Backup Vaults - Create Or Update

Creates or updates a BackupVault resource belonging to a resource group.

PUT https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.DataProtection/backupVaults/{vaultName}?api-version=2025-01-01

URI Parameters

Name In Required Type Description
resourceGroupName
path True

string

The name of the resource group. The name is case insensitive.

subscriptionId
path True

string

uuid

The ID of the target subscription. The value must be an UUID.

vaultName
path True

string

The name of the backup vault.

api-version
query True

string

The API version to use for this operation.

Request Header

Name Required Type Description
x-ms-authorization-auxiliary

string

Request Body

Name Required Type Description
location True

string

Resource location.

properties True

BackupVault

BackupVault
BackupVaultResource properties

eTag

string

Optional ETag.

identity

DppIdentityDetails

DppIdentityDetails
Input Managed Identity Details

tags

object

Resource tags.

Responses

Name Type Description
200 OK

BackupVaultResource

OK

201 Created

BackupVaultResource

Created

Other Status Codes

CloudError

Error response describing why the operation failed.

Security

azure_auth

Azure Active Directory OAuth2 Flow

Type: oauth2
Flow: implicit
Authorization URL: https://login.microsoftonline.com/common/oauth2/authorize

Scopes

Name Description
user_impersonation impersonate your user account.

Examples

Create BackupVault
Create BackupVault With CMK
Create BackupVault With MSI

Create BackupVault

Sample request

PUT https://management.azure.com/subscriptions/0b352192-dcac-4cc7-992e-a96190ccc68c/resourceGroups/SampleResourceGroup/providers/Microsoft.DataProtection/backupVaults/swaggerExample?api-version=2025-01-01

{
  "location": "WestUS",
  "tags": {
    "key1": "val1"
  },
  "identity": {
    "type": "None"
  },
  "properties": {
    "monitoringSettings": {
      "azureMonitorAlertSettings": {
        "alertsForAllJobFailures": "Enabled"
      }
    },
    "storageSettings": [
      {
        "datastoreType": "VaultStore",
        "type": "LocallyRedundant"
      }
    ],
    "featureSettings": {
      "crossRegionRestoreSettings": {
        "state": "Enabled"
      }
    },
    "securitySettings": {
      "softDeleteSettings": {
        "state": "Enabled",
        "retentionDurationInDays": 14
      }
    }
  }
}

Sample response

Retry-After: 10
Azure-AsyncOperation: https://management.windowsazure.com/subscriptions/04cf684a-d41f-4550-9f70-7708a3a2283b/resourceGroups/SampleResourceGroup/providers/Microsoft.DataProtection/Backupvaults/swaggerExample/operationStatus/YWUzNDFkMzQtZmM5OS00MmUyLWEzNDMtZGJkMDIxZjlmZjgzOzdmYzBiMzhmLTc2NmItNDM5NS05OWQ1LTVmOGEzNzg4MWQzNA==?api-version=2025-01-01
{
  "id": "/subscriptions/0b352192-dcac-4cc7-992e-a96190ccc68c/resourceGroups/SampleResourceGroup/providers/Microsoft.DataProtection/Backupvaults/swaggerExample",
  "name": "swaggerExample",
  "type": "Microsoft.DataProtection/Backupvaults",
  "location": "WestUS",
  "tags": {
    "key1": "val1"
  },
  "properties": {
    "monitoringSettings": {
      "azureMonitorAlertSettings": {
        "alertsForAllJobFailures": "Enabled"
      }
    },
    "provisioningState": "Provisioning",
    "storageSettings": [
      {
        "datastoreType": "VaultStore",
        "type": "LocallyRedundant"
      }
    ],
    "featureSettings": {
      "crossRegionRestoreSettings": {
        "state": "Enabled"
      }
    },
    "securitySettings": {
      "softDeleteSettings": {
        "state": "Enabled",
        "retentionDurationInDays": 14
      }
    },
    "secureScore": "Adequate"
  }
}
{
  "identity": {
    "type": "None"
  },
  "id": "/subscriptions/0b352192-dcac-4cc7-992e-a96190ccc68c/resourceGroups/SampleResourceGroup/providers/Microsoft.DataProtection/Backupvaults/swaggerExample",
  "name": "swaggerExample",
  "type": "Microsoft.DataProtection/Backupvaults",
  "location": "WestUS",
  "tags": {
    "key1": "val1"
  },
  "properties": {
    "monitoringSettings": {
      "azureMonitorAlertSettings": {
        "alertsForAllJobFailures": "Enabled"
      }
    },
    "provisioningState": "Succeeded",
    "storageSettings": [
      {
        "datastoreType": "VaultStore",
        "type": "LocallyRedundant"
      }
    ],
    "featureSettings": {
      "crossRegionRestoreSettings": {
        "state": "Enabled"
      }
    },
    "securitySettings": {
      "softDeleteSettings": {
        "state": "Enabled",
        "retentionDurationInDays": 14
      }
    },
    "secureScore": "Adequate"
  }
}

Create BackupVault With CMK

Sample request

PUT https://management.azure.com/subscriptions/0b352192-dcac-4cc7-992e-a96190ccc68c/resourceGroups/SampleResourceGroup/providers/Microsoft.DataProtection/backupVaults/swaggerExample?api-version=2025-01-01

{
  "location": "WestUS",
  "tags": {
    "key1": "val1"
  },
  "identity": {
    "type": "None"
  },
  "properties": {
    "monitoringSettings": {
      "azureMonitorAlertSettings": {
        "alertsForAllJobFailures": "Enabled"
      }
    },
    "securitySettings": {
      "softDeleteSettings": {
        "state": "Off",
        "retentionDurationInDays": 0
      },
      "immutabilitySettings": {
        "state": "Disabled"
      },
      "encryptionSettings": {
        "state": "Enabled",
        "keyVaultProperties": {
          "keyUri": "https://cmk2xkv.vault.azure.net/keys/Key1/0767b348bb1a4c07baa6c4ec0055d2b3"
        },
        "kekIdentity": {
          "identityType": "UserAssigned",
          "identityId": "/subscriptions/85bf5e8c-3084-4f42-add2-746ebb7e97b2/resourcegroups/defaultrg/providers/Microsoft.ManagedIdentity/userAssignedIdentities/examplemsi"
        },
        "infrastructureEncryption": "Enabled"
      }
    },
    "storageSettings": [
      {
        "datastoreType": "VaultStore",
        "type": "LocallyRedundant"
      }
    ]
  }
}

Sample response

Retry-After: 10
Azure-AsyncOperation: https://management.windowsazure.com/subscriptions/04cf684a-d41f-4550-9f70-7708a3a2283b/resourceGroups/SampleResourceGroup/providers/Microsoft.DataProtection/Backupvaults/swaggerExample/operationStatus/YWUzNDFkMzQtZmM5OS00MmUyLWEzNDMtZGJkMDIxZjlmZjgzOzdmYzBiMzhmLTc2NmItNDM5NS05OWQ1LTVmOGEzNzg4MWQzNA==?api-version=2023-04-01-privatepreview
{
  "id": "/subscriptions/0b352192-dcac-4cc7-992e-a96190ccc68c/resourceGroups/SampleResourceGroup/providers/Microsoft.DataProtection/Backupvaults/swaggerExample",
  "name": "swaggerExample",
  "type": "Microsoft.DataProtection/Backupvaults",
  "location": "WestUS",
  "tags": {
    "key1": "val1"
  },
  "properties": {
    "monitoringSettings": {
      "azureMonitorAlertSettings": {
        "alertsForAllJobFailures": "Enabled"
      }
    },
    "securitySettings": {
      "softDeleteSettings": {
        "state": "Off",
        "retentionDurationInDays": 0
      },
      "immutabilitySettings": {
        "state": "Disabled"
      },
      "encryptionSettings": {
        "state": "Enabled",
        "keyVaultProperties": {
          "keyUri": "https://cmk2xkv.vault.azure.net/keys/Key1/0767b348bb1a4c07baa6c4ec0055d2b3"
        },
        "kekIdentity": {
          "identityType": "UserAssigned",
          "identityId": "/subscriptions/85bf5e8c-3084-4f42-add2-746ebb7e97b2/resourcegroups/defaultrg/providers/Microsoft.ManagedIdentity/userAssignedIdentities/examplemsi"
        },
        "infrastructureEncryption": "Enabled"
      }
    },
    "provisioningState": "Provisioning",
    "storageSettings": [
      {
        "datastoreType": "VaultStore",
        "type": "LocallyRedundant"
      }
    ]
  }
}
{
  "identity": {
    "type": "None"
  },
  "id": "/subscriptions/0b352192-dcac-4cc7-992e-a96190ccc68c/resourceGroups/SampleResourceGroup/providers/Microsoft.DataProtection/Backupvaults/swaggerExample",
  "name": "swaggerExample",
  "type": "Microsoft.DataProtection/Backupvaults",
  "location": "WestUS",
  "tags": {
    "key1": "val1"
  },
  "properties": {
    "monitoringSettings": {
      "azureMonitorAlertSettings": {
        "alertsForAllJobFailures": "Enabled"
      }
    },
    "provisioningState": "Succeeded",
    "storageSettings": [
      {
        "datastoreType": "VaultStore",
        "type": "LocallyRedundant"
      }
    ]
  }
}

Create BackupVault With MSI

Sample request

PUT https://management.azure.com/subscriptions/0b352192-dcac-4cc7-992e-a96190ccc68c/resourceGroups/SampleResourceGroup/providers/Microsoft.DataProtection/backupVaults/swaggerExample?api-version=2025-01-01

{
  "location": "WestUS",
  "tags": {
    "key1": "val1"
  },
  "identity": {
    "type": "systemAssigned"
  },
  "properties": {
    "monitoringSettings": {
      "azureMonitorAlertSettings": {
        "alertsForAllJobFailures": "Enabled"
      }
    },
    "storageSettings": [
      {
        "datastoreType": "VaultStore",
        "type": "LocallyRedundant"
      }
    ],
    "featureSettings": {
      "crossRegionRestoreSettings": {
        "state": "Enabled"
      }
    },
    "securitySettings": {
      "softDeleteSettings": {
        "state": "Enabled",
        "retentionDurationInDays": 14
      }
    }
  }
}

Sample response

Retry-After: 10
Azure-AsyncOperation: https://management.windowsazure.com/subscriptions/04cf684a-d41f-4550-9f70-7708a3a2283b/resourceGroups/SampleResourceGroup/providers/Microsoft.DataProtection/Backupvaults/swaggerExample/operationStatus/YWUzNDFkMzQtZmM5OS00MmUyLWEzNDMtZGJkMDIxZjlmZjgzOzdmYzBiMzhmLTc2NmItNDM5NS05OWQ1LTVmOGEzNzg4MWQzNA==?api-version=2025-01-01
{
  "id": "/subscriptions/0b352192-dcac-4cc7-992e-a96190ccc68c/resourceGroups/SampleResourceGroup/providers/Microsoft.DataProtection/Backupvaults/swaggerExample",
  "name": "swaggerExample",
  "type": "Microsoft.DataProtection/Backupvaults",
  "location": "WestUS",
  "tags": {
    "key1": "val1"
  },
  "properties": {
    "monitoringSettings": {
      "azureMonitorAlertSettings": {
        "alertsForAllJobFailures": "Enabled"
      }
    },
    "provisioningState": "Provisioning",
    "storageSettings": [
      {
        "datastoreType": "VaultStore",
        "type": "LocallyRedundant"
      }
    ],
    "featureSettings": {
      "crossRegionRestoreSettings": {
        "state": "Enabled"
      }
    },
    "securitySettings": {
      "softDeleteSettings": {
        "state": "Enabled",
        "retentionDurationInDays": 14
      }
    },
    "secureScore": "Adequate"
  }
}
{
  "identity": {
    "principalId": "c009b9a0-0024-417c-83cd-025d3776045d",
    "tenantId": "83abe5cd-bcc3-441a-bd86-e6a75360cecc",
    "type": "SystemAssigned"
  },
  "id": "/subscriptions/0b352192-dcac-4cc7-992e-a96190ccc68c/resourceGroups/SampleResourceGroup/providers/Microsoft.DataProtection/Backupvaults/swaggerExample",
  "name": "swaggerExample",
  "type": "Microsoft.DataProtection/Backupvaults",
  "location": "WestUS",
  "tags": {
    "key1": "val1"
  },
  "properties": {
    "monitoringSettings": {
      "azureMonitorAlertSettings": {
        "alertsForAllJobFailures": "Enabled"
      }
    },
    "provisioningState": "Succeeded",
    "storageSettings": [
      {
        "datastoreType": "VaultStore",
        "type": "LocallyRedundant"
      }
    ],
    "featureSettings": {
      "crossRegionRestoreSettings": {
        "state": "Enabled"
      }
    },
    "securitySettings": {
      "softDeleteSettings": {
        "state": "Enabled",
        "retentionDurationInDays": 14
      }
    },
    "secureScore": "Adequate"
  }
}

Definitions

Name Description
AlertsState
AzureMonitorAlertSettings

Settings for Azure Monitor based alerts

BackupVault

BackupVault

BackupVaultResource

BackupVault Resource

BCDRSecurityLevel

Security Level of Backup Vault

CloudError

CloudError

CmkKekIdentity

The details of the managed identity used for CMK

CmkKeyVaultProperties

The properties of the Key Vault which hosts CMK

createdByType

The type of identity that created the resource.

CrossRegionRestoreSettings
CrossRegionRestoreState

CrossRegionRestore state

CrossSubscriptionRestoreSettings

CrossSubscriptionRestore Settings

CrossSubscriptionRestoreState

CrossSubscriptionRestore state

DppIdentityDetails

DppIdentityDetails

encryptionSettings

Customer Managed Key details of the resource.

EncryptionState

Encryption state of the Backup Vault.

Error

The resource management error response.

ErrorAdditionalInfo

The resource management error additional info.

FeatureSettings

Class containing feature settings of vault

IdentityType

The identity type. 'SystemAssigned' and 'UserAssigned' are mutually exclusive. 'SystemAssigned' will use implicitly created managed identity.

ImmutabilitySettings

Immutability Settings at vault level

ImmutabilityState

Immutability state

InfrastructureEncryptionState

Enabling/Disabling the Double Encryption state

MonitoringSettings

Monitoring Settings

ProvisioningState

Provisioning state of the BackupVault resource

ResourceMoveDetails

ResourceMoveDetails will be returned in response to GetResource call from ARM

ResourceMoveState

Resource move state for backup vault

SecureScoreLevel

Secure Score of Backup Vault

SecuritySettings

Class containing security settings of vault

SoftDeleteSettings

Soft delete related settings

SoftDeleteState

State of soft delete

StorageSetting

StorageSetting

StorageSettingStoreTypes

Gets or sets the type of the datastore.

StorageSettingTypes

Gets or sets the type.

systemData

Metadata pertaining to creation and last modification of the resource.

UserAssignedIdentity

User assigned identity properties

AlertsState

Value Description
Disabled
Enabled

AzureMonitorAlertSettings

Settings for Azure Monitor based alerts

Name Type Description
alertsForAllJobFailures

AlertsState

BackupVault

BackupVault

Name Type Description
bcdrSecurityLevel

BCDRSecurityLevel

Security Level of Backup Vault

featureSettings

FeatureSettings

Feature Settings

isVaultProtectedByResourceGuard

boolean

Is vault protected by resource guard

monitoringSettings

MonitoringSettings

Monitoring Settings

provisioningState

ProvisioningState

Provisioning state of the BackupVault resource

replicatedRegions

string[]

List of replicated regions for Backup Vault

resourceGuardOperationRequests

string[]

ResourceGuardOperationRequests on which LAC check will be performed

resourceMoveDetails

ResourceMoveDetails

Resource move details for backup vault

resourceMoveState

ResourceMoveState

Resource move state for backup vault

secureScore

SecureScoreLevel

Secure Score of Backup Vault

securitySettings

SecuritySettings

Security Settings

storageSettings

StorageSetting[]

Storage Settings

BackupVaultResource

BackupVault Resource

Name Type Description
eTag

string

Optional ETag.

id

string

Resource Id represents the complete path to the resource.

identity

DppIdentityDetails

DppIdentityDetails
Input Managed Identity Details

location

string

Resource location.

name

string

Resource name associated with the resource.

properties

BackupVault

BackupVault
BackupVaultResource properties

systemData

systemData

Metadata pertaining to creation and last modification of the resource.

tags

object

Resource tags.

type

string

Resource type represents the complete path of the form Namespace/ResourceType/ResourceType/...

BCDRSecurityLevel

Security Level of Backup Vault

Value Description
Excellent
Fair
Good
NotSupported
Poor

CloudError

CloudError

Name Type Description
error

Error

The resource management error response.

CmkKekIdentity

The details of the managed identity used for CMK

Name Type Description
identityId

string

The managed identity to be used which has access permissions to the Key Vault. Provide a value here in case identity types: 'UserAssigned' only.

identityType

IdentityType

The identity type. 'SystemAssigned' and 'UserAssigned' are mutually exclusive. 'SystemAssigned' will use implicitly created managed identity.

CmkKeyVaultProperties

The properties of the Key Vault which hosts CMK

Name Type Description
keyUri

string

The key uri of the Customer Managed Key

createdByType

The type of identity that created the resource.

Value Description
Application
Key
ManagedIdentity
User

CrossRegionRestoreSettings

Name Type Description
state

CrossRegionRestoreState

CrossRegionRestore state

CrossRegionRestoreState

CrossRegionRestore state

Value Description
Disabled
Enabled

CrossSubscriptionRestoreSettings

CrossSubscriptionRestore Settings

Name Type Description
state

CrossSubscriptionRestoreState

CrossSubscriptionRestore state

CrossSubscriptionRestoreState

CrossSubscriptionRestore state

Value Description
Disabled
Enabled
PermanentlyDisabled

DppIdentityDetails

DppIdentityDetails

Name Type Description
principalId

string

The object ID of the service principal object for the managed identity that is used to grant role-based access to an Azure resource.

tenantId

string

A Globally Unique Identifier (GUID) that represents the Azure AD tenant where the resource is now a member.

type

string

The identityType which can be either SystemAssigned, UserAssigned, 'SystemAssigned,UserAssigned' or None

userAssignedIdentities

<string,  UserAssignedIdentity>

Gets or sets the user assigned identities.

encryptionSettings

Customer Managed Key details of the resource.

Name Type Description
infrastructureEncryption

InfrastructureEncryptionState

Enabling/Disabling the Double Encryption state

kekIdentity

CmkKekIdentity

The details of the managed identity used for CMK

keyVaultProperties

CmkKeyVaultProperties

The properties of the Key Vault which hosts CMK

state

EncryptionState

Encryption state of the Backup Vault.

EncryptionState

Encryption state of the Backup Vault.

Value Description
Disabled

CMK encryption is disabled on the Backup Vault. User can not set this state once Encryption State is 'Enabled'.

Enabled

CMK encryption is enabled on the Backup Vault

Inconsistent

CMK encryption is in inconsistent state on the Backup Vault. This state indicates that user needs to retry the encryption settings operation immediately to correct the state.

Error

The resource management error response.

Name Type Description
additionalInfo

ErrorAdditionalInfo[]

The error additional info.

code

string

The error code.

details

Error[]

The error details.

message

string

The error message.

target

string

The error target.

ErrorAdditionalInfo

The resource management error additional info.

Name Type Description
info

object

The additional info.

type

string

The additional info type.

FeatureSettings

Class containing feature settings of vault

Name Type Description
crossRegionRestoreSettings

CrossRegionRestoreSettings

crossSubscriptionRestoreSettings

CrossSubscriptionRestoreSettings

CrossSubscriptionRestore Settings

IdentityType

The identity type. 'SystemAssigned' and 'UserAssigned' are mutually exclusive. 'SystemAssigned' will use implicitly created managed identity.

Value Description
SystemAssigned
UserAssigned

ImmutabilitySettings

Immutability Settings at vault level

Name Type Description
state

ImmutabilityState

Immutability state

ImmutabilityState

Immutability state

Value Description
Disabled
Locked
Unlocked

InfrastructureEncryptionState

Enabling/Disabling the Double Encryption state

Value Description
Disabled
Enabled

MonitoringSettings

Monitoring Settings

Name Type Description
azureMonitorAlertSettings

AzureMonitorAlertSettings

Settings for Azure Monitor based alerts

ProvisioningState

Provisioning state of the BackupVault resource

Value Description
Failed
Provisioning
Succeeded
Unknown
Updating

ResourceMoveDetails

ResourceMoveDetails will be returned in response to GetResource call from ARM

Name Type Description
completionTimeUtc

string

Completion time in UTC of latest ResourceMove operation attempted. ISO 8601 format.

operationId

string

CorrelationId of latest ResourceMove operation attempted

sourceResourcePath

string

ARM resource path of source resource

startTimeUtc

string

Start time in UTC of latest ResourceMove operation attempted. ISO 8601 format.

targetResourcePath

string

ARM resource path of target resource used in latest ResourceMove operation

ResourceMoveState

Resource move state for backup vault

Value Description
CommitFailed
CommitTimedout
CriticalFailure
Failed
InProgress
MoveSucceeded
PartialSuccess
PrepareFailed
PrepareTimedout
Unknown

SecureScoreLevel

Secure Score of Backup Vault

Value Description
Adequate
Maximum
Minimum
None
NotSupported

SecuritySettings

Class containing security settings of vault

Name Type Description
encryptionSettings

encryptionSettings

Customer Managed Key details of the resource.

immutabilitySettings

ImmutabilitySettings

Immutability Settings at vault level

softDeleteSettings

SoftDeleteSettings

Soft delete related settings

SoftDeleteSettings

Soft delete related settings

Name Type Description
retentionDurationInDays

number

Soft delete retention duration

state

SoftDeleteState

State of soft delete

SoftDeleteState

State of soft delete

Value Description
AlwaysOn

Soft Delete is permanently enabled for the BackupVault and the setting cannot be changed

Off

Soft Delete is turned off for the BackupVault

On

Soft Delete is enabled for the BackupVault but can be turned off

StorageSetting

StorageSetting

Name Type Description
datastoreType

StorageSettingStoreTypes

Gets or sets the type of the datastore.

type

StorageSettingTypes

Gets or sets the type.

StorageSettingStoreTypes

Gets or sets the type of the datastore.

Value Description
ArchiveStore
OperationalStore
VaultStore

StorageSettingTypes

Gets or sets the type.

Value Description
GeoRedundant
LocallyRedundant
ZoneRedundant

systemData

Metadata pertaining to creation and last modification of the resource.

Name Type Description
createdAt

string

The timestamp of resource creation (UTC).

createdBy

string

The identity that created the resource.

createdByType

createdByType

The type of identity that created the resource.

lastModifiedAt

string

The timestamp of resource last modification (UTC)

lastModifiedBy

string

The identity that last modified the resource.

lastModifiedByType

createdByType

The type of identity that last modified the resource.

UserAssignedIdentity

User assigned identity properties

Name Type Description
clientId

string

The client ID of the assigned identity.

principalId

string

The principal ID of the assigned identity.