12.3 Implementing Security Controls to Protect Backups

The Attack Pattern You Are Defending Against

A competent ransomware operator does not start by encrypting data. They start by deleting the backups, because that removes the victim's only alternative to paying. The sequence is predictable: obtain a privileged Azure identity, open the Recovery Services vault, stop protection with "delete backup data", then encrypt production. Every control below exists to break one step of that chain.

---

Vault Soft Delete

Soft delete keeps deleted backup data recoverable rather than destroying it immediately.

The critical nuance: with basic soft delete, an attacker with vault privileges can disable soft delete first and then delete the data, defeating the control. Enabling always-on soft delete removes that option permanently — you cannot turn it back off, which is exactly why it is a security control rather than a convenience toggle.

---

Immutable Vaults

An immutable vault blocks any operation that could reduce the recoverability of existing data:

• Reducing a backup policy's retention duration.
• Deleting a recovery point or stopping protection with delete data.
• Changing a policy in a way that shortens retention.

Operations that increase protection remain allowed, so immutability is not a freeze on operations — it is a one-way ratchet.

Immutability has two states:

1. Enabled (unlocked) — reversible while you validate the impact on your operations.
2. Enabled and locked — irreversible. Neither you nor Microsoft support can remove it.

The exam scenario is almost always "a compliance mandate requires that recovery points cannot be deleted before their retention expires, even by an administrator" → immutable vault, locked.

---

Multi-User Authorization and Resource Guard

Multi-user authorization (MUA) implements four-eyes control over destructive backup operations.

How it works:

1. A Resource Guard resource is created — critically, in a different subscription and ideally a different Microsoft Entra tenant from the vault.
2. The vault is associated with the Resource Guard.
3. Protected operations (disabling soft delete, removing MUA, reducing retention, stopping backup with data deletion, changing MARS security PIN) now require the caller to hold a role such as Backup MUA Operator on the Resource Guard.
4. The backup administrator does not hold standing access to the Resource Guard. They request just-in-time access through PIM, which a different security administrator approves.

The security property is separation of blast radius: compromising the backup administrator's account is no longer sufficient, because the approval authority lives in an identity boundary the attacker has not breached. If a scenario says "even a compromised backup administrator must not be able to delete backups", MUA with a cross-tenant Resource Guard is the answer — immutability alone protects existing recovery points but does not require a second human.

---

MARS Agent and Hybrid Backup Security

For on-premises workloads protected with the Microsoft Azure Recovery Services (MARS) agent, Azure adds agent-specific controls:

• Security PIN required for critical operations: changing the passphrase, stopping backup with data deletion, and reducing retention. The PIN is generated in the Azure portal by an identity with vault access, so malware on the protected server cannot produce it.
• Deleted backup data is retained for 14 days at no cost, with alerts raised to vault contacts.
• Minimum retention enforcement prevents an attacker from reducing retention to near-zero as a precursor to deletion.
• The passphrase encrypts data before it leaves the server and is not known to Microsoft, so it must be escrowed — losing it means losing the ability to restore.

---

Role Separation, Encryption, and Network Isolation

Least-privilege backup roles:

Give day-to-day teams Backup Operator, keep Backup Contributor in a PIM-eligible role, and never grant subscription Owner as a shortcut.

Encryption: vault data is encrypted at rest with platform-managed keys by default; switch to customer-managed keys where policy requires key ownership, and enable infrastructure encryption for double encryption. For Azure VM backups, the disks' own encryption (ADE or CMK-backed SSE) carries into the recovery points.

Network isolation: deploy private endpoints for the Recovery Services vault so backup and restore traffic from Azure VMs and MARS agents never traverses public endpoints, and disable public network access on the vault.

Cross Region Restore on a geo-redundant vault gives you a restore path in the paired region without waiting for a Microsoft-declared outage — useful when a regional incident coincides with an attack.

Monitoring: route Backup vault diagnostic logs and Azure Monitor alerts for jobs and security events to your Log Analytics workspace, and build a Sentinel analytics rule for "protection stopped with delete data" and "soft delete disabled". Those two events are among the highest-fidelity ransomware precursors available in Azure.