Using GRS for Azure SQL Database Backups to a region with restricted access?

Question

Using GRS for Azure SQL Database Backups to a region with restricted access?

Mattias Andrén 0

I´m wondering what happens if I setup Backup for an Azure SQL Database using GRS in Sweden Central without having applied to access for Sweden South (the paired but restricted region). Would the backup still be replicated to Sweden South? Would there be any issues when I need to restore from backup? I´m having a hard time finding any documentation regarding this setup, but I might be missing something, so if there is any documentation of how this is handled, please let me know.

Saraswathi Devadula 16,025 Reputation points Microsoft External Staff Moderator

2026-05-13T11:05:07.14+00:00

Hello **Mattias Andrén

**Yes, if you configure Azure SQL Database backups with Geo-Redundant Storage (GRS) in Sweden Central, the backups are automatically replicated to the paired region (Sweden South), even if you don’t have explicit access to Sweden South. You won’t face issues with restore operations, because restores are always initiated from the primary region (Sweden Central), and Microsoft manages replication to the secondary region transparently.

Automatic replication: GRS replicates your backups asynchronously to the paired region (Sweden South in this case). You don’t need to request access to the secondary region for replication to occur.

Restore behavior: Restores are performed from the primary region (Sweden Central). If Sweden Central experiences a catastrophic outage, Microsoft can fail over to Sweden South, but this is managed at the platform level — you don’t manually restore from Sweden South.

No user access required: Even if Sweden South is a restricted region, replication still happens because it’s part of Azure’s internal disaster recovery design. You won’t be blocked from backup or restore operations.

https://learn.microsoft.com/en-us/azure/azure-sql/database/recovery-using-backups?view=azuresql&tabs=azure-portal#geo-restore
https://learn.microsoft.com/en-us/azure/azure-sql/database/recovery-using-backups?view=azuresql&tabs=azure-portal
https://learn.microsoft.com/en-us/azure/azure-sql/database/automated-backups-overview?view=azuresql
https://learn.microsoft.com/en-us/azure/azure-sql/database/active-geo-replication-overview?view=azuresql&tabs=tsql#configure-geo-secondary

Please do let me know if you need any assistance. I am happy to address.
Saraswathi Devadula 16,025 Reputation points Microsoft External Staff Moderator

2026-05-14T11:00:17.9133333+00:00

Hello **Mattias Andrén
We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.

1 answer

Your answer

Saraswathi Devadula 16,025 Reputation points Microsoft External Staff Moderator

2026-05-13T11:05:07.14+00:00

Hello **Mattias Andrén

**Yes, if you configure Azure SQL Database backups with Geo-Redundant Storage (GRS) in Sweden Central, the backups are automatically replicated to the paired region (Sweden South), even if you don’t have explicit access to Sweden South. You won’t face issues with restore operations, because restores are always initiated from the primary region (Sweden Central), and Microsoft manages replication to the secondary region transparently.

Automatic replication: GRS replicates your backups asynchronously to the paired region (Sweden South in this case). You don’t need to request access to the secondary region for replication to occur.

Restore behavior: Restores are performed from the primary region (Sweden Central). If Sweden Central experiences a catastrophic outage, Microsoft can fail over to Sweden South, but this is managed at the platform level — you don’t manually restore from Sweden South.

No user access required: Even if Sweden South is a restricted region, replication still happens because it’s part of Azure’s internal disaster recovery design. You won’t be blocked from backup or restore operations.

https://learn.microsoft.com/en-us/azure/azure-sql/database/recovery-using-backups?view=azuresql&tabs=azure-portal#geo-restore
https://learn.microsoft.com/en-us/azure/azure-sql/database/recovery-using-backups?view=azuresql&tabs=azure-portal
https://learn.microsoft.com/en-us/azure/azure-sql/database/automated-backups-overview?view=azuresql
https://learn.microsoft.com/en-us/azure/azure-sql/database/active-geo-replication-overview?view=azuresql&tabs=tsql#configure-geo-secondary

Please do let me know if you need any assistance. I am happy to address.
Saraswathi Devadula 16,025 Reputation points Microsoft External Staff Moderator

2026-05-14T11:00:17.9133333+00:00

Hello **Mattias Andrén
We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.

Answer 1

For Azure SQL Database, when backup storage redundancy is set to Geo-redundant (GRS or GZRS), backups are always replicated to the paired secondary region, regardless of whether that region is generally restricted for creating customer resources.

From the backup platform perspective:

GRS “copies your data asynchronously three times to a single physical location in the paired secondary region.” This is an internal platform operation and does not require that customer access be enabled to that region.
Geo-restore for Azure SQL Database “uses geo-replicated backups as the source” and “you can restore a database on any logical server in any Azure region from the most recent geo-replicated backups,” as long as the database is configured with geo-redundant or geo-zone-redundant backup storage.

Implications for the described scenario (Sweden Central with paired Sweden South):

Backups of the database in Sweden Central configured with GRS/GZRS will still be replicated to the paired region (Sweden South) by the platform.
Geo-restore will allow restoring the database to a logical server in any Azure region in the same subscription, not just the paired region. Therefore, even if direct customer access to Sweden South is restricted, geo-restore can be performed to another accessible region.
The main consideration is that GRS/GZRS implies data is stored in the paired region, which may affect data residency/compliance requirements. If data must not leave a single region, use LRS or ZRS instead and enforce this via Azure Policy (for example, using the built-in policy “Azure SQL DB should avoid using GRS backup”).

There is no indication in the documentation that lack of customer access to the paired region prevents replication or breaks restore; the platform manages geo-replication and geo-restore as long as GRS/GZRS is configured.

References:

Share via

Using GRS for Azure SQL Database Backups to a region with restricted access?

1 answer

Your answer