Data Encryption

By default, Azure Storage uses service-side encryption (SSE) to automatically encrypt data. For more information on Azure Storage encryption, see Microsoft Docs.

For enhanced data security, Veeam Backup for Microsoft Azure allows you to encrypt backed-up data in backup repositories using Veeam encryption mechanisms. Veeam Backup for Microsoft Azure encrypts backup files stored in backup repositories the same way as Veeam Backup & Replication encrypts backup files stored in backup repositories. To learn what algorithms Veeam Backup & Replication uses to encrypt backup files, see the Veeam Backup & Replication User Guide, section Encryption Standards.

To enable encryption for a backup repository added to Veeam Backup for Microsoft Azure, configure the repository settings as described in section Adding Backup Repositories and choose whether you want to encrypt backed-up data using a password or an Azure Key Vault cryptographic key. After you create a backup policy and specify the backup repository as a target location for Azure VM image-level backups, Azure SQL backups, Cosmos DB for PostgreSQL backups to a repository or virtual network configuration backup copies as described in sections Creating VM Backup Policies, Creating SQL Backup Policies, Creating Cosmos DB Backup Policies and Editing Virtual Network Configuration Backup Policy, Veeam Backup for Microsoft Azure performs the following steps:

1. Based on the provided password or Azure Key Vault key, generates an encryption key to protect instance data stored in the backup repository, and stores the key in the configuration database on the backup appliance.
2. Uses the generated key to encrypt backed-up data transferred to the backup repository when running the backup policy.