Freshness - Security DAdata isolation

Author: AbhishekMallick-MS

articles/backup/backup-architecture.md

@@ -2,10 +2,11 @@
 title: Architecture Overview 
 description: Provides an overview of the architecture, components, and processes used by the Azure Backup service.
 ms.topic: conceptual
-ms.date: 12/24/2021
+ms.date: 03/19/2024
 ms.service: backup
 author: AbhishekMallick-MS
 ms.author: v-abhmallick
+ms.custom: engagement-fy24
 ---
 
 # Azure Backup architecture and components
@@ -223,6 +224,14 @@ When you restore VMs with managed disks, you can restore to a complete VM with m
 - During the restore process, Azure handles the managed disks. If you're using the storage account option, you manage the storage account that's created during the restore process.
 - If you restore a managed VM that's encrypted, make sure the VM's keys and secrets exist in the key vault before you start the restore process.
 
+## DaData isolation with Azure Backup
+
+With Azure Backup, the vaulted backup data is stored in Microsoft-managed Azure subscription and tenant. External users or guests have no direct access to this backup storage or its contents, ensuring the isolation of backup data from the production environment where the data source resides.
+
+In Azure, all communications and data in transit is securely transferred with *HTTPS* and *TLS 1.2+* protocols. This data remains on the Azure backbone network ensuring reliable and efficient data transmission. The backup data at rest is encrypted by default using *Microsoft-managed keys*. You can also bring your own keys for encryption if you require greater control over the data. To enhance protection, you can use [immutability](security-overview.md#immutable-vaults), which prevents data from being altered or deleted before its retention period.  Azure Backup gives you diverse options such as [soft delete](security-overview.md#soft-delete), stop backup and delete data or retain data if you need to stop backups at any time. To protect critical operations, you can add [Multi-User Authorization (MUA)](security-overview.md#multi-user-authorization) that adds additional layer of protection by using an Azure resource called Azure Resource Guard (ARG).
+
+This robust approach ensures that even in a compromised environment, existing backups cannot be tampered with or deleted by unauthorized users.
+
 ## Next steps
 
 - Review the support matrix to [learn about supported features and limitations for backup scenarios](backup-support-matrix.md).