How to configure Azure for Enterprise backup

Introduction 

This document provides the configuration steps required to enable SOftwareONE’s Backup service to protect public cloud services and to utilise public cloud data repositories.

Azure configuration

The following sections describe:

How to configure Blob Storage for use as a BackupSimple storage repository

1. How to configure Azure to enable BackupSimple to protect Azure Virtual Machines, Azure PaaS services and other data hosting services in Azure.

Blob Storage Configuration

To create an Azure Blob for use as a Storage Repository:

1. Log on to the public Azure portal with service administrator credentials.

   1. Create a new Storage Account

      1. Go to Storage Account > Add

Select your subscription and Resource Group.

We recommend creating a dedicated ResourceGroup for all things BackupSimple

• Storage Account name: e.g. CompanyNameShortCodebackupsimple

• Location: Select the location you want the data to reside

• Performance: Standard

• Account Kind: StorageV2 (general purpose v2)

• Replication: For low-risk, regional disaster recovery of your backup data, we recommend selecting Geo-redundant storage (GRS).

• Access tier: Cool

Click Next : Advanced

• Security: Secure Transfer required: Enabled

• Virtual Networks: All Networks

• Data Lake Storage Gen2 : Disabled

Note: If you are hosting your Media Agent in Azure it is recommended to restrict access to the Blob store to only Selected Networks, i.e. the VNet of your Media Agent. This will ensure faster routing and a more secure environment for your backup data.

From the Azure portal, select the Storage Account of your Blob Store > Firewalls and Virtual networks > Choose ‘Selected Networks’ and define the Vnet the Media Agent resides in.

Select the Vnet hosting your Media Agent > go to Service Endpoints > Add > select the endpoint defined earlier for the Blob store.

1. Share the Storage Account information with the BackupSimple Project or Support Team who will align a BackupSimple cloud library with the new Azure Blob.

   1. Go to the Storage Account created above

   2. Go to Access Keys.

Share the table below.

Azure Configuration

To configure Azure to allow BackupSimple to protect resources hosted in an Azure Subscription.

1. Create the Azure Application

   1. Log on to the public Azure portal with service administrator credentials.

   2. From the All Services menu, select the App registrations tab, and click on New Application Registration.

   3. Enter the appropriate values for the following:

• Name: Name of the application, e.g. BackupSimple-Az

• Application type: Select Web app/API or Native.

• Sign-on URL: http://app_name. For example: https://backupsimple-az.

• Click Create. The newly created application will appear.

Note and share the Application name.

Note and share the Application ID.

1. Assign the Azure application the necessary Permissions

   1. If not already open, open the application created above

   2. Click Settings

   3. On the Required Permission tab, Click Add > Select an API > Select Windows Azure Service Management API

   4. Select ‘Access Azure Service Management as organization users’

   5. Click Select and Done.

2. Collect the Application key

   1. Select the newly created application, and click Settings.

   2. Click on Keys. Provide the key name, and a long-term expiration date. Click Save.

This will generate a unique secret key for the application.

Note and share the Application Key value.

1. Assign the application Contributor Role to your subscription

   1. Go to All Services > Subscriptions

   2. Select the relevant subscription

Note and share the Subscription ID.

1. Select Access Control (IAM) > Click Add to add a service principal user.

2. On the Add Permissions blade, select the Contributor role

3. Select Azure AD user, group, or application.

4. Select the application created in previous step.

1. Collect the Tenant ID or Directory ID

   1. Select All Services > Active Directory.

   2. Select your Active Directory > Properties > Directory ID.

Note and share the Tenant ID (Directory ID).

Media Agent Specifications & Supported OS

This section defines the configuration of the Media Agent. The specification of the machines depends on the front-end Terabytes of the Environment.

Please ensure all non-OS disks are formatted with 4KB clusters

Enable Accelerated Networking on VM types which support it

Media Agent Antivirus exclusions

This section lists the recommended Antivirus exclusion on the Media Agent. Antivirus exclusions will help maintain optimum performance:

Antivirus exclusions;

*:\Program Files\CommVault\ContentStore\**

*:\Program Files\CommVault\ContentStore\iDataAgent\JobResults

*:\Program Files\CommVault\ContentStore\IndexCache

*:\**\CV_MAGNETIC\**

Deduplication databases > Usually installed on E:\DDB

Index > Usually installed on F:\Index (or E:\Index for a Single Disk Media Agent)

Virtual Server Agent specifications

Virtual Server Agents protect Virtual Machines hosted on a variety of both Public and Private Hypervisors.

VSA’s can be installed share a host with Media Agents for smaller environments.

The BackupSimple team will advise when to break out to dedicated VSA hosts, with a general rule of at least one VSA agent per Region.

VSA’s can scale horizontally and be load balanced.

The specifications for VSA agents are as follows:

Enable Accelerated Networking on VM types which support it.