# Azure Cosmos DB Backup Policy Not Configured

> Cosmos DB accounts on a Periodic backup policy with retention positively reported below 24 hours are flagged by rule RC-1336. That is less than one day of recoverable history and no point-in-time restore. Continuous-mode accounts never fire, and a missing retention value abstains, because Resource Graph often omits the nested periodic properties.

Source: https://zop.dev/integrations/azure/recommendations/azure-cosmos-db-backup-policy-not-configured
Updated: 2026-08-19

---

## Less than a day of recoverable history

Azure's default Periodic backup for Cosmos DB keeps two copies taken four hours apart,
roughly 8 hours of recoverable history. Delete the wrong documents on Friday evening and
discover it Monday morning, and there is nothing left to restore: every surviving backup
already contains the mistake. That is the exposure this rule describes: not a missing
backup system, but a retention window shorter than the time it typically takes a human to
notice data damage.

## What provably weak means here

Two metadata values drive the verdict, both stamped by the discoverer from the account's
live ARM `backupPolicy` (a read under the built-in Reader role). `backup_policy_type`
distinguishes Periodic from Continuous; Continuous means point-in-time restore is available
and the rule never fires on it. For Periodic accounts, `backup_retention_hours` must be
positively surfaced *and* parse to a number strictly below the 24-hour floor before the
finding is raised. Only that combination fires, at medium severity: Periodic, with retention known and
under one day.

## Read the backup policy on an account

```bash
az cosmosdb show -n <account> -g <rg> \
  --query "{mode: backupPolicy.type, retentionHours: backupPolicy.periodicModeProperties.backupRetentionIntervalInHours, intervalMinutes: backupPolicy.periodicModeProperties.backupIntervalInMinutes}"
```

Output showing `Periodic` with `retentionHours` under 24 reproduces the finding exactly.

## Why a missing value never fires

Azure Resource Graph frequently declines to project the nested `periodicModeProperties`, so a
healthy Periodic account with a generous retention window can reach the recommender with no
retention value at all. Absence therefore means "not surfaced", never "not configured", and
the rule abstains on it, as it does on an unparseable value or a missing policy type. The
practical consequence: some genuinely under-protected accounts will not be flagged. The rule
trades that miss for never accusing a correctly configured account, so treat its findings as
proven and its silence as unverified.

## Choosing Continuous

For production data, the durable fix is switching the account to Continuous mode, which
replaces the snapshot-copy model with point-in-time restore across the retention period.
Where Periodic must stay (Continuous has feature and cost implications that not every
account tolerates), raise the retention interval well past a day so the recovery window
outlives a weekend. Both changes live under the account's Backup and Restore settings.