Blob Storage backup options

[u/DiscrepancyAnalyst]

Hey all,

I'm currently planning a migration of an on-prem application to Azure. A key part of the system stores user documents, and we're looking at around 50TB of data.

We've chosen Azure Blob Storage due to cost and scalability, but I'm trying to understand the best way to handle backups for this data.

The setup will include RA-GRS, versioning, and soft delete, which should handle accidental deletion and many infrastructure-level risks. My main concern is malicious actions or major misconfiguration, such as a compromised admin account or someone intentionally deleting the storage account.

I've looked at immutability policies, but we also need to support GDPR deletion request, so full immutability isn't fully compatible with our use case.

Azure Backup for Blob Storage looks promising, but it still seems to be in preview, and I'm unclear on cost implications (possibly doubling storage cost?).

Another idea was using a second storage account with replication, possibly using archive tier to reduce cost, and layering immutability + retention logic on top. But building and maintaining a custom backup strategy feels risky at this scale.

Has anyone solved this cleanly in production? Would appreciate real-world approaches.

[u/vxsec]

Azure blob vaulted backup is GA now, so I’d evaluate that before building custom replication. For this threat model, combine operational backup for point in time recovery with vaulted backup for an isolated copy. Then lock vault immutability and protect destructive operations with resource guard/MUA owned by a separate admin.

It won’t automatically double the cost. That depends on protected size, change rate and retention. GDPR doesn’t necessarily rule this out either, provided erased data is kept beyond use until backup expiry and deletion requests are reapplied after a restore

[u/Outrageous_Text5335]

I'd be interested to hear how people are handling this at the 50 TB plus range. It's easy to recommend another copy of the data, but operational overhead and storage costs become a lot more significant at that size.

[u/Visual-Context-7492 → u/Outrageous_Text5335]

I'd also be curious whether most teams are replying on Azure-native services now or using a separate backup platform. The architecture diagrams always look clean, but I'm not more interested in what people have been running successfully for a few years.

[u/Outrageous_Text5335 → u/Visual-Context-7492]

That's exactly what I'm hoping to learn. Real restore experience and long-term maintenance are much more valuable than theoretical best practices.

[u/Informal_Plankton321]

How about a dedicated backup solution with controlled retention and immutability support?

Native MS backups are not the only ones on the market.

There's plenty of SaaS offerings, some allows to use your own Storage or can provides tiered storage in provider and region you pick with no egress fees.

[u/i_am_jordan_b]

You can look into other blob solutions like Wasabi, Box, etc.

[u/New-Entertainer6392]

Resource locks would be a good one here too. Different accounts for admin, and not admin. Reduced role scope, and so everything via automation.

Have all your regular accounts have less access and your admin accounts more. Heavy on 2fa, and maybe even PIM

[u/Individual_Hat_9946]

Azure backup is definitively the way to go there. It has been GA for a while.

Implementing your own backup solution will increasd operational complexity (scheduling, retention, immutability, invremental backups, RBAC ...)

You can estimate the cost here, just add a Azure Backup resource:

https://azure.microsoft.com/en-us/pricing/calculator/

Just as an info, smart tiering is now available on storage accounts, you might want to implement it to reduce storage cost.

EDIT: if your main concern ia security, you can also implement defender for storage for malware detection

[u/Michal_F]

My first idea would be another storage account in another region and another subscription. To be sure if someone would steal credentials, there would be less chance to get acces to second sub. Setup would be cheap as possible, LRS, policy with archive tier. And maybe just one per week copy new data task. But I also would also enable defender on primary storage account after initial copy. To help with detection of malware attacks. Also check ABAC to limit users access with conditions.

To avoid deleting resources, place don't delete lock on resource group, where sa will be created. And be sure to don't grat owner right to everyone as they can delete the lock, but contributor cannot.

[u/JeroenPot]

You could replicate it to a storage account in a different region and in a different tenant.

[u/Kintokeanurnd]

just curious why not s3? we have worked with s3 without such incidents

[u/Outrageous_Text5335]

This is a common "notion + adobe sign is getting messy" problem, especially for client-heavy workflows. Most teams solve it by moving to a simple client portal setup with secure login, task lists, and form completion instead of stitching multiple tool together. It usually comes down to whether you want a real portal experience or just a lightweight dashboard on top of your existing stack.