Backup & disaster recovery
AWS Backup logically air-gapped vault vs Azure Backup immutable vaults
AWS Backup Vault Lock and logically air-gapped vaults map to Azure Backup immutable vaults (which can be locked), combined with soft delete and multi-user authorization through Resource Guard.
Side-by-side comparison
| Aspect | Amazon Web Services | Microsoft Azure |
|---|---|---|
| Service | AWS Backup logically air-gapped vault | Azure Backup immutable vaults |
| Lifecycle | Generally available | Generally available |
| What it is | A vault type with compliance-mode locking, AWS-owned or customer-managed key encryption, sharing to recovery accounts through AWS RAM, and optional multi-party approval for recovery when the owning account is lost. | Vault setting that blocks operations that could delete recovery points. It can be locked to make it irreversible, with backups moved onto WORM storage where available, and combined with soft delete, multi-user authorization (Resource Guard), and Microsoft-managed or customer-managed keys. |
| Pricing model | Logically air-gapped vault storage is billed per GB-month by resource type. Vault Lock has no extra charge. | No extra charge for immutability or soft delete beyond normal backup pricing. |
| Docs | AWS Backup logically air-gapped vault docs | Azure Backup immutable vaults docs |
| Pricing page | AWS Backup logically air-gapped vault pricing | Azure Backup immutable vaults pricing |
| Exams | SAA-C03 SCS-C03 | AZ-104 AZ-305 SC-500 |
Key differences
- Isolation. Logically air-gapped vaults can be shared to a recovery account through AWS RAM and support multi-party approval to recover if the owning account is lost. Azure has no direct equivalent of that recovery path. Its protection comes from locked immutability, soft delete, and a Resource Guard kept in a separate subscription or tenant.
- WORM. Azure is moving locked-immutable backups onto WORM storage by region and workload, and the backup service enforces immutability until then. AWS Vault Lock in compliance mode can't be removed after its grace period.
Pricing summary
Pricing models only. No prices are quoted because they change by region and over time.
- AWS
- Logically air-gapped vault storage is billed per GB-month by resource type. Vault Lock has no extra charge. AWS Backup logically air-gapped vault pricing →
- Azure
- No extra charge for immutability or soft delete beyond normal backup pricing. Azure Backup immutable vaults pricing →
Certification exam mapping
| Exam | Provider | Level | Status |
|---|---|---|---|
| AWS Certified Solutions Architect – Associate SAA-C03 | AWS | Associate | current Italian version retires after Dec 31, 2026. |
| AWS Certified Security – Specialty SCS-C03 | AWS | Specialty | current The current code (SCS-C03) is taken from the exam-prep link on the official certification page. Simplified Chinese, Spanish (Latin America), and Portuguese (Brazil) versions retire after Dec 31, 2026. |
| Microsoft Certified – Azure Administrator Associate AZ-104 | Azure | Associate | current |
| Microsoft Certified – Azure Solutions Architect Expert AZ-305 | Azure | Expert | current English version updated Apr 17, 2026. |
| Microsoft Certified – Cloud and AI Security Engineer Associate SC-500 | Azure | Associate | current New certification. A practice assessment isn't available yet, which the page says usually means the exam recently left (or is in) beta. |
Relevance is based on each exam's published scope, not a line-by-line objective match. Check the official study guide.
FAQ
What is the Azure equivalent of AWS Backup logically air-gapped vault?
AWS Backup Vault Lock and logically air-gapped vaults map to Azure Backup immutable vaults (which can be locked), combined with soft delete and multi-user authorization through Resource Guard.
How does pricing compare between AWS Backup logically air-gapped vault and Azure Backup immutable vaults?
AWS: Logically air-gapped vault storage is billed per GB-month by resource type. Vault Lock has no extra charge. Azure: No extra charge for immutability or soft delete beyond normal backup pricing. Check the official pricing pages for current rates.
Which certification exams cover this topic?
AWS Certified Solutions Architect – Associate (SAA-C03); AWS Certified Security – Specialty (SCS-C03); Microsoft Certified – Azure Administrator Associate (AZ-104); Microsoft Certified – Azure Solutions Architect Expert (AZ-305); Microsoft Certified – Cloud and AI Security Engineer Associate (SC-500).