Recovery Services vaults for non-production workloads still storing backups geo-redundantly

Why a second-region backup copy costs more than it is worth for dev

Recovery Services vaults default to geo-redundant storage (GRS), which keeps a copy of backup data in the paired region. The vault creation guide lets you pick geo-redundant, locally redundant or zone-redundant, and notes that Cross Region Restore, the feature that uses the paired copy, works only on GRS vaults and carries its own charges.

For a vault that protects development or test machines, a regional disaster copy is rarely a real requirement. Locally redundant storage keeps the backups in one region at a lower storage rate, and the vaults that protect production can stay on GRS.

Checking the replication type of each vault

az backup vault list --query "[].{name:name, rg:resourceGroup}" -o table

az backup vault backup-properties show --resource-group my-rg --name my-dev-vault

The second command returns the vault’s backup properties, including its storage redundancy and whether Cross Region Restore is on.

Non-production evidence the rule insists on

1. The vault’s replication type is read from its backup storage configuration and is GeoRedundant or ReadAccessGeoZoneRedundant. If Azure does not return an authoritative value, the vault is not judged.
2. There is an affirmative non-production signal: a dev or test pattern in the vault name, or a subscription flagged as non-production.
3. There is no production signal. A production name pattern or a production environment tag overrides everything else.

The two signals are asymmetric on purpose. Name patterns can mislead either way, so the rule needs positive proof of non-production and the absence of any sign of production.

Vaults that are never proposed for LRS

Vaults already on locally or zone-redundant storage are skipped, as are vaults without a clear non-production signal. Without both a geo-redundant and a locally redundant storage rate for the region it raises no finding, and at present those per-GB rates cannot yet be used by the check, so it stays silent on every vault. When Cross Region Restore is enabled, the recommendation adds disabling it as a first step.

Where the saving comes from

Only the backup storage component of a vault bill depends on redundancy. The fee charged for each protected instance stays the same whichever replication type you pick, so any real saving is the stored backup volume priced at the GRS rate minus the same volume at the LRS rate. ZopNight does not show a figure for this recommendation until it can price that storage component on its own, rather than apply a rate ratio to a bill that is mostly instance fees.

Moving a dev vault to locally redundant storage

1. Confirm the vault protects only non-production workloads and that no one needs a second-region copy.
2. Open the vault, then Properties, then Backup Configuration.
3. Check Cross Region Restore first. Microsoft notes that a vault with it enabled cannot be reverted to GRS or LRS after protection starts for the first time.
4. Change Storage replication type to Locally-redundant and save, for example with az backup vault backup-properties set --resource-group my-rg --name my-dev-vault --backup-storage-redundancy LocallyRedundant.