Soft delete for SQL and SAP HANA

Author: David Curwin

articles/backup/media/soft-delete-sql-saphana-in-azure-vm/delete-backup-data.png

@@ -0,0 +1,140 @@
+---
+title: Soft delete for SQL server in Azure VM and SAP HANA in Azure VM workloads
+description: Learn how soft delete for SQL server in Azure VM and SAP HANA in Azure VM workloads makes backups more secure.
+ms.topic: conceptual
+ms.date: 04/27/2020
+---
+# Soft delete for SQL server in Azure VM and SAP HANA in Azure VM workloads
+
+Azure Backup now provides soft delete for SQL server in Azure VM and SAP HANA in Azure VM workloads. This is in addition to the already supported [Azure Virtual machine soft delete scenario](https://docs.microsoft.com/azure/backup/backup-azure-security-feature-cloud).
+
+Soft delete is a security feature to help protect backup data even after deletion. With soft delete, even if a malicious actor deletes the backup of a database (or backup data is accidentally deleted), the backup data is retained for 14 additional days. This allows the recovery of that backup item with no data loss. This additional retention of 14 days of the backup data in the "soft delete" state doesn’t incur any cost to the customer.
+
+## Steps to enroll in preview
+
+1. Sign in to your Azure Account.
+
+   ```powershell
+   Login-AzureRmAccount
+   ```
+
+2. Select the subscription that you want to enroll in the preview:
+
+   ```powershell
+   Get-AzureRmSubscription –SubscriptionName "Subscription Name" | Select-AzureRmSubscription
+   ```
+
+3. Register this subscription to the preview program:
+
+   ```powershell
+   Register-AzureRMProviderFeature -FeatureName WorkloadBackupSoftDelete -ProviderNamespace Microsoft.RecoveryServices
+   ```
+
+4. Wait for 30 minutes for the subscription to be enrolled into the preview.
+
+5. To check the status, run the following cmdlets:
+
+   ```powershell
+   Get-AzureRmProviderFeature -FeatureName WorkloadBackupSoftDelete -ProviderNamespace Microsoft.RecoveryServices
+   ```
+
+6. Once the subscription shows as registered, run the following command:
+
+   ```powershell
+   Register-AzureRmResourceProvider -ProviderNamespace Microsoft.RecoveryServices
+   ```
+
+>[!NOTE]
+>Any time a new vault/vaults are created under the soft delete enabled subscription, the following command needs to be re-run to enable the feature for the newly created vaults.<BR>
+> `Register-AzureRmResourceProvider -ProviderNamespace Microsoft.RecoveryServices`
+
+## Soft delete for SQL server in Azure VM
+
+These instructions also apply to SAP HANA in Azure VM.
+
+1. To delete the backup data of a database in a SQL server, the backup must be stopped. In the Azure portal, go to your recovery services vault, go to the backup item, and choose **Stop backup**.
+
+   ![Stop backup](./media/soft-delete-sql-saphana-in-azure-vm/stop-backup.png)
+
+2. In the following window, you'll be given a choice to delete or retain the backup data. If you choose **Delete backup data**, the database backup won't be permanently deleted. Rather, the backup data will be retained for 14 days in the soft deleted state. The deletion is deferred until the 15th day with regular alert emails on the first, 12th, and 15th day informing about the backup state of the database to the user.
+
+   ![Delete backup data](./media/soft-delete-sql-saphana-in-azure-vm/delete-backup-data.png)
+
+3. During those 14 days, in the Recovery Services Vault, the soft deleted item will appear with a red “soft-delete” icon next to it.
+
+   ![Soft deleted items](./media/soft-delete-sql-saphana-in-azure-vm/soft-deleted-items.png)
+
+4. To restore the soft-deleted DB, it must first be undeleted. To undelete, choose the soft-deleted DB, and then select the option **Undelete**.
+
+   ![Undelete database](./media/soft-delete-sql-saphana-in-azure-vm/undelete-database.png)
+
+   A window will appear warning that if undelete is chosen, all restore points for the database will be undeleted and available for performing a restore operation. The backup item will be retained in a “stop protection with retain data” state with backups paused and backup data retained forever with no backup policy effective.
+
+   ![Undelete warning](./media/soft-delete-sql-saphana-in-azure-vm/undelete-warning.png)
+
+5. At this point, you can also restore the VM by selecting **Restore VM** from the chosen restore point.
+
+   ![Restore VM](./media/soft-delete-sql-saphana-in-azure-vm/restore-vm.png)
+
+6. After the undelete process is completed, the status will return to “Stop backup with retain data” and then you can choose **Resume backup**. The **Resume backup** operation brings back the backup item in the active state, associated with a backup policy selected by the user defining the backup and retention schedules.
+
+   ![Resume backup](./media/soft-delete-sql-saphana-in-azure-vm/resume-backup.png)
+
+## How to disable soft delete
+
+Disabling this feature isn't recommended. The only circumstance where you should consider disabling soft delete is if you're planning on moving your protected items to a new vault, and can't wait the 14 days required before deleting and reprotecting (such as in a test environment.) Only a Backup Administrator can disable this feature. To disable soft delete, disable the button under **Vault properties** > **Security settings** for the given vault. It's important to remember that once the button is disabled, the feature is disabled for all the workloads including virtual machines. Once enabled in preview (according to the safelisting steps), there's no way to disable soft delete only for SQL server or SAP HANA DBs while keeping it enabled for virtual machines in the same vault.
+
+![Disable soft delete](./media/soft-delete-sql-saphana-in-azure-vm/disable-soft-delete.png)
+
+## Soft delete for SQL server in VM using Azure PowerShell
+
+>[!NOTE]
+>The Az.RecoveryServices version required to use soft-delete using Azure PowerShell is minimum 2.2.0. Use `Install-Module -Name Az.RecoveryServices -Force` to get the latest version.
+
+The sequence of steps for using  Azure PowerShell is the same as in the Azure portal, outlined above.
+
+### Delete the backup item using Azure PowerShell
+
+Delete the backup item using the [Disable-AzRecoveryServicesBackupProtection](https://docs.microsoft.com/powershell/module/az.recoveryservices/Disable-AzRecoveryServicesBackupProtection?view=azps-1.5.0) PS cmdlet.
+
+```powershell
+Disable-AzRecoveryServicesBackupProtection -Item $myBkpItem -RemoveRecoveryPoints -VaultId $myVaultID -Force
+```
+
+The **DeleteState** of the backup item will change from **NotDeleted** to **ToBeDeleted**. The backup data will be retained for 14 days. If you wish to revert the delete operation, then undo-delete should be performed.
+
+### Undoing the deletion operation using Azure PowerShell
+
+First, fetch the relevant backup item that is in soft-delete state (that is, about to be deleted).
+
+```powershell
+Get-AzRecoveryServicesBackupItem -BackupManagementType AzureWorkload -WorkloadType SQLDataBase -VaultId $myVaultID | Where-Object {$_.DeleteState -eq "ToBeDeleted"}
+
+$myBkpItem = Get-AzRecoveryServicesBackupItem -BackupManagementType AzureWorkload -WorkloadType SQLDataBase -VaultId $myVaultID -Name AppVM1
+```
+
+Then, perform the undo-deletion operation using the [Undo-AzRecoveryServicesBackupItemDeletion](https://docs.microsoft.com/powershell/module/az.recoveryservices/undo-azrecoveryservicesbackupitemdeletion?view=azps-3.8.0) PS cmdlet.
+
+```powershell
+Undo-AzRecoveryServicesBackupItemDeletion -Item $myBKpItem -VaultId $myVaultID -Force
+```
+
+The **DeleteState** of the backup item will revert to **NotDeleted**. But the protection is still stopped. Resume the backup to re-enable the protection.
+
+### Disabling soft delete using Azure PowerShell
+
+To disable, use the [Set-AzRecoveryServicesVaultBackupProperty](https://docs.microsoft.com/powershell/module/az.recoveryservices/set-azrecoveryservicesbackupproperty?view=azps-3.1.0) PS cmdlet.
+
+```powershell
+Set-AzRecoveryServicesVaultProperty -VaultId $myVaultID -SoftDeleteFeatureState Disable
+```
+
+Points to note:
+
+1. If any soft-deleted backup items are present in the vault, the vault can't be deleted at that time. Try vault deletion after the backup items are permanently deleted, and there are no items in the soft deleted state left in the vault. To permanently delete soft deleted items, see [here](https://docs.microsoft.com/azure/backup/backup-azure-security-feature-cloud#permanently-deleting-soft-deleted-backup-items).
+2. The **Soft Delete** button under Vault properties has to be enabled (it's enabled by default for all the vaults) along with subscription safelisting (as mentioned in the steps above) to get the soft delete preview enabled for SQL Server and SAP HANA Databases running in VMs.
+3. All the points and steps mentioned in the doc apply to both SQL server and SAP HANA databases running in virtual machines.
+
+## Next steps
+
+- [Overview of security features in Azure Backup](security-overview.md)

articles/backup/media/soft-delete-sql-saphana-in-azure-vm/disable-soft-delete.png

@@ -344,6 +344,8 @@
       href: backup-rbac-rs-vault.md
     - name: Security for cloud workloads
       href: backup-azure-security-feature-cloud.md
+    - name: Soft delete for SQL Server and SAP HANA in Azure VMs
+      href: soft-delete-sql-saphana-in-azure-vm.md
     - name: Security for hybrid backups
       href: backup-azure-security-feature.md
     - name: Built-in security controls