Azure Backup for Small Businesses in Berlin: Practical Guide to Cloud-Based Data Protection
Most Berlin SMBs have some form of backup. Most of those backups have never been tested. Untested backups are not backups — they are a false sense of security that becomes obvious at precisely the worst moment. Azure Backup is not magic, but it is production-grade, it integrates with the Microsoft ecosystem that SMBs already run, and it provides restore testing workflows that make validation the default rather than the exception.
What Azure Backup Protects
Azure Backup is a unified backup service in the Azure portal that covers multiple workload types from a single Recovery Services vault:
- Azure Virtual Machines — full VM snapshot backup with application-consistent checkpoints for running databases. Requires no agent for managed disk VMs.
- On-premises Windows Servers — the Microsoft Azure Recovery Services (MARS) agent installed on any Windows Server 2012 R2 or later machine sends encrypted backups directly to a Recovery Services vault. Covers files, folders, and system state.
- SQL Server in Azure VMs — workload-aware backup that honours SQL Server transaction log backup schedules and provides point-in-time recovery for databases.
- Azure Files shares — snapshot-based backup of Azure Files file shares, restorable at the share, directory, or file level.
- On-premises VMware and Hyper-V VMs — via Microsoft Azure Backup Server (MABS), which is essentially a free DPM agent that targets Azure Backup as its secondary tier.
Recovery Services Vault: The Central Management Point
All Azure Backup data lands in a Recovery Services vault, which is an Azure resource in a specific region. For Berlin SMBs, the vault should be in the West Europe or Germany West Central region to comply with GDPR data residency requirements — backup data must stay within the EU.
Key vault configuration decisions:
- Redundancy: Locally redundant storage (LRS) replicates backup data three times within a single Azure datacenter. Geo-redundant storage (GRS) replicates it to a secondary region. GRS is the safer choice for disaster recovery scenarios where the primary Azure region could become unavailable. GRS roughly doubles the storage cost but is worth it for primary backup data.
- Soft delete: Enabled by default. Deleted backup items are retained for 14 additional days before permanent deletion. This protects against ransomware that targets backup data. Do not disable this.
- Azure Backup immutability: Configurable on the vault level, prevents changes or deletions to backup data during the retention period. For NIS2 compliance and ransomware resilience, enabling immutable vaults is best practice.
MARS Agent: Protecting On-Premises Windows Servers
The MARS agent is the path for SMBs who still run on-premises Windows file servers or domain controllers and want to back them up to Azure without deploying a full backup server infrastructure. Setup:
- Create a Recovery Services vault in your target Azure region.
- Download the MARS agent installer and vault credentials file from the vault.
- Install the agent on the server, register it against the vault using the credentials file, and set an encryption passphrase. The passphrase is not recoverable by Microsoft. Store it securely offline.
- Configure backup items (files, folders, or system state) and the backup schedule (up to three times per day for files; daily for system state).
- Set the retention policy: daily retention (30 days minimum recommended), weekly, monthly, and yearly retention as required by your data retention obligations.
Initial backup performs a full transfer. Subsequent backups are incremental at the block level. For servers with large data volumes, the first backup should be seeded using Azure Data Box or the offline backup seed option to avoid days of initial data transfer over the internet.
Backup Policy: RTO and RPO Mapping
Backup policy design starts with business requirements, not technology defaults. Define your Recovery Point Objective (RPO — how much data you can afford to lose) and Recovery Time Objective (RTO — how long you can operate without the recovered system) for each workload before configuring backup schedules.
| Workload | Suggested RPO | Suggested RTO | Backup Method |
|---|---|---|---|
| Production SQL database | 15 min | 4 hrs | SQL workload backup (Azure VM) |
| File server | 24 hrs | 8 hrs | MARS agent or Azure Files snapshot |
| Business-critical Azure VM | 4 hrs | 4 hrs | Azure VM backup + enhanced policy |
| Domain controller | 24 hrs | 4 hrs | MARS agent (system state) |
Testing Restores: The Step Most SMBs Skip
Azure Backup provides restore validation options that remove the excuse for not testing. For Azure VM backups, the Instant Restore feature allows you to start a new VM directly from the recovery point snapshot (not from vault data transfer) in minutes. This VM should be started in an isolated virtual network, verified for application functionality, and then discarded. The entire test takes under 30 minutes and should be performed at least quarterly.
For MARS file restores, the recovery wizard in the MARS agent allows granular file and folder recovery from any recovery point. Test a random sample of files monthly — not just that the restore dialog opens, but that the recovered files open correctly and contain the expected content.
Document restore test results in your IT runbook. If you need to demonstrate backup capability to auditors (NIS2, insurance underwriters, enterprise clients), a restore test log is the evidence they will ask for.
Cost Estimation
Azure Backup pricing has two components: storage consumed and per-instance fees. For a Berlin SMB protecting ten servers with an average of 100 GB of data per server using MARS, expect approximately €50 to €100 per month in Azure Backup costs at GRS redundancy. Azure VM backup adds a per-instance fee (approximately €5 per VM per month) plus storage. Exact costs depend on data change rates (which affect incremental backup size) and retention periods. The Azure Backup pricing calculator at the Azure portal provides accurate estimates based on your specific workload parameters.
What IT Experts Berlin Implements
Our Azure Backup engagement covers Recovery Services vault creation with appropriate redundancy and immutability settings, MARS agent deployment for on-premises servers, Azure VM backup policies for cloud workloads, backup policy design aligned to your RTO and RPO requirements, and documented restore test procedures. We also integrate backup monitoring with Azure Monitor alerts so backup failures trigger notifications rather than being discovered during an incident. Contact us for a scoping assessment.