# Azure Recovery Vault Geo-Redundant Downgrade

> Recovery Services vaults on GeoRedundant or ReadAccessGeoZoneRedundant storage with a positive non-production signal are candidates for LocallyRedundant replication. Savings require both GRS and LRS rates in the pricing cache; because Azure Backup pricing currently collapses to 1 vault key, those rates are absent and the rule abstains on live data.

Source: https://zop.dev/integrations/azure/recommendations/azure-recovery-vault-geo-redundant-downgrade
Updated: 2026-08-19

---

## Vaults on geo-redundant storage without prod signals

- resource.Metadata.storage_replication_type, written by the discoverer from the Azure Backup BackupResourceStorageConfigsNonCRR control-plane response. Missing key is fail-safe (the discoverer omits it on the "Invalid" sentinel or transient SDK errors); the rule must not fire without an authoritative value.
- Replication type ∈ \{GeoRedundant, ReadAccessGeoZoneRedundant}. Anything else (already LRS, zone-redundant only, etc.) is skipped.
- Non-prod signal: either a dev/test name pattern (isDevTestName) OR a subscriptionIsNonprod=true Metadata flag from the subscription enricher (read via hasTagValue(resource.Metadata, …)).
- Prod-veto signal: any prod name pattern OR prod env tag (isProdResource) overrides the non-prod signal. Gates 3 and 4 are asymmetric on purpose: name patterns carry false-positive risk in both directions, so the rule requires an affirmative non-prod signal AND the absence of any prod signal.
- Optional cross_region_restore_enabled=true Metadata flag (read via hasTagValue(resource.Metadata, …)) adds a CRR-disable prerequisite line to the description and remediation.

## Why the GRS to LRS rate delta is unavailable

```text
when both recovery-vault-grs and recovery-vault-lrs rates are present in pricing_cache for the vault's region, savings is the real rate delta via DeriveCatalogDiffSavingsStrict(srcRate, dstRate, cost); when either rate is absent or the delta is non-positive the rule ABSTAINS (returns nil) -- the prior 0.40 storage-haircut fallback was removed (T0223: Azure Backup pricing collapses every meter into one lowest-rate-wins recovery-vault key, so the grs/lrs keys are never produced today and the rule abstains on live data until that pricing split lands).
```

## Switching replication to LocallyRedundant

(from manualsteps.go):
1. Confirm this Recovery Services vault backs only non-production workloads and a second-region copy is not a business requirement.
2. Recovery Services vault → \{\{.ResourceName}} → Properties → Backup Configuration.
3. If cross-region restore is enabled, disable it first, because Azure blocks the replication change while CRR is on.
4. Change Storage replication type to LocallyRedundant (LRS).
5. Azure applies the change only while the vault holds no protected items. If items exist, stop protection with retain-data first, switch replication, then restore protection.
6. Save the configuration and verify the new replication type on the Properties blade.

## No metrics, metadata and environment only

None (signal is metadata + env-classification)