Amazon Web Services → Microsoft Azure
Azure equivalent of AWS Backup logically air-gapped vault
AWS Backup Vault Lock and logically air-gapped vaults map to Azure Backup immutable vaults (which can be locked), combined with soft delete and multi-user authorization through Resource Guard.
About AWS Backup logically air-gapped vault
| Provider | Amazon Web Services |
|---|---|
| Status | Generally available |
| What it is | A vault type with compliance-mode locking, AWS-owned or customer-managed key encryption, sharing to recovery accounts through AWS RAM, and optional multi-party approval for recovery when the owning account is lost. |
| Documentation | docs.aws.amazon.com |
| Pricing | Official pricing page |
Azure mappings (1)
| Capability | Azure equivalent | Match |
|---|---|---|
| Immutable and isolated backup vaults (ransomware protection) | Azure Backup immutable vaults | Partial match |
Backup & disaster recovery(1)
Immutable and isolated backup vaults (ransomware protection) Partial match
AWS Backup Vault Lock and logically air-gapped vaults map to Azure Backup immutable vaults (which can be locked), combined with soft delete and multi-user authorization through Resource Guard.
- Isolation. Logically air-gapped vaults can be shared to a recovery account through AWS RAM and support multi-party approval to recover if the owning account is lost. Azure has no direct equivalent of that recovery path. Its protection comes from locked immutability, soft delete, and a Resource Guard kept in a separate subscription or tenant.
- WORM. Azure is moving locked-immutable backups onto WORM storage by region and workload, and the backup service enforces immutability until then. AWS Vault Lock in compliance mode can't be removed after its grace period.