Virtual Machine backup meets the daily retention minimum

Check ID: vm_sufficient_daily_backup_retention_period
Provider: Azure
Service: vm
Severity: MEDIUM
Categories: resilience
Resource type: microsoft.compute/virtualmachines

What this check verifies

Azure virtual machines are evaluated for a backup policy in a Recovery Services vault with a daily retention period that meets the configured minimum. VMs lacking protection or using a shorter retention window are identified for review.

Risk

Insufficient or missing VM backups weaken availability and integrity. Short retention reduces recovery points, limiting rollback after ransomware, accidental deletion, or faulty changes. This increases RPO, extends RTO, and can force rebuilds, causing data loss and downtime.

Recommendation

Enforce backup policies that provide daily retention aligned to business RPO/RTO for every VM. Apply defense in depth: isolate backups in a vault, enable immutability/soft delete, limit changes with least privilege and MFA, and regularly test restores. Use tiered retention (daily/weekly/monthly/yearly) based on data criticality.

Remediation

Terraform
Native IaC
Dashboard steps

# Backup policy with sufficient daily retention
resource "azurerm_backup_policy_vm" "<example_resource_name>" {
  name                = "<example_resource_name>"
  resource_group_name = "<example_resource_name>"
  recovery_vault_name = "<example_resource_name>"

  backup {
    frequency = "Daily"
    time      = "23:00"
  }

  retention_daily {
    count = 7 # CRITICAL: ensures daily retention meets minimum required days
  }
}

# Protect the VM with the compliant policy
resource "azurerm_backup_protected_vm" "<example_resource_name>" {
  resource_group_name = "<example_resource_name>"
  recovery_vault_name = "<example_resource_name>"
  source_vm_id        = "<example_resource_id>"
  backup_policy_id    = azurerm_backup_policy_vm.<example_resource_name>.id # CRITICAL: applies the policy to the VM
}

// Create/ensure a VM backup policy with daily retention >= minimum
resource rv 'Microsoft.RecoveryServices/vaults@2023-01-01' existing = {
  name: '<example_resource_name>'
}

resource vmPolicy 'Microsoft.RecoveryServices/vaults/backupPolicies@2023-02-01' = {
  name: '${rv.name}/<example_resource_name>'
  properties: {
    backupManagementType: 'AzureIaasVM'
    schedulePolicy: {
      schedulePolicyType: 'SimpleSchedulePolicyV2'
      scheduleRunFrequency: 'Daily'
      scheduleRunTimes: ['2020-01-01T23:00:00Z']
    }
    retentionPolicy: {
      retentionPolicyType: 'LongTermRetentionPolicy'
      dailySchedule: {
        retentionTimes: ['2020-01-01T23:00:00Z']
        retentionDuration: {
          count: 7 // CRITICAL: sets daily retention to at least the minimum required days
          durationType: 'Days' // explains the unit
        }
      }
    }
  }
}

References

Where this check fires

This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable by Check ID = vm_sufficient_daily_backup_retention_period. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to Azure checks

Virtual Machine Scale Set has at least one VM instance Virtual Machine has Trusted Launch with Secure Boot

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires