Getting started with Datto Backup for Microsoft Azure: Azure Files & Azure Blob Storage
Datto Backup for Microsoft Azure: Azure Files & Azure Blob Storage is a backup solution purposefully built to protect the resources of Microsoft Azure tenants in the Microsoft Azure cloud infrastructure.
Environment 
- Datto Backup for Microsoft Azure: Azure Files
- Datto Backup for Microsoft Azure: Azure Blob Storage
Description
Datto Backup for Microsoft Azure: Azure Files provides resource backups for all commercial Microsoft Azure regions. Currently, the resource backup options include File Shares and Azure Blob Storage within the Microsoft Azure tenant but will be expanding.
Requirements 
-
The Microsoft Azure user that is used to add the protected Azure tenants will need to be a Global Admin Account, with multi-factor authentication enabled.
-
Storage Accounts configured cannot have network rules set to deny all public access. Accounts with such rules prevent Datto Backup for Microsoft Azure from displaying or adding those resources.
-
If your storage account Public Network Access is set to Enabled from selected virtual networks and IP addresses, you must grant Datto Backup for Microsoft Azure access to both East US region and the region your Storage Account is located. For more information on granting access refer to: Inaccessible storage account .
-
-
Only file shares configured with Server Message Block (SMB) access will be available. NFS shares cannot be added at this time.
Storage Overview
Datto Backup for Microsoft Azure uses zone-redundant storage (ZRS) for all backup data. ZRS replicates data synchronously across three availability zones within the same region, delivering 99.9999999999% durability. Your data remains protected and accessible even in the event of a zone-level outage, with no single point of failure at the storage level.
Backup data will be housed in the following geographical locations. Azure tenants in one of these locations will use the offsite storage listed.
- US
- Canada
- Netherlands
- Germany
- Australia
- UK
Microsoft Azure Tenants housed in other locations will store their data in one of the available locations based on proximity, compliance, and load balance.
Performance Tier
Backup data is stored across two performance tiers depending on its age:
-
Standard (Azure Hot equivalent)
Newly created backups are stored in the Standard tier, optimized for frequent access. This ensures fast retrieval during active recovery operations or shortly after a backup is taken.
-
Coldline (Azure Cold equivalent)
After 90 days, backup data is automatically transitioned to the Coldline tier. Coldline storage is optimized for infrequently accessed data. This transition happens automatically.
What this means for you:
- 99.9999999999% data durability backed by zone-redundant storage.
- Recent backups are immediately accessible at full speed.
- Older backups remain fully restorable from Coldline storage, with retrieval times that may be slightly longer than Standard tier.
Encryption
Datto Backup for Microsoft Azure protects backup data using industry-standard encryption at every stage of its lifecycle. Data is encrypted in transit using TLS and stored at rest using AES 256-bit encryption.
Data Integrity Verification
The integrity of backed-up data at both backup time and restore time is verified to ensure that data is complete and uncorrupted throughout its retention period.
-
Backup-time hashing
When a backup is performed, it computes a cryptographic hash for each item as it is read from the source. Hashes are stored alongside backup metadata in Datto's immutable backup storage, isolated from your production Azure resources.
-
Restore-time comparison
When a restore is initiated, the hash is re-computed for each object as it is read from backup storage and is compared against the hash recorded at backup time.
-
Incremental backup integrity
For incremental backups, only changed blocks or objects are re-hashed and re-transferred. Unchanged objects retain their previously verified hash from the last successful backup, ensuring integrity checks cover the entire backup chain.
Key takeaways
- Every backup and restore is verified automatically.
- AES 256-bit encryption at rest and TLS in transit protect data throughout its lifecycle.
- Integrity checks span the full backup chain, including incremental backups.
Immutable Storage
Backup data is written to Datto's immutable cloud storage. Once written, backup data cannot be modified or deleted — even by a compromised management account or a ransomware attack that gains access to your Azure environment.
Management portal
Datto Backup for Microsoft Azure: Azure Files & Azure Blob Storage is managed through the UniView portal (backup.net). In the Dashboard you can see all of the protected assets, their policies, and recent backup information across Datto Endpoint Backup v2 (if used) and Datto Backup for Microsoft Azure: Azure Files & Azure Blob Storage. The Dashboard also allows you to create restores, all from the same window.
Under Microsoft Azure in the collapsible menu on the left-hand side, the Tenants page can be used to manage and add Microsoft Azure tenants, while the Policy Management page can be used to edit and create the backup policies used for the assets protected with Datto Backup for Microsoft Azure: Azure Files.
Policy management
The policies are used to determine the backup and retention period for the assets of a protected Azure tenant. These policies are applied to all assets of a specified type in an Azure tenant. For more information on creating backup policies, adjusting settings, and managing current policies, refer to: Microsoft Azure – Policy Management.
Protecting a resource
The onboarding process includes assets for protection when you add an Azure tenant. For more information on adding Azure tenants and resource management refer to: Microsoft Azure – Tenants .
For more information on how to include new resources for protection, refer to: Automatic Inclusion .
Restore
Currently Datto Backup for Microsoft Azure: Azure Files & Azure Blob Storage offers Azure Restore. For more information on restoring protected assets, refer to Azure Restore.
