Azure Storage Account Creation For Veeam Repo

In this article, we will discuss how to Leverage Azure Blob Storage as an Object Storage Repo in Veeam. Azure Storage Accounts provide the foundational management layer for storing cloud data in Microsoft Azure. They create a unique, secure, highly scalable, and globally accessible namespace for your data. Azure Storage Account give you access to Azure’s core storage services. Such as the Blob Storage (object storage), Azure Files (SMB file shares), Queue Storage (messaging), and Table Storage (NoSQL key-value data). Please see Azure Storage: How to create Blob Storage and upload files.

An object storage repository is a repository intended for long-term data storage. It is based on either a cloud solution or S3 compatible on-premises storage solutions. Veeam Backup & Replication supports the following types of object storage repositories:

Veeam Data Cloud Vault
Amazon S3, Amazon S3 Glacier and AWS Snowball Edge
S3 compatible, S3 compatible with data archiving
Google Cloud
IBM Cloud
Wasabi Cloud Storage
Microsoft Azure Blob, Azure Archive Storage and Azure Data Box
11:11 Cloud Object Storage

Please see how to Setup iSCSI Target and Storage LUN on Synology DS923+ for VBR. Here is how to Setup DS923+ Synology NAS as a Backup Repository for VBR.

Types of storage accounts

As mentioned above, Azure Storage offers several types of storage accounts. Each type supports different features and has its own pricing model. To learn more about blob storage, please take a look at this Microsoft Learn article.

This matrix below outlines the different Azure storage account tiers. It shows that Standard general-purpose v2 provides versatile, multi-service storage with maximum redundancy options for typical workloads. While the Premium tiers offer specialized, low-latency performance optimized individually for block blobs, file shares, or page blobs.

Out focus in this guide will be the Blob Storage. As shown, it is designed for high-performance workloads that require low latency and high transaction rates. Therefore ideall for applications with frequent read/write operations, and Small object sizes and high IOPS requirements. This storage type provides higher performance than standard storage.

Please see Deploy a Static Website to Azure Storage from VSCode, Azure CLI: How To Upload Batch Files to Azure Storage Account, and Running PowerShell remotely on Azure VMs.

Create Azure Blob Storage

Note: Unlike in previous versions, with Veeam Backup & Replication v12.1 and v13, Azure Blob Storage can be used directly as a backup repository and is no longer limited to Capacity Tier usage. You can take a look at this guide to learn more “Achieve 3-2-1 rule with SOBR on Synology or OOTBI and Wasabi“.

Note: Before proceeding to create an Azure Blob Storage. You can decide to create a Reource Group before hand or during the Azure Storage Account creation. This is because, every resource (VMs, storage accounts, networks, etc.) must belong to a resource group.

To create an Azure Blob Staorage. Log in to the Azure Portal and search for Storage accounts or click on “more servces”.

Click on Storage Account as shown below.

Next, click on “Create” as shown below.

Please see PXE Boot Failure: “Access Denied or Aborted” with Secure Boot on [Part 4], Advanced Tape Troubleshooting: Diagnosing Veeam LTO Drive Issues with ITDT, and how to protect Microsoft 365 beyond native limits with VDC [Part 1].

Create a Resource Group

A resource group is a logical container in Azure. It organizes resources and enables lifecycle management, deployment control, and RBAC-based access management.

As already mentioned, you can create a resource group before hand or during the creation of an Azure Storage Account. To do this, navigate to “Resource Groups”, and click on “Create”. Enter the “Name” and desired region closest to you. When you are done, click on “Review + Create”.

Since this has not been created previously, I will create a resource group on the fly as shown below.

Enter the Storage Account name, region and ensure you select the “Standard” performnce tier. For the preferrable storage type, select Azure Blob Storage or Azure Data Lake Storage Gen 2 and click Next.

Please see how to create an App Service Plan with Continuous Deployment to deploy a .NET Application from GitHub. Also, see how to Install Azure Storage Explorer on Windows.

Blob Storage Access Tier

Azure offers three storage tiers to store data in blob storage. They are “Hot Access tier, Cool Access tier, and Cold (Archive tier)”. These tiers target data at different stages of its lifecycle and offer cost-effective storage options for different use cases. Take a look at this link for Azure Blob Storage pricing. For my usecase, I will select “Cool” and click on Next.

Under “Public Network Access”, I will select Enable as shown below. Ensure Public network access scope is also enabled for all network and click on Next.

Under data protection, ensure enable versioning for blobs is enabled as shown below and click Next.

Please see Azure Resource Locks: Protecting Critical Cloud Resources from Accidental and Malicious Deletion. Also see how to Fix Operating System Loader failed signature verification” on Dell Safe BIOS Systems via PXE [Part 3].

Configure Azure Secuirty Settings

In the Advanced tab, under Security, I will keep the default settings as shown below and click Next.

Note: Do not enable Microsoft Defender for Storage. At this time, this Microsoft Defender for Storage is not supported by Veeam. Please see this guide if you wish to learn more about Microsoft fo r Cloud.

Select your encryption type as shown below. Enable support for customer-managed keys for Blob and files only and click Next.

At this point, I do not care about Tags. Therefore, I will click “Next”Review and Create”.

Note: If you did not specify a unique storage account name. The creation of the Azure Storage Account will fail with the error message below.

This is because, Azure Storage Account names must be **globally unique across all Microsoft Azure customers worldwide. It is not just within your own subscription or tenant. Since the name `veeambackupstore01` is highly generic, I assume another user has already registered it under the standard public namespac.

This means you must choose a completely unique name as shown below. This will ensure a preflight validation check passes successfully.

Click on “Review and Create” as shown below.

As you can see, the Storage Account has been deployed. You can view deployment details by navigating to the resources as shown below.

Get Access Keys

Access keys ensures your applications (Required for Veeam) are able to authenticate too the stoage account. To copy the access key, navigate to the Storage account and click on “Access keys” as shown below.

Please see Steps to customize Windows PE boot images, and Tape Backup Troubleshooting in Veeam: Real Cases. Also, see [World Backup Day] V13 Upgrade Failure: Veeam Configuration Backup Saved the Day.

Create the Blob Container

A container organizes a set of blobs, similar to a directory in a file system. A storage account can include an unlimited number of containers, and a container can store an unlimited number of blobs. Azure Blob Storage offers three types of resources as shown below:

The storage account
A container in the storage account
A blob in a container

To create a blob container, from the storage account. Click on “Containers” under Data Storage and click on “Create a new container.

In the new Container window, enter the container name as shown below. In this window, I will ensure that I enable “Enable version-level immuntability support” and cick on Create.

As you can see, we have successfully created our container which will be consmed by Veeam very shortly.

Note: From the VBR console. we will map this repository to this container. And create a folder path inside the container during repository creation.

Please see Update WinPE Boot Images with Windows UEFI CA Certificates [Part 2], How to perform Tape Drive Cleaning in Practice, and Active Directory Vulnerability Assessment with Purple Knight: Domain Controller Owner Is Not an Administrator.

Add Azure Blob to Veeam Backup & Replication v13

To add Azure Blob Storage as an Object Storage repository in Veeam, open the Veeam Backup & Replication console. Navigate to Backup Infrastructure and select Backup Repositories. From there, click either the working area or the ribbon menu, then choose Add Repository.

Click on Object Storage as shown below.

Next, select Hyperscalers in order to be able to add Azure Blob Storage

Select Microsoft Azure Storage

Click on Azure Blob Storage from the window below.

Please see Fix unable to contact Server: This may be the server does not exist, how to fix ADDS already contain a computer account, and AZURE Kubernetes Service (AKS) upgrade minor version from 1.32.3 to 1.33.7.

New Object Stoage Repository

Enter a name of your choice in the Object Storage Repository Name field. And optionally provide a description to help identify its purpose and click on Next.

Object Staorage Name — If you want to limit the maximum number of tasks that can be processed at once. Select the Limit concurrent tasks to “N” check box.

At the Account step of the wizard, Add a new credential or select your Credentials using the drop-down list. This credential will be used to access the Azure Blob storage

Since I do not already have a credential added. I will click on “Add” and select “Microsoft Azure Storage Account (Shared Keys). If you wish to conenct via Entra ID, please see the following Help Center article.

Enter the Access Key details we copied earlier into the wizard below and click on OK.

Add credentials and Select Region

Ensure you have the right region selected and conenction mode as well and click on Next to proceed.

Region And Conenction Mode — The Direct connection mode instantly moves data of processed VMs or file shares to object storage repositories

If you are not fine with the Direct conenction mode. You can select a gateway server and VBR will automatically determine the most suitable gateway from the list below.

Direct Connection Mode — By default, the role of a gateway server is assigned to the Veeam Backup & Replication server. You can choose any Microsoft Windows or Linux server that is added to your backup infrastructure and has internet connection. Note that you must add the server to the backup infrastructure beforehand.

Shortly, this will load the Microsoft Azure Configuration

From the Container drop-down list, select a container we created above. Use the “Browse” button to create a “folder”

Storage Container Selection — Make sure that the container where you want to store your backup data was created in advance. And note that the Root Container is not supported.

Here, you can use the Browse button to either select an existing folder. Or create a New Folder as shown below.

Select the created folder and click on OK.

Next, select the “Limit object storage consumption” check box to define a soft limit for your object storage consumption. If this limit is exceeded during a job run, Veeam Backup & Replication will complete the job.

However, a new job will not be able to start unless you remove the extra data that exceeds the limit or change the soft limit settings. Provide the value in TB or PB.

Also, ensure you select “Make backups immutable”. Immutability prohibits deletion of blocks of data from your object storage repository.

Note: The default immutability period is 30 days. You can set the immutability period to different values in the Veeam Backup & Replication UI. The minimum immutability period is 1 day, and the maximum is 999 days.

Access Tier

Also, the access tier settings define the cost and performance of data that you keep in Azure Blob object storage. Use the “Cool” option if you plan to access your data rarely (for example, once in a month or less). Also when you plan to store data at least for 30 days.

Note: If you select the Cool option and plan to use this object storage as a performance or capacity tier. Do not target to this repository any jobs that constantly send backup data to this storage: scheduled regular backup and backup copy jobs that run without GFS. Jobs with transactions logs enabled, jobs created by Veeam Plug-Ins for Enterprise Applications. Otherwise, it will result in higher costs.

Note: Azure Blob storage may apply a different access tier to your backup data and metadata than the settings specified in Veeam Backup & Replication. If your Azure storage account access tier differs from those set in Veeam Backup & Replication.

Container — In the Immutability Settings window, specify how the immutability period is counted and set the immutability period in days:

I will change the this access tier to reflect the access tier i created above during the storage account creation.

he mount server is a component that Veeam Backup & Replication uses for restore operation.

Please see Reset or reinstall Windows Server without deleting the VM, and Build a New DC vs Swing Migration: Upgrade Server OS Correctly.

Review Repository Components

As you can see, the following Veeam components has already been installed. Therefore, I will click on Apply.

Note: If the backup repository contains backups, select the Search the repository for existing backups and import them automatically check box. Veeam Backup & Replication will scan the backup repository to detect existing backup files and display them in the Veeam Backup & Replication console under the Backups > Object Storage (Imported) node. Also, if the backup repository contains guest file system index files, select the Import guest file system index data to the catalog check box. Veeam Backup & Replication will import index files together with backup files, and you will be able to search for guest OS files inside imported backups.

At the Apply step of the wizard, wait for Veeam Backup & Replication to complete saving your settings to the configuration database and create backup infrastructure objects.

At the Summary window, click on “Finish” as shown below.

As ylu can see below, we have successfully added Azure Blob Storage to Veeam Backup and Replication.

Please see how to Set up Veeam Backup for Microsoft Azure, Azure File Sync : How to enable Self-Service restore, and steps to Run MBR and GPT conversion with the best GPT converter.

Create a Backup Job

You can proceed and create a Backup job by clicking on “Backup Job” as shown below.

Enter the job name and a description to enable easy identification of the job without editing on the job and checking on the repository.

Use the Add button under the Virtual Machine window to add machines to be processed.

Here, I will select the TDASCVMM Virtual Machine. Here is a guide on “how to integrate Hyper-V: Install System Center Virtual Machine Manager”.

VM selected! Click Next to continue.

Selct the Repository we created above. In this case, this is the AZTDABlogStorage.

Pleae see Fix missing path and delete a Veeam Backup Repository, and how to Change Active Directory Domain name from dot local to dot com.

Enable Guest File System Indexing and Malware detection

Note: If you do not set an account that has permission on the VM. you will get the following error “ Unable to perform guest file system indexing: Failed to install via Deployment Svc“.

To mitigate this issue, select a user account that has enough permissions on the VM. If you have not set up credentials beforehand. Click the Add button to add credentials.

I will enter the device account “Administrator”and password and then click on OK.

As you can see, we have populated the Guest OS Credential field as shown below. Instead of proceeding blindly, you can click on verifiy network conenctivity and credentials.

As you can see below, the test connectivity and credential were completed successfully.

Click Next to proceed.

At this time, I will not configure the jobs to run automatically. I will click on “Apply”

On the “Summary” window, I will check the box to run the job when I click Finish. Finially, I will click on Finish.

As you can see below, our backup job completed successfully.

Summary

By disabling soft delete to control operational expenditures, and utilizing version-level immutability. We have built a bulletproof, high-performance offsite repository.

As you can see above, he job is completed successfully. This ensure that our environment (infrastructure) is audit-ready, secure against extortion threats (ransomeware, and positioned perfectly for automated disaster recovery scaling. Lastly, the Storage Center (Blob Storage) dashboard provides a centralized overview of storage accounts and their security and feature status as we have enabled.

I hope you found this guide very useful on how to Leverage Azure Blob Storage as an Object Storage Repo in Veeam. Please feel free to leave a comment below.