Azure Files Backup in Private Environment

If the private network deployment functionality is enabled for a backup appliance, Veeam Backup for Microsoft Azure performs Azure Files backup in the following way:

Creates a share snapshot of the processed Azure file share using Microsoft Azure native capabilities.

Note

Due to Microsoft Azure limitations, the maximum number of snapshots to keep for one file share is 200.

If you enable file share indexing, Veeam Backup for Microsoft Azure performs the following operations:

Launches a worker instance in an Azure region in which the processed file share resides.
Re-creates the file share from the share snapshot created at step 1 and mounts the share to the worker instance.
Reads data from the file share on the worker instance, creates a catalog of files and folders (that is, the index) of the share, and saves the index as a .ZIP file on the backup appliance.

The creation of the .ZIP file may take significant time to complete. If a new backup policy session starts and the previous indexing session is still running, a new indexing session will not be launched.

Deallocates the worker instance when the indexing session completes.

Veeam Backup for Microsoft Azure communicates with the worker instance through the Azure Queue Storage messaging service. The backup appliance and the worker instance have no direct connection — Azure Queue Storage acts as a proxy that delivers status messages between them. These messages tell the backup appliance that the worker instance is deployed and ready, and report the progress of the indexing session. The worker instance uses the same mechanism to learn whether it must process another workload.

Important

If you grant access to the storage account through private endpoints, peering connections make DNS resolution of these endpoints work across VNets. Veeam Backup for Microsoft Azure does not use the peering connections to transfer backup data and never creates them automatically, because organization security policies may restrict connections between VNets. You must manually create a peering connection between the VNet of the backup appliance and the VNet of the private endpoint, as described in section Configure Private Endpoint Network Settings.