The proof: restore what you deleted.

Storage redundancy (LRS/ZRS/GRS) keeps extra copies of your data against a hardware failure — but it faithfully replicates a deletion or a ransomware encryption too, because it does not know the change was a mistake. A one-off snapshot is better, but nobody remembers to take them and nobody knows when the last one was. Azure Backup is the discipline in between: a policy takes recovery points on a schedule and keeps them for a set retention, in a Recovery Services vault that lives apart from the data it protects. This lab runs the whole loop on an Azure Files share — the cheapest, fastest workload that still teaches vault, policy, recovery point, and, the part that actually matters, the restore.

A backup you never restore is a rumour.

Create a storage account, a small file share, and drop one file in it — the thing you will later "lose."

# Windows/Git Bash: stop it mangling resource-id arguments (harmless on macOS/Linux)
export MSYS_NO_PATHCONV=1

SUFFIX=$RANDOM
RG="campux-lab-dr-rg"
LOCATION="eastus"
SA="campuxdr$SUFFIX"          # 3-24 lowercase alphanumeric
SHARE="campuxfiles"
VAULT="campux-dr-vault"
POLICY="campux-afs-policy"

az group create --name "$RG" --location "$LOCATION" -o table
az storage account create --name "$SA" --resource-group "$RG" \
  --location "$LOCATION" --sku Standard_LRS --kind StorageV2 -o none
az storage share-rm create --resource-group "$RG" \
  --storage-account "$SA" --name "$SHARE" --quota 1 -o none

# upload one throwaway file, using an account key
KEY=$(az storage account keys list -g "$RG" -n "$SA" --query "[0].value" -o tsv)
echo "The quarterly numbers nobody wants to lose." > payroll.csv
az storage file upload --account-name "$SA" --account-key "$KEY" \
  --share-name "$SHARE" --source payroll.csv -o none

The vault holds recovery points apart from the share. Set its redundancy while it is empty (you cannot change it once backups exist), then build a file-share policy from the built-in default template so you do not have to hand-write the schedule JSON.

az backup vault create --resource-group "$RG" --name "$VAULT" \
  --location "$LOCATION" -o table

# cheaper local redundancy for a throwaway lab — must run before any backup item exists
az backup vault backup-properties set --name "$VAULT" --resource-group "$RG" \
  --backup-storage-redundancy LocallyRedundant

# export the built-in default policy, then create our file-share policy from it
az backup policy show --resource-group "$RG" --vault-name "$VAULT" \
  --name DefaultVaultPolicy > afs-policy.json
az backup policy create --resource-group "$RG" --vault-name "$VAULT" \
  --policy afs-policy.json --name "$POLICY" \
  --backup-management-type AzureStorage

Enable protection, then trigger an on-demand backup rather than waiting for the schedule — you want a recovery point in hand and you want to watch a job finish.

az backup protection enable-for-azurefileshare \
  --vault-name "$VAULT" --resource-group "$RG" \
  --policy-name "$POLICY" --storage-account "$SA" \
  --azure-file-share "$SHARE" -o table

# capture the exact container + item names the later commands need
CONTAINER=$(az backup container list --resource-group "$RG" --vault-name "$VAULT" \
  --backup-management-type azurestorage --query "[0].name" -o tsv)
ITEM=$(az backup item list --resource-group "$RG" --vault-name "$VAULT" \
  --backup-management-type azurestorage --query "[0].name" -o tsv)

az backup protection backup-now \
  --vault-name "$VAULT" --resource-group "$RG" \
  --container-name "$CONTAINER" --item-name "$ITEM" \
  --retain-until 31-12-2026 -o table

Now lose it — the deleted spreadsheet, the fat-fingered delete, the everyday incident that item-level restore exists for.

az storage file delete --account-name "$SA" --account-key "$KEY" \
  --share-name "$SHARE" --path payroll.csv

az storage file exists --account-name "$SA" --account-key "$KEY" \
  --share-name "$SHARE" --path payroll.csv --query exists   # -> false

Find the recovery point and restore just that one file back to its original location.

# the newest recovery point
RP=$(az backup recoverypoint list --vault-name "$VAULT" --resource-group "$RG" \
  --container-name "$CONTAINER" --item-name "$ITEM" \
  --backup-management-type azurestorage --workload-type azurefileshare \
  --query "[0].name" -o tsv)

az backup restore restore-azurefiles \
  --vault-name "$VAULT" --resource-group "$RG" --rp-name "$RP" \
  --container-name "$CONTAINER" --item-name "$ITEM" \
  --restore-mode originallocation \
  --source-file-type file --source-file-path "payroll.csv" \
  --resolve-conflict overwrite -o table

Stop protection and clear the backup data, then remove the group. Soft delete is the trap here: a vault holding soft-deleted recovery points refuses to be deleted, so disable it first.

# disable soft delete so the cleared data is gone immediately, not held ~14 days
az backup vault backup-properties set --name "$VAULT" --resource-group "$RG" \
  --soft-delete-feature-state Disable

az backup protection disable \
  --vault-name "$VAULT" --resource-group "$RG" \
  --container-name "$CONTAINER" --item-name "$ITEM" \
  --backup-management-type azurestorage --workload-type azurefileshare \
  --delete-backup-data true --yes -o table

az group delete --name "$RG" --yes
az group exists --name "$RG"   # -> false

You created a Recovery Services vault, built a backup policy, protected an Azure Files share, took an on-demand recovery point, and — the part most engineers never do — actually restored, returning a deleted file from the vault to its original place. You know a vault stores recovery points apart from what they protect, that a policy is a schedule plus a retention, and that soft delete guards the backups themselves (and blocks a careless teardown). The same loop scales up: a full share restore, a full VM restore, or a cross-region restore where the vault is GRS. The one DR step this lab deliberately skips is an Azure Site Recovery test failover — it needs replicated VMs and target-region compute, so Class 36e — Azure Site Recovery covers it as a walkthrough rather than a paid exercise.