Backup Vaults - Create Or Update

Service:: Data Protection

API Version:: 2026-03-01

Creates or updates a BackupVault resource belonging to a resource group.

PUT https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.DataProtection/backupVaults/{vaultName}?api-version=2026-03-01

URI Parameters

Name	In	Required	Type	Description
resourceGroupName	path	True	string minLength: 1 maxLength: 90	The name of the resource group. The name is case insensitive.
subscriptionId	path	True	string (uuid)	The ID of the target subscription. The value must be an UUID.
vaultName	path	True	string	The name of the BackupVaultResource
api-version	query	True	string minLength: 1	The API version to use for this operation.

Request Header

Name	Required	Type	Description
x-ms-authorization-auxiliary		string
x-ms-deleted-vault-id		string	The ID of the deleted backup vault to restore from during undelete flow.

Request Body

Name	Required	Type	Description
location	True	string	The geo-location where the resource lives
properties	True	BackupVault	BackupVaultResource properties
eTag		string	Optional ETag.
identity		DppIdentityDetails	Input Managed Identity Details
tags		object	Resource tags.

Responses

Name	Type	Description
200 OK	BackupVaultResource	Resource 'BackupVaultResource' update operation succeeded
201 Created	BackupVaultResource	Resource 'BackupVaultResource' create operation succeeded Headers Location: string Retry-After: integer
Other Status Codes	CloudError	An unexpected error response.

Name

Type

Description

200 OK

BackupVaultResource

Resource 'BackupVaultResource' update operation succeeded

201 Created

BackupVaultResource

Resource 'BackupVaultResource' create operation succeeded

Headers

Location: string
Retry-After: integer

Other Status Codes

CloudError

An unexpected error response.

Security

azure_auth

Azure Active Directory OAuth2 Flow.

Type: oauth2
Flow: implicit
Authorization URL: https://login.microsoftonline.com/common/oauth2/authorize

Scopes

Name	Description
user_impersonation	impersonate your user account

Examples

Create BackupVault

Create BackupVault With CMK

Create BackupVault With MSI

Create or Update Backup Vault With CMK and Resource Guard Enabled

Restore a soft-deleted backup vault

Create BackupVault

Sample request

PUT https://management.azure.com/subscriptions/0b352192-dcac-4cc7-992e-a96190ccc68c/resourceGroups/SampleResourceGroup/providers/Microsoft.DataProtection/backupVaults/swaggerExample?api-version=2026-03-01

{
  "location": "WestUS",
  "properties": {
    "featureSettings": {
      "crossRegionRestoreSettings": {
        "state": "Enabled"
      }
    },
    "monitoringSettings": {
      "azureMonitorAlertSettings": {
        "alertsForAllJobFailures": "Enabled"
      }
    },
    "securitySettings": {
      "softDeleteSettings": {
        "retentionDurationInDays": 14,
        "state": "Enabled"
      }
    },
    "storageSettings": [
      {
        "type": "LocallyRedundant",
        "datastoreType": "VaultStore"
      }
    ]
  },
  "tags": {
    "key1": "val1"
  }
}


import com.azure.resourcemanager.dataprotection.models.AlertsState;
import com.azure.resourcemanager.dataprotection.models.AzureMonitorAlertSettings;
import com.azure.resourcemanager.dataprotection.models.BackupVault;
import com.azure.resourcemanager.dataprotection.models.CrossRegionRestoreSettings;
import com.azure.resourcemanager.dataprotection.models.CrossRegionRestoreState;
import com.azure.resourcemanager.dataprotection.models.FeatureSettings;
import com.azure.resourcemanager.dataprotection.models.MonitoringSettings;
import com.azure.resourcemanager.dataprotection.models.SecuritySettings;
import com.azure.resourcemanager.dataprotection.models.SoftDeleteSettings;
import com.azure.resourcemanager.dataprotection.models.SoftDeleteState;
import com.azure.resourcemanager.dataprotection.models.StorageSetting;
import com.azure.resourcemanager.dataprotection.models.StorageSettingStoreTypes;
import com.azure.resourcemanager.dataprotection.models.StorageSettingTypes;
import java.util.Arrays;
import java.util.HashMap;
import java.util.Map;

/**
 * Samples for BackupVaults CreateOrUpdate.
 */
public final class Main {
    /*
     * x-ms-original-file: 2026-03-01/VaultCRUD/PutBackupVault.json
     */
    /**
     * Sample code: Create BackupVault.
     * 
     * @param manager Entry point to DataProtectionManager.
     */
    public static void createBackupVault(com.azure.resourcemanager.dataprotection.DataProtectionManager manager) {
        manager.backupVaults().define("swaggerExample").withRegion("WestUS")
            .withExistingResourceGroup("SampleResourceGroup")
            .withProperties(new BackupVault()
                .withMonitoringSettings(new MonitoringSettings().withAzureMonitorAlertSettings(
                    new AzureMonitorAlertSettings().withAlertsForAllJobFailures(AlertsState.ENABLED)))
                .withSecuritySettings(new SecuritySettings().withSoftDeleteSettings(new SoftDeleteSettings()
                    .withState(SoftDeleteState.fromString("Enabled")).withRetentionDurationInDays(14.0D)))
                .withStorageSettings(
                    Arrays.asList(new StorageSetting().withDatastoreType(StorageSettingStoreTypes.VAULT_STORE)
                        .withType(StorageSettingTypes.LOCALLY_REDUNDANT)))
                .withFeatureSettings(new FeatureSettings().withCrossRegionRestoreSettings(
                    new CrossRegionRestoreSettings().withState(CrossRegionRestoreState.ENABLED))))
            .withTags(mapOf("key1", "fakeTokenPlaceholder")).create();
    }

    // Use "Map.of" if available
    @SuppressWarnings("unchecked")
    private static <T> Map<String, T> mapOf(Object... inputs) {
        Map<String, T> map = new HashMap<>();
        for (int i = 0; i < inputs.length; i += 2) {
            String key = (String) inputs[i];
            T value = (T) inputs[i + 1];
            map.put(key, value);
        }
        return map;
    }
}

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

from azure.identity import DefaultAzureCredential

from azure.mgmt.dataprotection import DataProtectionMgmtClient

"""
# PREREQUISITES
    pip install azure-identity
    pip install azure-mgmt-dataprotection
# USAGE
    python put_backup_vault.py

    Before run the sample, please set the values of the client ID, tenant ID and client secret
    of the AAD application as environment variables: AZURE_CLIENT_ID, AZURE_TENANT_ID,
    AZURE_CLIENT_SECRET. For more info about how to get the value, please see:
    https://docs.microsoft.com/azure/active-directory/develop/howto-create-service-principal-portal
"""


def main():
    client = DataProtectionMgmtClient(
        credential=DefaultAzureCredential(),
        subscription_id="SUBSCRIPTION_ID",
    )

    response = client.backup_vaults.begin_create_or_update(
        resource_group_name="SampleResourceGroup",
        vault_name="swaggerExample",
        parameters={
            "location": "WestUS",
            "properties": {
                "featureSettings": {"crossRegionRestoreSettings": {"state": "Enabled"}},
                "monitoringSettings": {"azureMonitorAlertSettings": {"alertsForAllJobFailures": "Enabled"}},
                "securitySettings": {"softDeleteSettings": {"retentionDurationInDays": 14, "state": "Enabled"}},
                "storageSettings": [{"datastoreType": "VaultStore", "type": "LocallyRedundant"}],
            },
            "tags": {"key1": "val1"},
        },
    ).result()
    print(response)


# x-ms-original-file: 2026-03-01/VaultCRUD/PutBackupVault.json
if __name__ == "__main__":
    main()

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

package armdataprotection_test

import (
	"context"
	"log"

	"github.com/Azure/azure-sdk-for-go/sdk/azcore/to"
	"github.com/Azure/azure-sdk-for-go/sdk/azidentity"
	"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/dataprotection/armdataprotection/v4"
)

// Generated from example definition: 2026-03-01/VaultCRUD/PutBackupVault.json
func ExampleBackupVaultsClient_BeginCreateOrUpdate_createBackupVault() {
	cred, err := azidentity.NewDefaultAzureCredential(nil)
	if err != nil {
		log.Fatalf("failed to obtain a credential: %v", err)
	}
	ctx := context.Background()
	clientFactory, err := armdataprotection.NewClientFactory("0b352192-dcac-4cc7-992e-a96190ccc68c", cred, nil)
	if err != nil {
		log.Fatalf("failed to create client: %v", err)
	}
	poller, err := clientFactory.NewBackupVaultsClient().BeginCreateOrUpdate(ctx, "SampleResourceGroup", "swaggerExample", armdataprotection.BackupVaultResource{
		Location: to.Ptr("WestUS"),
		Properties: &armdataprotection.BackupVault{
			FeatureSettings: &armdataprotection.FeatureSettings{
				CrossRegionRestoreSettings: &armdataprotection.CrossRegionRestoreSettings{
					State: to.Ptr(armdataprotection.CrossRegionRestoreStateEnabled),
				},
			},
			MonitoringSettings: &armdataprotection.MonitoringSettings{
				AzureMonitorAlertSettings: &armdataprotection.AzureMonitorAlertSettings{
					AlertsForAllJobFailures: to.Ptr(armdataprotection.AlertsStateEnabled),
				},
			},
			SecuritySettings: &armdataprotection.SecuritySettings{
				SoftDeleteSettings: &armdataprotection.SoftDeleteSettings{
					RetentionDurationInDays: to.Ptr[float64](14),
					State:                   to.Ptr(armdataprotection.SoftDeleteState("Enabled")),
				},
			},
			StorageSettings: []*armdataprotection.StorageSetting{
				{
					Type:          to.Ptr(armdataprotection.StorageSettingTypesLocallyRedundant),
					DatastoreType: to.Ptr(armdataprotection.StorageSettingStoreTypesVaultStore),
				},
			},
		},
		Tags: map[string]*string{
			"key1": to.Ptr("val1"),
		},
	}, nil)
	if err != nil {
		log.Fatalf("failed to finish the request: %v", err)
	}
	res, err := poller.PollUntilDone(ctx, nil)
	if err != nil {
		log.Fatalf("failed to pull the result: %v", err)
	}
	// You could use response here. We use blank identifier for just demo purposes.
	_ = res
	// If the HTTP response code is 200 as defined in example definition, your response structure would look as follows. Please pay attention that all the values in the output are fake values for just demo purposes.
	// res = armdataprotection.BackupVaultsClientCreateOrUpdateResponse{
	// 	BackupVaultResource: &armdataprotection.BackupVaultResource{
	// 		Name: to.Ptr("swaggerExample"),
	// 		Type: to.Ptr("Microsoft.DataProtection/Backupvaults"),
	// 		ID: to.Ptr("/subscriptions/0b352192-dcac-4cc7-992e-a96190ccc68c/resourceGroups/SampleResourceGroup/providers/Microsoft.DataProtection/Backupvaults/swaggerExample"),
	// 		Location: to.Ptr("WestUS"),
	// 		Properties: &armdataprotection.BackupVault{
	// 			FeatureSettings: &armdataprotection.FeatureSettings{
	// 				CrossRegionRestoreSettings: &armdataprotection.CrossRegionRestoreSettings{
	// 					State: to.Ptr(armdataprotection.CrossRegionRestoreStateEnabled),
	// 				},
	// 			},
	// 			MonitoringSettings: &armdataprotection.MonitoringSettings{
	// 				AzureMonitorAlertSettings: &armdataprotection.AzureMonitorAlertSettings{
	// 					AlertsForAllJobFailures: to.Ptr(armdataprotection.AlertsStateEnabled),
	// 				},
	// 			},
	// 			ProvisioningState: to.Ptr(armdataprotection.ProvisioningStateSucceeded),
	// 			SecureScore: to.Ptr(armdataprotection.SecureScoreLevelAdequate),
	// 			SecuritySettings: &armdataprotection.SecuritySettings{
	// 				SoftDeleteSettings: &armdataprotection.SoftDeleteSettings{
	// 					RetentionDurationInDays: to.Ptr[float64](14),
	// 					State: to.Ptr(armdataprotection.SoftDeleteState("Enabled")),
	// 				},
	// 			},
	// 			StorageSettings: []*armdataprotection.StorageSetting{
	// 				{
	// 					Type: to.Ptr(armdataprotection.StorageSettingTypesLocallyRedundant),
	// 					DatastoreType: to.Ptr(armdataprotection.StorageSettingStoreTypesVaultStore),
	// 				},
	// 			},
	// 		},
	// 		Tags: map[string]*string{
	// 			"key1": to.Ptr("val1"),
	// 		},
	// 	},
	// }
}

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

const { DataProtectionClient } = require("@azure/arm-dataprotection");
const { DefaultAzureCredential } = require("@azure/identity");

/**
 * This sample demonstrates how to creates or updates a BackupVault resource belonging to a resource group.
 *
 * @summary creates or updates a BackupVault resource belonging to a resource group.
 * x-ms-original-file: 2026-03-01/VaultCRUD/PutBackupVault.json
 */
async function createBackupVault() {
  const credential = new DefaultAzureCredential();
  const subscriptionId = "0b352192-dcac-4cc7-992e-a96190ccc68c";
  const client = new DataProtectionClient(credential, subscriptionId);
  const result = await client.backupVaults.createOrUpdate("SampleResourceGroup", "swaggerExample", {
    location: "WestUS",
    properties: {
      featureSettings: { crossRegionRestoreSettings: { state: "Enabled" } },
      monitoringSettings: { azureMonitorAlertSettings: { alertsForAllJobFailures: "Enabled" } },
      securitySettings: { softDeleteSettings: { retentionDurationInDays: 14, state: "Enabled" } },
      storageSettings: [{ type: "LocallyRedundant", datastoreType: "VaultStore" }],
    },
    tags: { key1: "val1" },
  });
  console.log(result);
}

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

Sample response

Status code:: 200

{
  "name": "swaggerExample",
  "type": "Microsoft.DataProtection/Backupvaults",
  "id": "/subscriptions/0b352192-dcac-4cc7-992e-a96190ccc68c/resourceGroups/SampleResourceGroup/providers/Microsoft.DataProtection/Backupvaults/swaggerExample",
  "location": "WestUS",
  "properties": {
    "featureSettings": {
      "crossRegionRestoreSettings": {
        "state": "Enabled"
      }
    },
    "monitoringSettings": {
      "azureMonitorAlertSettings": {
        "alertsForAllJobFailures": "Enabled"
      }
    },
    "provisioningState": "Succeeded",
    "secureScore": "Adequate",
    "securitySettings": {
      "softDeleteSettings": {
        "retentionDurationInDays": 14,
        "state": "Enabled"
      }
    },
    "storageSettings": [
      {
        "type": "LocallyRedundant",
        "datastoreType": "VaultStore"
      }
    ]
  },
  "tags": {
    "key1": "val1"
  }
}

Status code:: 201

Azure-AsyncOperation: https://management.azure.com/subscriptions/04cf684a-d41f-4550-9f70-7708a3a2283b/resourceGroups/SampleResourceGroup/providers/Microsoft.DataProtection/Backupvaults/swaggerExample/operationStatus/YWUzNDFkMzQtZmM5OS00MmUyLWEzNDMtZGJkMDIxZjlmZjgzOzdmYzBiMzhmLTc2NmItNDM5NS05OWQ1LTVmOGEzNzg4MWQzNA==?api-version=2026-03-01
Retry-After: 10

{
  "name": "swaggerExample",
  "type": "Microsoft.DataProtection/Backupvaults",
  "id": "/subscriptions/0b352192-dcac-4cc7-992e-a96190ccc68c/resourceGroups/SampleResourceGroup/providers/Microsoft.DataProtection/Backupvaults/swaggerExample",
  "location": "WestUS",
  "properties": {
    "featureSettings": {
      "crossRegionRestoreSettings": {
        "state": "Enabled"
      }
    },
    "monitoringSettings": {
      "azureMonitorAlertSettings": {
        "alertsForAllJobFailures": "Enabled"
      }
    },
    "provisioningState": "Provisioning",
    "secureScore": "Adequate",
    "securitySettings": {
      "softDeleteSettings": {
        "retentionDurationInDays": 14,
        "state": "Enabled"
      }
    },
    "storageSettings": [
      {
        "type": "LocallyRedundant",
        "datastoreType": "VaultStore"
      }
    ]
  },
  "tags": {
    "key1": "val1"
  }
}

Create BackupVault With CMK

Sample request

PUT https://management.azure.com/subscriptions/0b352192-dcac-4cc7-992e-a96190ccc68c/resourceGroups/SampleResourceGroup/providers/Microsoft.DataProtection/backupVaults/swaggerExample?api-version=2026-03-01

{
  "location": "WestUS",
  "properties": {
    "monitoringSettings": {
      "azureMonitorAlertSettings": {
        "alertsForAllJobFailures": "Enabled"
      }
    },
    "securitySettings": {
      "encryptionSettings": {
        "infrastructureEncryption": "Enabled",
        "kekIdentity": {
          "identityId": "/subscriptions/85bf5e8c-3084-4f42-add2-746ebb7e97b2/resourceGroups/defaultrg/providers/Microsoft.ManagedIdentity/userAssignedIdentities/examplemsi",
          "identityType": "UserAssigned"
        },
        "keyVaultProperties": {
          "keyUri": "https://cmk2xkv.vault.azure.net/keys/Key1/0767b348bb1a4c07baa6c4ec0055d2b3"
        },
        "state": "Enabled"
      },
      "immutabilitySettings": {
        "state": "Disabled"
      },
      "softDeleteSettings": {
        "retentionDurationInDays": 0,
        "state": "Off"
      }
    },
    "storageSettings": [
      {
        "type": "LocallyRedundant",
        "datastoreType": "VaultStore"
      }
    ]
  },
  "tags": {
    "key1": "val1"
  }
}


import com.azure.resourcemanager.dataprotection.models.AlertsState;
import com.azure.resourcemanager.dataprotection.models.AzureMonitorAlertSettings;
import com.azure.resourcemanager.dataprotection.models.BackupVault;
import com.azure.resourcemanager.dataprotection.models.CmkKekIdentity;
import com.azure.resourcemanager.dataprotection.models.CmkKeyVaultProperties;
import com.azure.resourcemanager.dataprotection.models.EncryptionSettings;
import com.azure.resourcemanager.dataprotection.models.EncryptionState;
import com.azure.resourcemanager.dataprotection.models.IdentityType;
import com.azure.resourcemanager.dataprotection.models.ImmutabilitySettings;
import com.azure.resourcemanager.dataprotection.models.ImmutabilityState;
import com.azure.resourcemanager.dataprotection.models.InfrastructureEncryptionState;
import com.azure.resourcemanager.dataprotection.models.MonitoringSettings;
import com.azure.resourcemanager.dataprotection.models.SecuritySettings;
import com.azure.resourcemanager.dataprotection.models.SoftDeleteSettings;
import com.azure.resourcemanager.dataprotection.models.SoftDeleteState;
import com.azure.resourcemanager.dataprotection.models.StorageSetting;
import com.azure.resourcemanager.dataprotection.models.StorageSettingStoreTypes;
import com.azure.resourcemanager.dataprotection.models.StorageSettingTypes;
import java.util.Arrays;
import java.util.HashMap;
import java.util.Map;

/**
 * Samples for BackupVaults CreateOrUpdate.
 */
public final class Main {
    /*
     * x-ms-original-file: 2026-03-01/VaultCRUD/PutBackupVaultWithCMK.json
     */
    /**
     * Sample code: Create BackupVault With CMK.
     * 
     * @param manager Entry point to DataProtectionManager.
     */
    public static void
        createBackupVaultWithCMK(com.azure.resourcemanager.dataprotection.DataProtectionManager manager) {
        manager.backupVaults().define("swaggerExample").withRegion("WestUS")
            .withExistingResourceGroup("SampleResourceGroup")
            .withProperties(new BackupVault()
                .withMonitoringSettings(new MonitoringSettings().withAzureMonitorAlertSettings(
                    new AzureMonitorAlertSettings().withAlertsForAllJobFailures(AlertsState.ENABLED)))
                .withSecuritySettings(new SecuritySettings()
                    .withSoftDeleteSettings(
                        new SoftDeleteSettings().withState(SoftDeleteState.OFF).withRetentionDurationInDays(0.0D))
                    .withImmutabilitySettings(new ImmutabilitySettings().withState(ImmutabilityState.DISABLED))
                    .withEncryptionSettings(new EncryptionSettings().withState(EncryptionState.ENABLED)
                        .withKeyVaultProperties(new CmkKeyVaultProperties().withKeyUri("fakeTokenPlaceholder"))
                        .withKekIdentity(
                            new CmkKekIdentity().withIdentityType(IdentityType.USER_ASSIGNED).withIdentityId(
                                "/subscriptions/85bf5e8c-3084-4f42-add2-746ebb7e97b2/resourcegroups/defaultrg/providers/Microsoft.ManagedIdentity/userAssignedIdentities/examplemsi"))
                        .withInfrastructureEncryption(InfrastructureEncryptionState.ENABLED)))
                .withStorageSettings(
                    Arrays.asList(new StorageSetting().withDatastoreType(StorageSettingStoreTypes.VAULT_STORE)
                        .withType(StorageSettingTypes.LOCALLY_REDUNDANT))))
            .withTags(mapOf("key1", "fakeTokenPlaceholder")).create();
    }

    // Use "Map.of" if available
    @SuppressWarnings("unchecked")
    private static <T> Map<String, T> mapOf(Object... inputs) {
        Map<String, T> map = new HashMap<>();
        for (int i = 0; i < inputs.length; i += 2) {
            String key = (String) inputs[i];
            T value = (T) inputs[i + 1];
            map.put(key, value);
        }
        return map;
    }
}

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

from azure.identity import DefaultAzureCredential

from azure.mgmt.dataprotection import DataProtectionMgmtClient

"""
# PREREQUISITES
    pip install azure-identity
    pip install azure-mgmt-dataprotection
# USAGE
    python put_backup_vault_with_cmk.py

    Before run the sample, please set the values of the client ID, tenant ID and client secret
    of the AAD application as environment variables: AZURE_CLIENT_ID, AZURE_TENANT_ID,
    AZURE_CLIENT_SECRET. For more info about how to get the value, please see:
    https://docs.microsoft.com/azure/active-directory/develop/howto-create-service-principal-portal
"""


def main():
    client = DataProtectionMgmtClient(
        credential=DefaultAzureCredential(),
        subscription_id="SUBSCRIPTION_ID",
    )

    response = client.backup_vaults.begin_create_or_update(
        resource_group_name="SampleResourceGroup",
        vault_name="swaggerExample",
        parameters={
            "location": "WestUS",
            "properties": {
                "monitoringSettings": {"azureMonitorAlertSettings": {"alertsForAllJobFailures": "Enabled"}},
                "securitySettings": {
                    "encryptionSettings": {
                        "infrastructureEncryption": "Enabled",
                        "kekIdentity": {
                            "identityId": "/subscriptions/85bf5e8c-3084-4f42-add2-746ebb7e97b2/resourcegroups/defaultrg/providers/Microsoft.ManagedIdentity/userAssignedIdentities/examplemsi",
                            "identityType": "UserAssigned",
                        },
                        "keyVaultProperties": {
                            "keyUri": "https://cmk2xkv.vault.azure.net/keys/Key1/0767b348bb1a4c07baa6c4ec0055d2b3"
                        },
                        "state": "Enabled",
                    },
                    "immutabilitySettings": {"state": "Disabled"},
                    "softDeleteSettings": {"retentionDurationInDays": 0, "state": "Off"},
                },
                "storageSettings": [{"datastoreType": "VaultStore", "type": "LocallyRedundant"}],
            },
            "tags": {"key1": "val1"},
        },
    ).result()
    print(response)


# x-ms-original-file: 2026-03-01/VaultCRUD/PutBackupVaultWithCMK.json
if __name__ == "__main__":
    main()

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

package armdataprotection_test

import (
	"context"
	"log"

	"github.com/Azure/azure-sdk-for-go/sdk/azcore/to"
	"github.com/Azure/azure-sdk-for-go/sdk/azidentity"
	"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/dataprotection/armdataprotection/v4"
)

// Generated from example definition: 2026-03-01/VaultCRUD/PutBackupVaultWithCMK.json
func ExampleBackupVaultsClient_BeginCreateOrUpdate_createBackupVaultWithCmk() {
	cred, err := azidentity.NewDefaultAzureCredential(nil)
	if err != nil {
		log.Fatalf("failed to obtain a credential: %v", err)
	}
	ctx := context.Background()
	clientFactory, err := armdataprotection.NewClientFactory("0b352192-dcac-4cc7-992e-a96190ccc68c", cred, nil)
	if err != nil {
		log.Fatalf("failed to create client: %v", err)
	}
	poller, err := clientFactory.NewBackupVaultsClient().BeginCreateOrUpdate(ctx, "SampleResourceGroup", "swaggerExample", armdataprotection.BackupVaultResource{
		Location: to.Ptr("WestUS"),
		Properties: &armdataprotection.BackupVault{
			MonitoringSettings: &armdataprotection.MonitoringSettings{
				AzureMonitorAlertSettings: &armdataprotection.AzureMonitorAlertSettings{
					AlertsForAllJobFailures: to.Ptr(armdataprotection.AlertsStateEnabled),
				},
			},
			SecuritySettings: &armdataprotection.SecuritySettings{
				EncryptionSettings: &armdataprotection.EncryptionSettings{
					InfrastructureEncryption: to.Ptr(armdataprotection.InfrastructureEncryptionStateEnabled),
					KekIdentity: &armdataprotection.CmkKekIdentity{
						IdentityID:   to.Ptr("/subscriptions/85bf5e8c-3084-4f42-add2-746ebb7e97b2/resourcegroups/defaultrg/providers/Microsoft.ManagedIdentity/userAssignedIdentities/examplemsi"),
						IdentityType: to.Ptr(armdataprotection.IdentityTypeUserAssigned),
					},
					KeyVaultProperties: &armdataprotection.CmkKeyVaultProperties{
						KeyURI: to.Ptr("https://cmk2xkv.vault.azure.net/keys/Key1/0767b348bb1a4c07baa6c4ec0055d2b3"),
					},
					State: to.Ptr(armdataprotection.EncryptionStateEnabled),
				},
				ImmutabilitySettings: &armdataprotection.ImmutabilitySettings{
					State: to.Ptr(armdataprotection.ImmutabilityStateDisabled),
				},
				SoftDeleteSettings: &armdataprotection.SoftDeleteSettings{
					RetentionDurationInDays: to.Ptr[float64](0),
					State:                   to.Ptr(armdataprotection.SoftDeleteStateOff),
				},
			},
			StorageSettings: []*armdataprotection.StorageSetting{
				{
					Type:          to.Ptr(armdataprotection.StorageSettingTypesLocallyRedundant),
					DatastoreType: to.Ptr(armdataprotection.StorageSettingStoreTypesVaultStore),
				},
			},
		},
		Tags: map[string]*string{
			"key1": to.Ptr("val1"),
		},
	}, nil)
	if err != nil {
		log.Fatalf("failed to finish the request: %v", err)
	}
	res, err := poller.PollUntilDone(ctx, nil)
	if err != nil {
		log.Fatalf("failed to pull the result: %v", err)
	}
	// You could use response here. We use blank identifier for just demo purposes.
	_ = res
	// If the HTTP response code is 200 as defined in example definition, your response structure would look as follows. Please pay attention that all the values in the output are fake values for just demo purposes.
	// res = armdataprotection.BackupVaultsClientCreateOrUpdateResponse{
	// 	BackupVaultResource: &armdataprotection.BackupVaultResource{
	// 		Name: to.Ptr("swaggerExample"),
	// 		Type: to.Ptr("Microsoft.DataProtection/Backupvaults"),
	// 		ID: to.Ptr("/subscriptions/0b352192-dcac-4cc7-992e-a96190ccc68c/resourceGroups/SampleResourceGroup/providers/Microsoft.DataProtection/Backupvaults/swaggerExample"),
	// 		Location: to.Ptr("WestUS"),
	// 		Properties: &armdataprotection.BackupVault{
	// 			MonitoringSettings: &armdataprotection.MonitoringSettings{
	// 				AzureMonitorAlertSettings: &armdataprotection.AzureMonitorAlertSettings{
	// 					AlertsForAllJobFailures: to.Ptr(armdataprotection.AlertsStateEnabled),
	// 				},
	// 			},
	// 			ProvisioningState: to.Ptr(armdataprotection.ProvisioningStateSucceeded),
	// 			StorageSettings: []*armdataprotection.StorageSetting{
	// 				{
	// 					Type: to.Ptr(armdataprotection.StorageSettingTypesLocallyRedundant),
	// 					DatastoreType: to.Ptr(armdataprotection.StorageSettingStoreTypesVaultStore),
	// 				},
	// 			},
	// 		},
	// 		Tags: map[string]*string{
	// 			"key1": to.Ptr("val1"),
	// 		},
	// 	},
	// }
}

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

const { DataProtectionClient } = require("@azure/arm-dataprotection");
const { DefaultAzureCredential } = require("@azure/identity");

/**
 * This sample demonstrates how to creates or updates a BackupVault resource belonging to a resource group.
 *
 * @summary creates or updates a BackupVault resource belonging to a resource group.
 * x-ms-original-file: 2026-03-01/VaultCRUD/PutBackupVaultWithCMK.json
 */
async function createBackupVaultWithCMK() {
  const credential = new DefaultAzureCredential();
  const subscriptionId = "0b352192-dcac-4cc7-992e-a96190ccc68c";
  const client = new DataProtectionClient(credential, subscriptionId);
  const result = await client.backupVaults.createOrUpdate("SampleResourceGroup", "swaggerExample", {
    location: "WestUS",
    properties: {
      monitoringSettings: { azureMonitorAlertSettings: { alertsForAllJobFailures: "Enabled" } },
      securitySettings: {
        encryptionSettings: {
          infrastructureEncryption: "Enabled",
          kekIdentity: {
            identityId:
              "/subscriptions/85bf5e8c-3084-4f42-add2-746ebb7e97b2/resourcegroups/defaultrg/providers/Microsoft.ManagedIdentity/userAssignedIdentities/examplemsi",
            identityType: "UserAssigned",
          },
          keyVaultProperties: {
            keyUri: "https://cmk2xkv.vault.azure.net/keys/Key1/0767b348bb1a4c07baa6c4ec0055d2b3",
          },
          state: "Enabled",
        },
        immutabilitySettings: { state: "Disabled" },
        softDeleteSettings: { retentionDurationInDays: 0, state: "Off" },
      },
      storageSettings: [{ type: "LocallyRedundant", datastoreType: "VaultStore" }],
    },
    tags: { key1: "val1" },
  });
  console.log(result);
}

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

Sample response

Status code:: 200

{
  "name": "swaggerExample",
  "type": "Microsoft.DataProtection/Backupvaults",
  "id": "/subscriptions/0b352192-dcac-4cc7-992e-a96190ccc68c/resourceGroups/SampleResourceGroup/providers/Microsoft.DataProtection/Backupvaults/swaggerExample",
  "location": "WestUS",
  "properties": {
    "monitoringSettings": {
      "azureMonitorAlertSettings": {
        "alertsForAllJobFailures": "Enabled"
      }
    },
    "provisioningState": "Succeeded",
    "storageSettings": [
      {
        "type": "LocallyRedundant",
        "datastoreType": "VaultStore"
      }
    ]
  },
  "tags": {
    "key1": "val1"
  }
}

Status code:: 201

Azure-AsyncOperation: https://management.azure.com/subscriptions/04cf684a-d41f-4550-9f70-7708a3a2283b/resourceGroups/SampleResourceGroup/providers/Microsoft.DataProtection/Backupvaults/swaggerExample/operationStatus/YWUzNDFkMzQtZmM5OS00MmUyLWEzNDMtZGJkMDIxZjlmZjgzOzdmYzBiMzhmLTc2NmItNDM5NS05OWQ1LTVmOGEzNzg4MWQzNA==?api-version=2023-04-01-privatepreview
Retry-After: 10

{
  "name": "swaggerExample",
  "type": "Microsoft.DataProtection/Backupvaults",
  "id": "/subscriptions/0b352192-dcac-4cc7-992e-a96190ccc68c/resourceGroups/SampleResourceGroup/providers/Microsoft.DataProtection/Backupvaults/swaggerExample",
  "location": "WestUS",
  "properties": {
    "monitoringSettings": {
      "azureMonitorAlertSettings": {
        "alertsForAllJobFailures": "Enabled"
      }
    },
    "provisioningState": "Provisioning",
    "securitySettings": {
      "encryptionSettings": {
        "infrastructureEncryption": "Enabled",
        "kekIdentity": {
          "identityId": "/subscriptions/85bf5e8c-3084-4f42-add2-746ebb7e97b2/resourceGroups/defaultrg/providers/Microsoft.ManagedIdentity/userAssignedIdentities/examplemsi",
          "identityType": "UserAssigned"
        },
        "keyVaultProperties": {
          "keyUri": "https://cmk2xkv.vault.azure.net/keys/Key1/0767b348bb1a4c07baa6c4ec0055d2b3"
        },
        "state": "Enabled"
      },
      "immutabilitySettings": {
        "state": "Disabled"
      },
      "softDeleteSettings": {
        "retentionDurationInDays": 0,
        "state": "Off"
      }
    },
    "storageSettings": [
      {
        "type": "LocallyRedundant",
        "datastoreType": "VaultStore"
      }
    ]
  },
  "tags": {
    "key1": "val1"
  }
}

Create BackupVault With MSI

Sample request

PUT https://management.azure.com/subscriptions/0b352192-dcac-4cc7-992e-a96190ccc68c/resourceGroups/SampleResourceGroup/providers/Microsoft.DataProtection/backupVaults/swaggerExample?api-version=2026-03-01

{
  "location": "WestUS",
  "properties": {
    "featureSettings": {
      "crossRegionRestoreSettings": {
        "state": "Enabled"
      }
    },
    "monitoringSettings": {
      "azureMonitorAlertSettings": {
        "alertsForAllJobFailures": "Enabled"
      }
    },
    "securitySettings": {
      "softDeleteSettings": {
        "retentionDurationInDays": 14,
        "state": "Enabled"
      }
    },
    "storageSettings": [
      {
        "type": "LocallyRedundant",
        "datastoreType": "VaultStore"
      }
    ]
  },
  "tags": {
    "key1": "val1"
  }
}


import com.azure.resourcemanager.dataprotection.models.AlertsState;
import com.azure.resourcemanager.dataprotection.models.AzureMonitorAlertSettings;
import com.azure.resourcemanager.dataprotection.models.BackupVault;
import com.azure.resourcemanager.dataprotection.models.CrossRegionRestoreSettings;
import com.azure.resourcemanager.dataprotection.models.CrossRegionRestoreState;
import com.azure.resourcemanager.dataprotection.models.FeatureSettings;
import com.azure.resourcemanager.dataprotection.models.MonitoringSettings;
import com.azure.resourcemanager.dataprotection.models.SecuritySettings;
import com.azure.resourcemanager.dataprotection.models.SoftDeleteSettings;
import com.azure.resourcemanager.dataprotection.models.SoftDeleteState;
import com.azure.resourcemanager.dataprotection.models.StorageSetting;
import com.azure.resourcemanager.dataprotection.models.StorageSettingStoreTypes;
import com.azure.resourcemanager.dataprotection.models.StorageSettingTypes;
import java.util.Arrays;
import java.util.HashMap;
import java.util.Map;

/**
 * Samples for BackupVaults CreateOrUpdate.
 */
public final class Main {
    /*
     * x-ms-original-file: 2026-03-01/VaultCRUD/PutBackupVaultWithMSI.json
     */
    /**
     * Sample code: Create BackupVault With MSI.
     * 
     * @param manager Entry point to DataProtectionManager.
     */
    public static void
        createBackupVaultWithMSI(com.azure.resourcemanager.dataprotection.DataProtectionManager manager) {
        manager.backupVaults().define("swaggerExample").withRegion("WestUS")
            .withExistingResourceGroup("SampleResourceGroup")
            .withProperties(new BackupVault()
                .withMonitoringSettings(new MonitoringSettings().withAzureMonitorAlertSettings(
                    new AzureMonitorAlertSettings().withAlertsForAllJobFailures(AlertsState.ENABLED)))
                .withSecuritySettings(new SecuritySettings().withSoftDeleteSettings(new SoftDeleteSettings()
                    .withState(SoftDeleteState.fromString("Enabled")).withRetentionDurationInDays(14.0D)))
                .withStorageSettings(
                    Arrays.asList(new StorageSetting().withDatastoreType(StorageSettingStoreTypes.VAULT_STORE)
                        .withType(StorageSettingTypes.LOCALLY_REDUNDANT)))
                .withFeatureSettings(new FeatureSettings().withCrossRegionRestoreSettings(
                    new CrossRegionRestoreSettings().withState(CrossRegionRestoreState.ENABLED))))
            .withTags(mapOf("key1", "fakeTokenPlaceholder")).create();
    }

    // Use "Map.of" if available
    @SuppressWarnings("unchecked")
    private static <T> Map<String, T> mapOf(Object... inputs) {
        Map<String, T> map = new HashMap<>();
        for (int i = 0; i < inputs.length; i += 2) {
            String key = (String) inputs[i];
            T value = (T) inputs[i + 1];
            map.put(key, value);
        }
        return map;
    }
}

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

from azure.identity import DefaultAzureCredential

from azure.mgmt.dataprotection import DataProtectionMgmtClient

"""
# PREREQUISITES
    pip install azure-identity
    pip install azure-mgmt-dataprotection
# USAGE
    python put_backup_vault_with_msi.py

    Before run the sample, please set the values of the client ID, tenant ID and client secret
    of the AAD application as environment variables: AZURE_CLIENT_ID, AZURE_TENANT_ID,
    AZURE_CLIENT_SECRET. For more info about how to get the value, please see:
    https://docs.microsoft.com/azure/active-directory/develop/howto-create-service-principal-portal
"""


def main():
    client = DataProtectionMgmtClient(
        credential=DefaultAzureCredential(),
        subscription_id="SUBSCRIPTION_ID",
    )

    response = client.backup_vaults.begin_create_or_update(
        resource_group_name="SampleResourceGroup",
        vault_name="swaggerExample",
        parameters={
            "location": "WestUS",
            "properties": {
                "featureSettings": {"crossRegionRestoreSettings": {"state": "Enabled"}},
                "monitoringSettings": {"azureMonitorAlertSettings": {"alertsForAllJobFailures": "Enabled"}},
                "securitySettings": {"softDeleteSettings": {"retentionDurationInDays": 14, "state": "Enabled"}},
                "storageSettings": [{"datastoreType": "VaultStore", "type": "LocallyRedundant"}],
            },
            "tags": {"key1": "val1"},
        },
    ).result()
    print(response)


# x-ms-original-file: 2026-03-01/VaultCRUD/PutBackupVaultWithMSI.json
if __name__ == "__main__":
    main()

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

package armdataprotection_test

import (
	"context"
	"log"

	"github.com/Azure/azure-sdk-for-go/sdk/azcore/to"
	"github.com/Azure/azure-sdk-for-go/sdk/azidentity"
	"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/dataprotection/armdataprotection/v4"
)

// Generated from example definition: 2026-03-01/VaultCRUD/PutBackupVaultWithMSI.json
func ExampleBackupVaultsClient_BeginCreateOrUpdate_createBackupVaultWithMsi() {
	cred, err := azidentity.NewDefaultAzureCredential(nil)
	if err != nil {
		log.Fatalf("failed to obtain a credential: %v", err)
	}
	ctx := context.Background()
	clientFactory, err := armdataprotection.NewClientFactory("0b352192-dcac-4cc7-992e-a96190ccc68c", cred, nil)
	if err != nil {
		log.Fatalf("failed to create client: %v", err)
	}
	poller, err := clientFactory.NewBackupVaultsClient().BeginCreateOrUpdate(ctx, "SampleResourceGroup", "swaggerExample", armdataprotection.BackupVaultResource{
		Location: to.Ptr("WestUS"),
		Properties: &armdataprotection.BackupVault{
			FeatureSettings: &armdataprotection.FeatureSettings{
				CrossRegionRestoreSettings: &armdataprotection.CrossRegionRestoreSettings{
					State: to.Ptr(armdataprotection.CrossRegionRestoreStateEnabled),
				},
			},
			MonitoringSettings: &armdataprotection.MonitoringSettings{
				AzureMonitorAlertSettings: &armdataprotection.AzureMonitorAlertSettings{
					AlertsForAllJobFailures: to.Ptr(armdataprotection.AlertsStateEnabled),
				},
			},
			SecuritySettings: &armdataprotection.SecuritySettings{
				SoftDeleteSettings: &armdataprotection.SoftDeleteSettings{
					RetentionDurationInDays: to.Ptr[float64](14),
					State:                   to.Ptr(armdataprotection.SoftDeleteState("Enabled")),
				},
			},
			StorageSettings: []*armdataprotection.StorageSetting{
				{
					Type:          to.Ptr(armdataprotection.StorageSettingTypesLocallyRedundant),
					DatastoreType: to.Ptr(armdataprotection.StorageSettingStoreTypesVaultStore),
				},
			},
		},
		Tags: map[string]*string{
			"key1": to.Ptr("val1"),
		},
	}, nil)
	if err != nil {
		log.Fatalf("failed to finish the request: %v", err)
	}
	res, err := poller.PollUntilDone(ctx, nil)
	if err != nil {
		log.Fatalf("failed to pull the result: %v", err)
	}
	// You could use response here. We use blank identifier for just demo purposes.
	_ = res
	// If the HTTP response code is 200 as defined in example definition, your response structure would look as follows. Please pay attention that all the values in the output are fake values for just demo purposes.
	// res = armdataprotection.BackupVaultsClientCreateOrUpdateResponse{
	// 	BackupVaultResource: &armdataprotection.BackupVaultResource{
	// 		Name: to.Ptr("swaggerExample"),
	// 		Type: to.Ptr("Microsoft.DataProtection/Backupvaults"),
	// 		ID: to.Ptr("/subscriptions/0b352192-dcac-4cc7-992e-a96190ccc68c/resourceGroups/SampleResourceGroup/providers/Microsoft.DataProtection/Backupvaults/swaggerExample"),
	// 		Location: to.Ptr("WestUS"),
	// 		Properties: &armdataprotection.BackupVault{
	// 			FeatureSettings: &armdataprotection.FeatureSettings{
	// 				CrossRegionRestoreSettings: &armdataprotection.CrossRegionRestoreSettings{
	// 					State: to.Ptr(armdataprotection.CrossRegionRestoreStateEnabled),
	// 				},
	// 			},
	// 			MonitoringSettings: &armdataprotection.MonitoringSettings{
	// 				AzureMonitorAlertSettings: &armdataprotection.AzureMonitorAlertSettings{
	// 					AlertsForAllJobFailures: to.Ptr(armdataprotection.AlertsStateEnabled),
	// 				},
	// 			},
	// 			ProvisioningState: to.Ptr(armdataprotection.ProvisioningStateSucceeded),
	// 			SecureScore: to.Ptr(armdataprotection.SecureScoreLevelAdequate),
	// 			SecuritySettings: &armdataprotection.SecuritySettings{
	// 				SoftDeleteSettings: &armdataprotection.SoftDeleteSettings{
	// 					RetentionDurationInDays: to.Ptr[float64](14),
	// 					State: to.Ptr(armdataprotection.SoftDeleteState("Enabled")),
	// 				},
	// 			},
	// 			StorageSettings: []*armdataprotection.StorageSetting{
	// 				{
	// 					Type: to.Ptr(armdataprotection.StorageSettingTypesLocallyRedundant),
	// 					DatastoreType: to.Ptr(armdataprotection.StorageSettingStoreTypesVaultStore),
	// 				},
	// 			},
	// 		},
	// 		Tags: map[string]*string{
	// 			"key1": to.Ptr("val1"),
	// 		},
	// 	},
	// }
}

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

const { DataProtectionClient } = require("@azure/arm-dataprotection");
const { DefaultAzureCredential } = require("@azure/identity");

/**
 * This sample demonstrates how to creates or updates a BackupVault resource belonging to a resource group.
 *
 * @summary creates or updates a BackupVault resource belonging to a resource group.
 * x-ms-original-file: 2026-03-01/VaultCRUD/PutBackupVaultWithMSI.json
 */
async function createBackupVaultWithMSI() {
  const credential = new DefaultAzureCredential();
  const subscriptionId = "0b352192-dcac-4cc7-992e-a96190ccc68c";
  const client = new DataProtectionClient(credential, subscriptionId);
  const result = await client.backupVaults.createOrUpdate("SampleResourceGroup", "swaggerExample", {
    location: "WestUS",
    properties: {
      featureSettings: { crossRegionRestoreSettings: { state: "Enabled" } },
      monitoringSettings: { azureMonitorAlertSettings: { alertsForAllJobFailures: "Enabled" } },
      securitySettings: { softDeleteSettings: { retentionDurationInDays: 14, state: "Enabled" } },
      storageSettings: [{ type: "LocallyRedundant", datastoreType: "VaultStore" }],
    },
    tags: { key1: "val1" },
  });
  console.log(result);
}

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

Sample response

Status code:: 200

{
  "name": "swaggerExample",
  "type": "Microsoft.DataProtection/Backupvaults",
  "id": "/subscriptions/0b352192-dcac-4cc7-992e-a96190ccc68c/resourceGroups/SampleResourceGroup/providers/Microsoft.DataProtection/Backupvaults/swaggerExample",
  "location": "WestUS",
  "properties": {
    "featureSettings": {
      "crossRegionRestoreSettings": {
        "state": "Enabled"
      }
    },
    "monitoringSettings": {
      "azureMonitorAlertSettings": {
        "alertsForAllJobFailures": "Enabled"
      }
    },
    "provisioningState": "Succeeded",
    "secureScore": "Adequate",
    "securitySettings": {
      "softDeleteSettings": {
        "retentionDurationInDays": 14,
        "state": "Enabled"
      }
    },
    "storageSettings": [
      {
        "type": "LocallyRedundant",
        "datastoreType": "VaultStore"
      }
    ]
  },
  "tags": {
    "key1": "val1"
  }
}

Status code:: 201

Azure-AsyncOperation: https://management.azure.com/subscriptions/04cf684a-d41f-4550-9f70-7708a3a2283b/resourceGroups/SampleResourceGroup/providers/Microsoft.DataProtection/Backupvaults/swaggerExample/operationStatus/YWUzNDFkMzQtZmM5OS00MmUyLWEzNDMtZGJkMDIxZjlmZjgzOzdmYzBiMzhmLTc2NmItNDM5NS05OWQ1LTVmOGEzNzg4MWQzNA==?api-version=2026-03-01
Retry-After: 10

{
  "name": "swaggerExample",
  "type": "Microsoft.DataProtection/Backupvaults",
  "id": "/subscriptions/0b352192-dcac-4cc7-992e-a96190ccc68c/resourceGroups/SampleResourceGroup/providers/Microsoft.DataProtection/Backupvaults/swaggerExample",
  "location": "WestUS",
  "properties": {
    "featureSettings": {
      "crossRegionRestoreSettings": {
        "state": "Enabled"
      }
    },
    "monitoringSettings": {
      "azureMonitorAlertSettings": {
        "alertsForAllJobFailures": "Enabled"
      }
    },
    "provisioningState": "Provisioning",
    "secureScore": "Adequate",
    "securitySettings": {
      "softDeleteSettings": {
        "retentionDurationInDays": 14,
        "state": "Enabled"
      }
    },
    "storageSettings": [
      {
        "type": "LocallyRedundant",
        "datastoreType": "VaultStore"
      }
    ]
  },
  "tags": {
    "key1": "val1"
  }
}

Create or Update Backup Vault With CMK and Resource Guard Enabled

Sample request

PUT https://management.azure.com/subscriptions/0b352192-dcac-4cc7-992e-a96190ccc68c/resourceGroups/SampleResourceGroup/providers/Microsoft.DataProtection/backupVaults/swaggerExample?api-version=2026-03-01

{
  "location": "WestUS",
  "tags": {
    "key1": "val1"
  },
  "identity": {
    "type": "None"
  },
  "properties": {
    "monitoringSettings": {
      "azureMonitorAlertSettings": {
        "alertsForAllJobFailures": "Enabled"
      }
    },
    "securitySettings": {
      "softDeleteSettings": {
        "state": "Off",
        "retentionDurationInDays": 0
      },
      "immutabilitySettings": {
        "state": "Disabled"
      },
      "encryptionSettings": {
        "state": "Enabled",
        "keyVaultProperties": {
          "keyUri": "https://cmk2xkv.vault.azure.net/keys/Key1/0767b348bb1a4c07baa6c4ec0055d2b3"
        },
        "kekIdentity": {
          "identityType": "UserAssigned",
          "identityId": "/subscriptions/85bf5e8c-3084-4f42-add2-746ebb7e97b2/resourcegroups/defaultrg/providers/Microsoft.ManagedIdentity/userAssignedIdentities/examplemsi"
        },
        "infrastructureEncryption": "Enabled"
      }
    },
    "storageSettings": [
      {
        "datastoreType": "VaultStore",
        "type": "LocallyRedundant"
      }
    ]
  }
}

Sample response

Status code:: 201

Retry-After: 10
Azure-AsyncOperation: https://management.azure.com/subscriptions/04cf684a-d41f-4550-9f70-7708a3a2283b/resourceGroups/SampleResourceGroup/providers/Microsoft.DataProtection/Backupvaults/swaggerExample/operationStatus/YWUzNDFkMzQtZmM5OS00MmUyLWEzNDMtZGJkMDIxZjlmZjgzOzdmYzBiMzhmLTc2NmItNDM5NS05OWQ1LTVmOGEzNzg4MWQzNA==?api-version=2026-03-01

{
  "id": "/subscriptions/0b352192-dcac-4cc7-992e-a96190ccc68c/resourceGroups/SampleResourceGroup/providers/Microsoft.DataProtection/Backupvaults/swaggerExample",
  "name": "swaggerExample",
  "type": "Microsoft.DataProtection/Backupvaults",
  "location": "WestUS",
  "tags": {
    "key1": "val1"
  },
  "properties": {
    "monitoringSettings": {
      "azureMonitorAlertSettings": {
        "alertsForAllJobFailures": "Enabled"
      }
    },
    "securitySettings": {
      "softDeleteSettings": {
        "state": "Off",
        "retentionDurationInDays": 0
      },
      "immutabilitySettings": {
        "state": "Disabled"
      },
      "encryptionSettings": {
        "state": "Enabled",
        "keyVaultProperties": {
          "keyUri": "https://cmk2xkv.vault.azure.net/keys/Key1/0767b348bb1a4c07baa6c4ec0055d2b3"
        },
        "kekIdentity": {
          "identityType": "UserAssigned",
          "identityId": "/subscriptions/85bf5e8c-3084-4f42-add2-746ebb7e97b2/resourcegroups/defaultrg/providers/Microsoft.ManagedIdentity/userAssignedIdentities/examplemsi"
        },
        "infrastructureEncryption": "Enabled"
      }
    },
    "resourceGuardOperationRequests": [
      "/subscriptions/754ec39f-8d2a-44cf-bfbf-13107ac85c36/resourcegroups/mua-testing/providers/Microsoft.DataProtection/resourceGuards/gvjreddy-test-ecy-rg-reader/dppModifyEncryptionSettingsRequests/default"
    ],
    "provisioningState": "Provisioning",
    "storageSettings": [
      {
        "datastoreType": "VaultStore",
        "type": "LocallyRedundant"
      }
    ]
  }
}

Status code:: 200

{
  "identity": {
    "type": "None"
  },
  "id": "/subscriptions/0b352192-dcac-4cc7-992e-a96190ccc68c/resourceGroups/SampleResourceGroup/providers/Microsoft.DataProtection/Backupvaults/swaggerExample",
  "name": "swaggerExample",
  "type": "Microsoft.DataProtection/Backupvaults",
  "location": "WestUS",
  "tags": {
    "key1": "val1"
  },
  "properties": {
    "monitoringSettings": {
      "azureMonitorAlertSettings": {
        "alertsForAllJobFailures": "Enabled"
      }
    },
    "provisioningState": "Succeeded",
    "storageSettings": [
      {
        "datastoreType": "VaultStore",
        "type": "LocallyRedundant"
      }
    ]
  }
}

Restore a soft-deleted backup vault

Sample request

PUT https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/SampleResourceGroup/providers/Microsoft.DataProtection/backupVaults/swaggerExample?api-version=2026-03-01


{
  "location": "WestUS",
  "properties": {
    "monitoringSettings": {
      "azureMonitorAlertSettings": {
        "alertsForAllJobFailures": "Enabled"
      }
    },
    "securitySettings": {
      "softDeleteSettings": {
        "retentionDurationInDays": 14,
        "state": "Enabled"
      },
      "immutabilitySettings": {
        "state": "Disabled"
      }
    },
    "storageSettings": [
      {
        "datastoreType": "VaultStore",
        "type": "LocallyRedundant"
      }
    ],
    "featureSettings": {
      "crossSubscriptionRestoreSettings": {
        "state": "Disabled"
      },
      "crossRegionRestoreSettings": {
        "state": "Enabled"
      }
    }
  },
  "tags": {
    "key1": "val1"
  }
}


import com.azure.resourcemanager.dataprotection.models.AlertsState;
import com.azure.resourcemanager.dataprotection.models.AzureMonitorAlertSettings;
import com.azure.resourcemanager.dataprotection.models.BackupVault;
import com.azure.resourcemanager.dataprotection.models.CrossRegionRestoreSettings;
import com.azure.resourcemanager.dataprotection.models.CrossRegionRestoreState;
import com.azure.resourcemanager.dataprotection.models.CrossSubscriptionRestoreSettings;
import com.azure.resourcemanager.dataprotection.models.CrossSubscriptionRestoreState;
import com.azure.resourcemanager.dataprotection.models.FeatureSettings;
import com.azure.resourcemanager.dataprotection.models.ImmutabilitySettings;
import com.azure.resourcemanager.dataprotection.models.ImmutabilityState;
import com.azure.resourcemanager.dataprotection.models.MonitoringSettings;
import com.azure.resourcemanager.dataprotection.models.SecuritySettings;
import com.azure.resourcemanager.dataprotection.models.SoftDeleteSettings;
import com.azure.resourcemanager.dataprotection.models.SoftDeleteState;
import com.azure.resourcemanager.dataprotection.models.StorageSetting;
import com.azure.resourcemanager.dataprotection.models.StorageSettingStoreTypes;
import com.azure.resourcemanager.dataprotection.models.StorageSettingTypes;
import java.util.Arrays;
import java.util.HashMap;
import java.util.Map;

/**
 * Samples for BackupVaults CreateOrUpdate.
 */
public final class Main {
    /*
     * x-ms-original-file: 2026-03-01/PutBackupVaultWithUndelete.json
     */
    /**
     * Sample code: Restore a soft-deleted backup vault.
     * 
     * @param manager Entry point to DataProtectionManager.
     */
    public static void
        restoreASoftDeletedBackupVault(com.azure.resourcemanager.dataprotection.DataProtectionManager manager) {
        manager.backupVaults().define("swaggerExample").withRegion("WestUS")
            .withExistingResourceGroup("SampleResourceGroup")
            .withProperties(new BackupVault()
                .withMonitoringSettings(new MonitoringSettings().withAzureMonitorAlertSettings(
                    new AzureMonitorAlertSettings().withAlertsForAllJobFailures(AlertsState.ENABLED)))
                .withSecuritySettings(new SecuritySettings()
                    .withSoftDeleteSettings(new SoftDeleteSettings().withState(SoftDeleteState.fromString("Enabled"))
                        .withRetentionDurationInDays(14.0D))
                    .withImmutabilitySettings(new ImmutabilitySettings().withState(ImmutabilityState.DISABLED)))
                .withStorageSettings(
                    Arrays.asList(new StorageSetting().withDatastoreType(StorageSettingStoreTypes.VAULT_STORE)
                        .withType(StorageSettingTypes.LOCALLY_REDUNDANT)))
                .withFeatureSettings(new FeatureSettings()
                    .withCrossSubscriptionRestoreSettings(
                        new CrossSubscriptionRestoreSettings().withState(CrossSubscriptionRestoreState.DISABLED))
                    .withCrossRegionRestoreSettings(
                        new CrossRegionRestoreSettings().withState(CrossRegionRestoreState.ENABLED))))
            .withTags(mapOf("key1", "fakeTokenPlaceholder"))
            .withXMsDeletedVaultId(
                "/subscriptions/00000000-0000-0000-0000-000000000000/providers/Microsoft.DataProtection/locations/WestUS/deletedVaults/swaggerExample")
            .create();
    }

    // Use "Map.of" if available
    @SuppressWarnings("unchecked")
    private static <T> Map<String, T> mapOf(Object... inputs) {
        Map<String, T> map = new HashMap<>();
        for (int i = 0; i < inputs.length; i += 2) {
            String key = (String) inputs[i];
            T value = (T) inputs[i + 1];
            map.put(key, value);
        }
        return map;
    }
}

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

from azure.identity import DefaultAzureCredential

from azure.mgmt.dataprotection import DataProtectionMgmtClient

"""
# PREREQUISITES
    pip install azure-identity
    pip install azure-mgmt-dataprotection
# USAGE
    python put_backup_vault_with_undelete.py

    Before run the sample, please set the values of the client ID, tenant ID and client secret
    of the AAD application as environment variables: AZURE_CLIENT_ID, AZURE_TENANT_ID,
    AZURE_CLIENT_SECRET. For more info about how to get the value, please see:
    https://docs.microsoft.com/azure/active-directory/develop/howto-create-service-principal-portal
"""


def main():
    client = DataProtectionMgmtClient(
        credential=DefaultAzureCredential(),
        subscription_id="SUBSCRIPTION_ID",
    )

    response = client.backup_vaults.begin_create_or_update(
        resource_group_name="SampleResourceGroup",
        vault_name="swaggerExample",
        parameters={
            "location": "WestUS",
            "properties": {
                "featureSettings": {
                    "crossRegionRestoreSettings": {"state": "Enabled"},
                    "crossSubscriptionRestoreSettings": {"state": "Disabled"},
                },
                "monitoringSettings": {"azureMonitorAlertSettings": {"alertsForAllJobFailures": "Enabled"}},
                "securitySettings": {
                    "immutabilitySettings": {"state": "Disabled"},
                    "softDeleteSettings": {"retentionDurationInDays": 14, "state": "Enabled"},
                },
                "storageSettings": [{"datastoreType": "VaultStore", "type": "LocallyRedundant"}],
            },
            "tags": {"key1": "val1"},
        },
    ).result()
    print(response)


# x-ms-original-file: 2026-03-01/PutBackupVaultWithUndelete.json
if __name__ == "__main__":
    main()

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

package armdataprotection_test

import (
	"context"
	"log"

	"github.com/Azure/azure-sdk-for-go/sdk/azcore/to"
	"github.com/Azure/azure-sdk-for-go/sdk/azidentity"
	"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/dataprotection/armdataprotection/v4"
)

// Generated from example definition: 2026-03-01/PutBackupVaultWithUndelete.json
func ExampleBackupVaultsClient_BeginCreateOrUpdate_restoreASoftDeletedBackupVault() {
	cred, err := azidentity.NewDefaultAzureCredential(nil)
	if err != nil {
		log.Fatalf("failed to obtain a credential: %v", err)
	}
	ctx := context.Background()
	clientFactory, err := armdataprotection.NewClientFactory("00000000-0000-0000-0000-000000000000", cred, nil)
	if err != nil {
		log.Fatalf("failed to create client: %v", err)
	}
	poller, err := clientFactory.NewBackupVaultsClient().BeginCreateOrUpdate(ctx, "SampleResourceGroup", "swaggerExample", armdataprotection.BackupVaultResource{
		Location: to.Ptr("WestUS"),
		Properties: &armdataprotection.BackupVault{
			MonitoringSettings: &armdataprotection.MonitoringSettings{
				AzureMonitorAlertSettings: &armdataprotection.AzureMonitorAlertSettings{
					AlertsForAllJobFailures: to.Ptr(armdataprotection.AlertsStateEnabled),
				},
			},
			SecuritySettings: &armdataprotection.SecuritySettings{
				SoftDeleteSettings: &armdataprotection.SoftDeleteSettings{
					RetentionDurationInDays: to.Ptr[float64](14),
					State:                   to.Ptr(armdataprotection.SoftDeleteState("Enabled")),
				},
				ImmutabilitySettings: &armdataprotection.ImmutabilitySettings{
					State: to.Ptr(armdataprotection.ImmutabilityStateDisabled),
				},
			},
			StorageSettings: []*armdataprotection.StorageSetting{
				{
					DatastoreType: to.Ptr(armdataprotection.StorageSettingStoreTypesVaultStore),
					Type:          to.Ptr(armdataprotection.StorageSettingTypesLocallyRedundant),
				},
			},
			FeatureSettings: &armdataprotection.FeatureSettings{
				CrossSubscriptionRestoreSettings: &armdataprotection.CrossSubscriptionRestoreSettings{
					State: to.Ptr(armdataprotection.CrossSubscriptionRestoreStateDisabled),
				},
				CrossRegionRestoreSettings: &armdataprotection.CrossRegionRestoreSettings{
					State: to.Ptr(armdataprotection.CrossRegionRestoreStateEnabled),
				},
			},
		},
		Tags: map[string]*string{
			"key1": to.Ptr("val1"),
		},
	}, &armdataprotection.BackupVaultsClientBeginCreateOrUpdateOptions{
		XMSDeletedVaultID: to.Ptr("/subscriptions/00000000-0000-0000-0000-000000000000/providers/Microsoft.DataProtection/locations/WestUS/deletedVaults/swaggerExample")})
	if err != nil {
		log.Fatalf("failed to finish the request: %v", err)
	}
	res, err := poller.PollUntilDone(ctx, nil)
	if err != nil {
		log.Fatalf("failed to pull the result: %v", err)
	}
	// You could use response here. We use blank identifier for just demo purposes.
	_ = res
	// If the HTTP response code is 200 as defined in example definition, your response structure would look as follows. Please pay attention that all the values in the output are fake values for just demo purposes.
	// res = armdataprotection.BackupVaultsClientCreateOrUpdateResponse{
	// 	BackupVaultResource: &armdataprotection.BackupVaultResource{
	// 		Location: to.Ptr("WestUS"),
	// 		Tags: map[string]*string{
	// 			"key1": to.Ptr("val1"),
	// 		},
	// 		ID: to.Ptr("/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/SampleResourceGroup/providers/Microsoft.DataProtection/BackupVaults/swaggerExample"),
	// 		Name: to.Ptr("swaggerExample"),
	// 		Type: to.Ptr("Microsoft.DataProtection/BackupVaults"),
	// 		Properties: &armdataprotection.BackupVault{
	// 			ProvisioningState: to.Ptr(armdataprotection.ProvisioningStateSucceeded),
	// 			ResourceMoveState: to.Ptr(armdataprotection.ResourceMoveStateUnknown),
	// 			MonitoringSettings: &armdataprotection.MonitoringSettings{
	// 				AzureMonitorAlertSettings: &armdataprotection.AzureMonitorAlertSettings{
	// 					AlertsForAllJobFailures: to.Ptr(armdataprotection.AlertsStateEnabled),
	// 				},
	// 			},
	// 			SecuritySettings: &armdataprotection.SecuritySettings{
	// 				SoftDeleteSettings: &armdataprotection.SoftDeleteSettings{
	// 					RetentionDurationInDays: to.Ptr[float64](14),
	// 					State: to.Ptr(armdataprotection.SoftDeleteState("Enabled")),
	// 				},
	// 				ImmutabilitySettings: &armdataprotection.ImmutabilitySettings{
	// 					State: to.Ptr(armdataprotection.ImmutabilityStateDisabled),
	// 				},
	// 			},
	// 			StorageSettings: []*armdataprotection.StorageSetting{
	// 				{
	// 					DatastoreType: to.Ptr(armdataprotection.StorageSettingStoreTypesVaultStore),
	// 					Type: to.Ptr(armdataprotection.StorageSettingTypesLocallyRedundant),
	// 				},
	// 			},
	// 			FeatureSettings: &armdataprotection.FeatureSettings{
	// 				CrossSubscriptionRestoreSettings: &armdataprotection.CrossSubscriptionRestoreSettings{
	// 					State: to.Ptr(armdataprotection.CrossSubscriptionRestoreStateDisabled),
	// 				},
	// 				CrossRegionRestoreSettings: &armdataprotection.CrossRegionRestoreSettings{
	// 					State: to.Ptr(armdataprotection.CrossRegionRestoreStateEnabled),
	// 				},
	// 			},
	// 			SecureScore: to.Ptr(armdataprotection.SecureScoreLevelMaximum),
	// 			IsVaultProtectedByResourceGuard: to.Ptr(false),
	// 			ResourceGuardOperationRequests: []*string{
	// 			},
	// 			ReplicatedRegions: []*string{
	// 			},
	// 		},
	// 	},
	// }
}

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

const { DataProtectionClient } = require("@azure/arm-dataprotection");
const { DefaultAzureCredential } = require("@azure/identity");

/**
 * This sample demonstrates how to creates or updates a BackupVault resource belonging to a resource group.
 *
 * @summary creates or updates a BackupVault resource belonging to a resource group.
 * x-ms-original-file: 2026-03-01/PutBackupVaultWithUndelete.json
 */
async function restoreASoftDeletedBackupVault() {
  const credential = new DefaultAzureCredential();
  const subscriptionId = "00000000-0000-0000-0000-000000000000";
  const client = new DataProtectionClient(credential, subscriptionId);
  const result = await client.backupVaults.createOrUpdate(
    "SampleResourceGroup",
    "swaggerExample",
    {
      location: "WestUS",
      properties: {
        monitoringSettings: { azureMonitorAlertSettings: { alertsForAllJobFailures: "Enabled" } },
        securitySettings: {
          softDeleteSettings: { retentionDurationInDays: 14, state: "Enabled" },
          immutabilitySettings: { state: "Disabled" },
        },
        storageSettings: [{ datastoreType: "VaultStore", type: "LocallyRedundant" }],
        featureSettings: {
          crossSubscriptionRestoreSettings: { state: "Disabled" },
          crossRegionRestoreSettings: { state: "Enabled" },
        },
      },
      tags: { key1: "val1" },
    },
    {
      xMsDeletedVaultId:
        "/subscriptions/00000000-0000-0000-0000-000000000000/providers/Microsoft.DataProtection/locations/WestUS/deletedVaults/swaggerExample",
    },
  );
  console.log(result);
}

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

Sample response

Status code:: 200

{
  "location": "WestUS",
  "tags": {
    "key1": "val1"
  },
  "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/SampleResourceGroup/providers/Microsoft.DataProtection/BackupVaults/swaggerExample",
  "name": "swaggerExample",
  "type": "Microsoft.DataProtection/BackupVaults",
  "properties": {
    "provisioningState": "Succeeded",
    "resourceMoveState": "Unknown",
    "monitoringSettings": {
      "azureMonitorAlertSettings": {
        "alertsForAllJobFailures": "Enabled"
      }
    },
    "securitySettings": {
      "softDeleteSettings": {
        "retentionDurationInDays": 14,
        "state": "Enabled"
      },
      "immutabilitySettings": {
        "state": "Disabled"
      }
    },
    "storageSettings": [
      {
        "datastoreType": "VaultStore",
        "type": "LocallyRedundant"
      }
    ],
    "featureSettings": {
      "crossSubscriptionRestoreSettings": {
        "state": "Disabled"
      },
      "crossRegionRestoreSettings": {
        "state": "Enabled"
      }
    },
    "secureScore": "Maximum",
    "isVaultProtectedByResourceGuard": false,
    "resourceGuardOperationRequests": [],
    "replicatedRegions": []
  }
}

Status code:: 201

{
  "location": "WestUS",
  "tags": {
    "key1": "val1"
  },
  "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/SampleResourceGroup/providers/Microsoft.DataProtection/BackupVaults/swaggerExample",
  "name": "swaggerExample",
  "type": "Microsoft.DataProtection/BackupVaults",
  "properties": {
    "provisioningState": "Succeeded",
    "resourceMoveState": "Unknown",
    "monitoringSettings": {
      "azureMonitorAlertSettings": {
        "alertsForAllJobFailures": "Enabled"
      }
    },
    "securitySettings": {
      "softDeleteSettings": {
        "retentionDurationInDays": 14,
        "state": "Enabled"
      },
      "immutabilitySettings": {
        "state": "Disabled"
      }
    },
    "storageSettings": [
      {
        "datastoreType": "VaultStore",
        "type": "LocallyRedundant"
      }
    ],
    "featureSettings": {
      "crossSubscriptionRestoreSettings": {
        "state": "Disabled"
      },
      "crossRegionRestoreSettings": {
        "state": "Enabled"
      }
    },
    "secureScore": "Maximum",
    "isVaultProtectedByResourceGuard": false,
    "resourceGuardOperationRequests": [],
    "replicatedRegions": []
  }
}

Definitions

Name	Description
AlertsState
AzureMonitorAlertSettings	Settings for Azure Monitor based alerts
BackupVault	Backup Vault
BackupVaultResource	Backup Vault Resource
BCDRSecurityLevel	Security Level of Backup Vault
CloudError	An error response from Azure Backup.
CmkKekIdentity	The details of the managed identity used for CMK
CmkKeyVaultProperties	The properties of the Key Vault which hosts CMK
createdByType	The type of identity that created the resource.
CrossRegionRestoreSettings
CrossRegionRestoreState	CrossRegionRestore state
CrossSubscriptionRestoreSettings	CrossSubscriptionRestore Settings
CrossSubscriptionRestoreState	CrossSubscriptionRestore state
DppIdentityDetails	Identity details
encryptionSettings	Customer Managed Key details of the resource.
EncryptionState	Encryption state of the Backup Vault.
Error	The resource management error response.
ErrorAdditionalInfo	The resource management error additional info.
FeatureSettings	Class containing feature settings of vault
IdentityType	The identity type. 'SystemAssigned' and 'UserAssigned' are mutually exclusive. 'SystemAssigned' will use implicitly created managed identity.
ImmutabilitySettings	Immutability Settings at vault level
ImmutabilityState	Immutability state
InfrastructureEncryptionState	Enabling/Disabling the Double Encryption state
MonitoringSettings	Monitoring Settings
ProvisioningState	Provisioning state of the BackupVault resource
ResourceMoveDetails	ResourceMoveDetails will be returned in response to GetResource call from ARM
ResourceMoveState	Resource move state for backup vault
SecureScoreLevel	Secure Score of Backup Vault
SecuritySettings	Class containing security settings of vault
SoftDeleteSettings	Soft delete related settings
SoftDeleteState	State of soft delete
StorageSetting	Storage setting
StorageSettingStoreTypes	Gets or sets the type of the datastore.
StorageSettingTypes	Gets or sets the type.
systemData	Metadata pertaining to creation and last modification of the resource.
UserAssignedIdentity	User assigned identity properties

AlertsState

Enumeration

Value	Description
Enabled
Disabled

AzureMonitorAlertSettings

Object

Settings for Azure Monitor based alerts

Name	Type	Description
alertsForAllJobFailures	AlertsState

BackupVault

Object

Backup Vault

Name	Type	Description
bcdrSecurityLevel	BCDRSecurityLevel	Security Level of Backup Vault
featureSettings	FeatureSettings	Feature Settings
isVaultProtectedByResourceGuard	boolean	Is vault protected by resource guard
monitoringSettings	MonitoringSettings	Monitoring Settings
provisioningState	ProvisioningState	Provisioning state of the BackupVault resource
replicatedRegions	string[]	List of replicated regions for Backup Vault
resourceGuardOperationRequests	string[]	ResourceGuardOperationRequests on which LAC check will be performed
resourceMoveDetails	ResourceMoveDetails	Resource move details for backup vault
resourceMoveState	ResourceMoveState	Resource move state for backup vault
secureScore	SecureScoreLevel	Secure Score of Backup Vault
securitySettings	SecuritySettings	Security Settings
storageSettings	StorageSetting[]	Storage Settings

BackupVaultResource

Object

Backup Vault Resource

Name	Type	Description
eTag	string	Optional ETag.
id	string (arm-id)	Fully qualified resource ID for the resource. E.g. "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}"
identity	DppIdentityDetails	Input Managed Identity Details
location	string	The geo-location where the resource lives
name	string	The name of the resource
properties	BackupVault	BackupVaultResource properties
systemData	systemData	Azure Resource Manager metadata containing createdBy and modifiedBy information.
tags	object	Resource tags.
type	string	The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts"

BCDRSecurityLevel

Enumeration

Security Level of Backup Vault

Value	Description
Poor
Fair
Good
Excellent
NotSupported

CloudError

Object

An error response from Azure Backup.

Name	Type	Description
error	Error	The resource management error response.

CmkKekIdentity

Object

The details of the managed identity used for CMK

Name	Type	Description
identityId	string	The managed identity to be used which has access permissions to the Key Vault. Provide a value here in case identity types: 'UserAssigned' only.
identityType	IdentityType	The identity type. 'SystemAssigned' and 'UserAssigned' are mutually exclusive. 'SystemAssigned' will use implicitly created managed identity.

CmkKeyVaultProperties

Object

The properties of the Key Vault which hosts CMK

Name	Type	Description
keyUri	string	The key uri of the Customer Managed Key

createdByType

Enumeration

The type of identity that created the resource.

Value	Description
User
Application
ManagedIdentity
Key

CrossRegionRestoreSettings

Object

Name	Type	Description
state	CrossRegionRestoreState	CrossRegionRestore state

CrossRegionRestoreState

Enumeration

CrossRegionRestore state

Value	Description
Disabled
Enabled

CrossSubscriptionRestoreSettings

Object

CrossSubscriptionRestore Settings

Name	Type	Description
state	CrossSubscriptionRestoreState	CrossSubscriptionRestore state

CrossSubscriptionRestoreState

Enumeration

CrossSubscriptionRestore state

Value	Description
Disabled
PermanentlyDisabled
Enabled

DppIdentityDetails

Object

Identity details

Name	Type	Description
principalId	string	The object ID of the service principal object for the managed identity that is used to grant role-based access to an Azure resource.
tenantId	string	A Globally Unique Identifier (GUID) that represents the Azure AD tenant where the resource is now a member.
type	string	The identityType which can be either SystemAssigned, UserAssigned, 'SystemAssigned,UserAssigned' or None
userAssignedIdentities	<string, UserAssignedIdentity>	Gets or sets the user assigned identities.

encryptionSettings

Object

Customer Managed Key details of the resource.

Name	Type	Description
infrastructureEncryption	InfrastructureEncryptionState	Enabling/Disabling the Double Encryption state
kekIdentity	CmkKekIdentity	The details of the managed identity used for CMK
keyVaultProperties	CmkKeyVaultProperties	The properties of the Key Vault which hosts CMK
state	EncryptionState	Encryption state of the Backup Vault.

EncryptionState

Enumeration

Encryption state of the Backup Vault.

Value	Description
Enabled	CMK encryption is enabled on the Backup Vault
Disabled	CMK encryption is disabled on the Backup Vault. User can not set this state once Encryption State is 'Enabled'.
Inconsistent	CMK encryption is in inconsistent state on the Backup Vault. This state indicates that user needs to retry the encryption settings operation immediately to correct the state.

Error

Object

The resource management error response.

Name	Type	Description
additionalInfo	ErrorAdditionalInfo[]	The error additional info.
code	string	The error code.
details	Error[]	The error details.
message	string	The error message.
target	string	The error target.

ErrorAdditionalInfo

Object

The resource management error additional info.

Name	Type	Description
info	object	The additional info.
type	string	The additional info type.

FeatureSettings

Object

Class containing feature settings of vault

Name	Type	Description
crossRegionRestoreSettings	CrossRegionRestoreSettings
crossSubscriptionRestoreSettings	CrossSubscriptionRestoreSettings	CrossSubscriptionRestore Settings

IdentityType

Enumeration

The identity type. 'SystemAssigned' and 'UserAssigned' are mutually exclusive. 'SystemAssigned' will use implicitly created managed identity.

Value	Description
SystemAssigned
UserAssigned

ImmutabilitySettings

Object

Immutability Settings at vault level

Name	Type	Description
state	ImmutabilityState	Immutability state

ImmutabilityState

Enumeration

Immutability state

Value	Description
Disabled
Unlocked
Locked

InfrastructureEncryptionState

Enumeration

Enabling/Disabling the Double Encryption state

Value	Description
Enabled
Disabled

MonitoringSettings

Object

Monitoring Settings

Name	Type	Description
azureMonitorAlertSettings	AzureMonitorAlertSettings	Settings for Azure Monitor based alerts

ProvisioningState

Enumeration

Provisioning state of the BackupVault resource

Value	Description
Failed
Provisioning
Succeeded
Unknown
Updating

ResourceMoveDetails

Object

ResourceMoveDetails will be returned in response to GetResource call from ARM

Name	Type	Description
completionTimeUtc	string	Completion time in UTC of latest ResourceMove operation attempted. ISO 8601 format.
operationId	string	CorrelationId of latest ResourceMove operation attempted
sourceResourcePath	string	ARM resource path of source resource
startTimeUtc	string	Start time in UTC of latest ResourceMove operation attempted. ISO 8601 format.
targetResourcePath	string	ARM resource path of target resource used in latest ResourceMove operation

ResourceMoveState

Enumeration

Resource move state for backup vault

Value	Description
Unknown
InProgress
PrepareFailed
CommitFailed
Failed
PrepareTimedout
CommitTimedout
CriticalFailure
PartialSuccess
MoveSucceeded

SecureScoreLevel

Enumeration

Secure Score of Backup Vault

Value	Description
None
Minimum
Adequate
Maximum
NotSupported

SecuritySettings

Object

Class containing security settings of vault

Name	Type	Description
encryptionSettings	encryptionSettings	Customer Managed Key details of the resource.
immutabilitySettings	ImmutabilitySettings	Immutability Settings at vault level
softDeleteSettings	SoftDeleteSettings	Soft delete related settings

SoftDeleteSettings

Object

Soft delete related settings

Name	Type	Description
retentionDurationInDays	number (double)	Soft delete retention duration
state	SoftDeleteState	State of soft delete

SoftDeleteState

Enumeration

State of soft delete

Value	Description
Off	Soft Delete is turned off for the BackupVault
On	Soft Delete is enabled for the BackupVault but can be turned off
AlwaysOn	Soft Delete is permanently enabled for the BackupVault and the setting cannot be changed

StorageSetting

Object

Storage setting

Name	Type	Description
datastoreType	StorageSettingStoreTypes	Gets or sets the type of the datastore.
type	StorageSettingTypes	Gets or sets the type.

StorageSettingStoreTypes

Enumeration

Gets or sets the type of the datastore.

Value	Description
ArchiveStore
OperationalStore
VaultStore

StorageSettingTypes

Enumeration

Gets or sets the type.

Value	Description
GeoRedundant
LocallyRedundant
ZoneRedundant

systemData

Object

Metadata pertaining to creation and last modification of the resource.

Name	Type	Description
createdAt	string (date-time)	The timestamp of resource creation (UTC).
createdBy	string	The identity that created the resource.
createdByType	createdByType	The type of identity that created the resource.
lastModifiedAt	string (date-time)	The timestamp of resource last modification (UTC)
lastModifiedBy	string	The identity that last modified the resource.
lastModifiedByType	createdByType	The type of identity that last modified the resource.

UserAssignedIdentity

Object

User assigned identity properties

Name	Type	Description
clientId	string (uuid)	The client ID of the assigned identity.
principalId	string (uuid)	The principal ID of the assigned identity.