# Azure Recovery Services Vault

> Recovery Services vaults bill per protected instance plus the backup storage consumed, multiplied by the vault's replication choice. ZopNight discovers vaults with protected-item and policy context, reads retention and soft-delete windows against 90-day and 30-day default ceilings, and flags stale or redundant protection.

Source: https://zop.dev/integrations/azure/recovery-vault
Updated: 2026-08-19

---

Recovery Services vaults hold backup data and site-recovery configuration for VMs and workloads, billed per protected instance plus storage consumed. Stale protection for deleted or unimportant resources keeps billing indefinitely.

## Two charges per protected item, one multiplier on top

Backup cost has a fixed and a variable half. Every protected instance carries a flat monthly protection charge that depends on the workload and its size band, and the recovery points themselves consume vault storage billed per GB. The vault's storage replication setting then multiplies that second half: geo-redundant vault storage costs roughly double locally redundant, and it is the default. Retention is the compounding factor: every extra day of retention is more recovery points held, so a generous policy quietly converts a modest per-instance fee into a substantial storage line.

## Policy signals ZopNight extracts from each vault

Discovery runs via Azure Resource Graph with protected-item context, and Cost Management billing attributes backup spend. A dedicated enricher then reads the vault's backup-policy configuration: the default policy's retention days, the soft-delete window, the storage replication type (locally redundant, zone-redundant, geo-redundant, or read-access geo-zone-redundant), and whether cross-region restore is on. Retention beyond a 90-day default ceiling and soft-delete windows beyond 30 days are marked excessive (both ceilings customer-tunable), and recommendations flag redundant or stale protection. ML auto-tagging covers this type. Vaults are not schedulable; savings come from policy trims, replication downgrades, and retiring dead protection.

## Backup spend that outlives its reason

Recurring offenders: protected items pointing at VMs deleted long ago, whose retained recovery points bill until someone stops protection and clears the data; production-grade geo-redundant vault storage guarding development machines; and default retention policies applied fleet-wide when a fraction of the fleet needs them.

## Tracing vault charges in the portal

Azure portal → Recovery Services vaults → select a vault → Backup items shows everything protected and by which policy; Properties → Backup Configuration shows the replication type. Cross-checking backup items against live resources finds the stale protection fastest.