Azure Backup and Azure Site Recovery are often mentioned in the same breath, but they solve different problems. Here's what each one does for your Azure virtual machines, and how to decide what you need.
Microsoft draws the line clearly in its own documentation: Azure Backup focuses on data protection, backup and restore, while Azure Site Recovery handles disaster recovery and failover orchestration. Both live in a Recovery Services vault and you manage them from the same place in the portal, which is partly why they get confused.
| Azure Backup | Azure Site Recovery | |
|---|---|---|
| Main job | Restore data to an earlier point in time | Keep systems running in another region |
| Protects against | Accidental deletion, corruption, ransomware | Regional or zonal outages, planned maintenance |
| How it works | Scheduled snapshots copied to a vault, kept per your retention policy | Continuous replication of VM disks to a secondary region |
| Typical data loss (RPO) | Up to the time since the last backup: once a day on the Standard policy, as often as every 4 hours on the Enhanced policy | Low: Azure VMs are replicated continuously |
| Recovery | Restore files, disks or a whole VM | Fail over a VM or a group of VMs, then fail back later |
| History kept | Days to years | Short-term recovery points, measured in days |
Summarised from Microsoft Learn at time of writing.
The most important row is the last one. Site Recovery copies changes to the other region almost as they happen. That's exactly what you want if a region goes down, and exactly what you don't want if ransomware encrypts your server: the encrypted data replicates too. That's why replication is never a substitute for backup.
For Azure VMs there's no backup server to build or maintain: you attach a backup policy to each VM and Azure Backup does the rest. The policy decides two things, how often and how long:
The features that matter most for ransomware are the ones protecting the backups themselves:
Microsoft's own security guidance suggests setting soft delete retention above 35 days or aligning it with your backup retention, so deleted data stays recoverable for as long as your policy says it should.
Site Recovery continuously replicates your VMs from one Azure region to another. If the primary region has an outage, you fail over and your VMs start in the secondary region from the replicated data. When the primary is healthy again, you fail back.
Three details are worth knowing before you rely on it:
One planning point Microsoft calls out: capacity in the target region is best-effort unless you reserve it with an on-demand capacity reservation, which costs extra.
Both are pay-as-you-go Azure services, so the bill depends on what you protect. Rather than quote rates that change, here's what drives each one:
For a wider view of how Azure bills compute and storage, see our guide to Azure pricing in Singapore.
If you run in the Southeast Asia region, which is Singapore, your vault's storage redundancy decides where backup copies are kept:
| Vault storage option | Where copies are kept | Survives |
|---|---|---|
| Locally redundant (LRS) | Three copies in one datacentre in Singapore | Hardware failure |
| Zone-redundant (ZRS) | Across availability zones in Singapore | Loss of a datacentre |
| Geo-redundant (GRS) | Singapore plus the paired region, East Asia (Hong Kong) | A region-wide outage |
With GRS you can also turn on Cross Region Restore to restore VMs in Hong Kong whenever you choose, for a drill or an outage, rather than waiting for Microsoft to declare a disaster. Microsoft notes it can take up to 48 hours for backup items to become available in the secondary region after you enable it.
For most SMEs on Azure, the gap isn't missing tools; it's tools nobody has configured, monitored or tested. Under the PDPA's Protection Obligation you must make reasonable security arrangements for personal data, and being able to recover it after ransomware or an outage is part of that. Backup and recovery also feature in CSA Cyber Essentials.
At Cloudeli, every Azure Managed Services package includes backup. Azure Care (US$1,100 per month management fee) has backup configured and monitored; Azure Managed (US$2,100) adds managed backup with restore testing; and Azure Complete (US$3,800) adds disaster recovery runbooks and tested failover. Fees are on a 12-month agreement, excluding GST, with Azure consumption billed separately.
Azure Backup keeps point-in-time copies of your data so you can restore files, disks or whole VMs after deletion, corruption or ransomware. Azure Site Recovery continuously replicates VMs to another region so you can fail over and keep running during an outage. Microsoft describes Backup as data protection and Site Recovery as disaster recovery and failover orchestration.
Every production VM should have Azure Backup, because replication copies mistakes and ransomware as faithfully as good data. Add Site Recovery for systems your business can't be without for the hours or days a regional restore could take.
Site Recovery is charged per protected instance, and each instance is free for its first 31 days of protection. You also pay for the replica storage, storage transactions and data transfer, and for compute only while VMs are running in the recovery region during a drill or a real failover.
Soft delete is on by default for new Recovery Services vaults and keeps deleted backup data for 14 days by default, at no extra cost. You can extend that period up to 180 days and make soft delete always-on, and immutable vaults can block operations that would delete recovery points.
It depends on the vault's storage redundancy. Locally redundant and zone-redundant storage keep backup data in the region you choose. Geo-redundant storage replicates it to the paired region, which for Southeast Asia (Singapore) is East Asia (Hong Kong).
Book a free consultation. We'll review which VMs are backed up, how long a restore would really take, and whether any of your systems need Site Recovery as well.
