Virtual Machine is protected by Azure Backup

# Protect an existing VM with Azure Backup
resource "azurerm_backup_protected_vm" "<example_resource_name>" {
  resource_group_name = "<example_resource_name>"   # vault's resource group
  recovery_vault_name = "<example_resource_name>"
  source_vm_id        = "<example_resource_id>"     # critical: VM to protect
  backup_policy_id    = "<example_resource_id>"     # critical: policy that enables backup
}

// Enable Azure Backup protection for an existing VM in an existing Recovery Services vault
param vmId string            // e.g., /subscriptions/<sub>/resourceGroups/<rg>/providers/Microsoft.Compute/virtualMachines/<vm>
param vaultName string
param vaultRg string
param policyId string        // e.g., /subscriptions/<sub>/resourceGroups/<rg>/providers/Microsoft.RecoveryServices/vaults/<vault>/backupPolicies/<policy>

resource vault 'Microsoft.RecoveryServices/vaults@2023-04-01' existing = {
  name: vaultName
  scope: resourceGroup(vaultRg)
}

var vmRg = split(split(vmId, '/resourceGroups/')[1], '/')[0]
var vmName = split(vmId, '/virtualMachines/')[1]

resource protect 'Microsoft.RecoveryServices/vaults/backupFabrics/protectionContainers/protectedItems@2023-02-01' = {
  // critical: this resource creates the protected item, enabling backup for the VM
  name: '${vault.name}/Azure/protectionContainers/iaasvmcontainer;iaasvmcontainerv2;${vmRg};${vmName}/protectedItems/VM;iaasvmcontainerv2;${vmRg};${vmName}'
  properties: {
    protectedItemType: 'Microsoft.Compute/virtualMachines' // critical: VM backup item type
    sourceResourceId: vmId                                 // critical: target VM to protect
    policyId: policyId                                     // critical: associates the VM with a backup policy
  }
}