Azure Storage and Veeam VBR v12 SOBR: how to migrate from a non-immutable to an immutable bucket?

Many users are deploying the famous Scale-Out Backup Repository architecture in a multi-tier environment, including the native integration with cloud provider services like Azure Blob.

Before VBR v12, the Azure Storage services were non-immutable – considering the context of the Veeam VBR. Some users already have Azure Blobs extends allocated in their SOBR´s Capacity Tier. Now, these non-immutable extents are populated with many backup files.

After Azure implemented object-level locking, the VBR v12 incorporated it as an immutable backup repository option. And now, the users want to migrate these backup files to Azure Blobs with immutability enabled to get better protection against Ransomware or strengthen their Business Continuity strategies.

So, why not enable the immutability flag in an existent Azure Blob service?

Unfortunately, it is not supported, despite Azure´s procedure for “Migrate an existing container to support version-level immutability.”

There is a Veeam´s KB number 4416 for “How to Configure Azure Storage Account to Leverage Immutability with Veeam Backup & Replication.” This document has an explicit orientation:

Immutability can only be used with new storage account containers and cannot be used with existing backup data where immutability was not applied previously.

Therefore, you must deploy a new object storage repository with immutability.

And is it possible to add a new immutable Azure Blob object storage as an additional extent into a Capacity Tier with native non-immutable object storage extents?

The answer is no.

There is another Veeam recommendation related to the extent of a Capacity tier:

Capacity tier extents must have the same immutability state. If you use immutability, you must enable it for all capacity extents. If you do not plan to use immutability, do not enable it for any capacity extent.

Therefore, to migrate from a non-immutable bucket to an immutable bucket into the Capacity Tier, it is necessary to offload the backup files from the Capacity Tier extents to the Performance Tier extents.

The procedure is as follows:

1. Download all backup files from the non-immutable object storage repository to the Performance Tier.
2. Add a new object storage repository to the Veeam Backup & Replication environment.
3. Replace the non-immutable object storage repository with the new immutable object storage created in the last step.
4. Manually move the backup files from the Performance Tier to the new immutable Azure Blob object storage repository.

For more information:

https://helpcenter.veeam.com/docs/backup/vsphere/capacity_tier_migrating.html?ver=120

Well, at this time, this is recommended procedure by Veeam.

I hope this information is helpful.

Reference documents:

https://www.veeam.com/kb4416

https://learn.microsoft.com/en-us/azure/storage/blobs/immutable-policy-configure-version-scope?tabs=azure-portal

https://helpcenter.veeam.com/docs/backup/vsphere/cloud_credentials_azure_storage.html?ver=120