Backups let you restore data. Disaster recovery lets you keep running when a whole region has a problem. Azure Site Recovery replicates Azure virtual machines to a second region so you can fail over when you need to. This guide follows Microsoft’s tutorial for enabling Azure-to-Azure replication in the portal with default settings.
Prerequisites
- Supported regions: confirm your source and target regions are supported. Vaults created in South Central India and North East US 5 aren’t supported for Azure-to-Azure disaster recovery, although those regions can still be a source or target if the vault is in a supported region.
- VMs: one or more Azure VMs running a supported Windows or Linux OS.
- Licensing: Site Recovery doesn’t keep the Windows Client license after failover. Validate and configure licensing on the recovered VM afterwards.
- Encryption: this procedure assumes the VMs aren’t encrypted. Encrypted VMs need a separate article.
- Shared disks: for clustered shared disks, follow the shared-disk guidance. Don’t use the generic Add disks operation; disable and re-enable protection for the whole cluster instead.
- An active Azure subscription.
Permissions
| Task | Access needed |
|---|---|
| Create a vault | Admin or Owner on the subscription |
| Manage Site Recovery operations | The built-in Site Recovery Contributor role |
| Create VMs in the target region | Virtual Machine Contributor, or specific rights to create VMs in the virtual network, write to a storage account, and write to managed disks |
Step 1: Check target-region capacity
Confirm the subscription has enough quota in the target region to create VMs. Site Recovery picks the same VM size as the source, or the closest available size.
Step 2: Prepare the VMs
Outbound connectivity
VMs need outbound access, and Site Recovery doesn’t support authentication proxies.
- URL-based firewall or proxy: allow
*.blob.core.windows.net(storage),login.microsoftonline.com(Microsoft Entra ID),*.hypervrecoverymanager.windowsazure.com(replication) and*.servicebus.windows.net(Service Bus). Government clouds use different endpoints. - NSG rules: create service-tag rules allowing outbound HTTPS (port 443) for the Storage, Microsoft Entra ID, EventsHub and AzureSiteRecovery tags, and optionally GuestAndHybridManagement for automatic agent upgrades.
- IMDS: the mobility agent uses the Azure Instance Metadata Service at
169.254.169.254. Bypass that IP in any proxy configuration.
Root certificates
VMs must have current root certificates or they can’t register with Site Recovery. On Windows, install the latest Windows updates. On Linux, get the latest trusted root certificates and certificate revocation list from your distribution.
Step 3: Create a Recovery Services vault
Create the vault in any region except the source region.
- Sign in to the Azure portal, search for recovery, and select Recovery Services vaults.
- Select + Create.
- On the Basics tab, choose the subscription and resource group, enter a vault name, and select a supported region.
- Select Review + create, then Create.
- When deployment finishes, select Go to resource, then Enable Site Recovery on the overview page.
Step 4: Enable replication
Source settings
- In the vault, open Site Recovery. Under Azure virtual machines, select Enable replication.
- On the Source tab, set the region where the VMs run now, a subscription in the same Microsoft Entra tenant as the vault, and the resource group containing the VMs.
- Keep the deployment model as Resource Manager and Disaster recovery between availability zones as No, then select Next.
Select the VMs
Choose up to 10 VMs to protect, then select Next.
Replication settings
- Review the default target settings Site Recovery creates for the target region.
- Disk types generally match the source. Premium SSD v2 and Ultra Disk sources use Premium SSD v1 replica disks, but keep their source disk type at failover.
- Churn is Normal by default. For VMs with high data change rates, choose High Churn under Storage > View/edit storage configuration > Churn for the VM. High Churn requires a Premium Block Blob storage account.
Manage
- Select a Replication policy.
- Optionally create a replication group, but only when the VMs run the same workload and need multi-VM-consistent recovery points.
- Under Extension settings, select Update settings and an Automation account.
Review and confirm
Check the source, VM selection and target settings, then select Enable replication.
Step 5: Check status
Protected VMs appear on the vault’s Replicated items page.
Next: run a drill
Replication isn’t recovery until you’ve proved failover works. Microsoft’s next step is a disaster recovery drill (test failover), so schedule one before you rely on this in production.
