Back to Checks
azure

Recovery Services vault has backup protected items configured

recovery_vault_has_protected_items
Service: recoverySeverity: medium
OfficialBuilt-inVerified
Categories:forensics-ready
Resource Type:microsoft.recoveryservices/vaults

Azure Recovery Services vaults are evaluated for backup protected items. A vault with no protected items indicates that no resources (VMs, databases, file shares) are configured for backup through this vault, potentially leaving critical workloads unprotected.

Prowler logoProwlerprowler-provider-azure

Risk

Empty vaults represent a gap in disaster recovery coverage. Resources without backup protection face permanent data loss from accidental deletion, ransomware, corruption, or regional outages. The vault may have been provisioned but backup was never configured.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks recovery_vault_has_protected_items

Recommendation

Configure backup protection for critical resources including VMs, databases, and file shares. Use Azure Backup policies with appropriate retention and frequency. If the vault is unused, consider deleting it to reduce resource sprawl.

Remediation

CLI

az backup protection enable-for-vm --resource-group <rg> --vault-name <vault> --vm <vm_id> --policy-name DefaultPolicy

Other

1Sign in to the Azure portal
2Go to Recovery Services vaults and select the vault
3Click + Backup
4Select the workload type (Azure VM, SQL, File Share, etc.)
5Select the backup policy
6Choose the resources to protect
7Click Enable Backup

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.recovery.recovery_client import recovery_client


class recovery_vault_has_protected_items(Check):
    """Check if Recovery Services vaults have protected backup items."""

    def execute(self) -> list[Check_Report_Azure]:
        """Execute the check across Recovery Services vaults."""

        findings = []

        for subscription_name, vaults in recovery_client.vaults.items():
            for vault in vaults.values():
                report = Check_Report_Azure(metadata=self.metadata(), resource=vault)
                report.subscription = subscription_name
                report.resource_name = vault.name
                report.resource_id = vault.id
                report.location = vault.location

                if vault.backup_protected_items:
                    report.status = "PASS"
                    report.status_extended = (
                        f"Recovery Services vault '{vault.name}' has "
                        f"{len(vault.backup_protected_items)} protected items."
                    )
                else:
                    report.status = "FAIL"
                    report.status_extended = (
                        f"Recovery Services vault '{vault.name}' has no "
                        f"protected items configured."
                    )

                findings.append(report)

        return findings

References