azure-site-recovery

Name: azure-site-recovery
Author: vinayaklatthe

53installs34forks

How to install azure-site-recovery?

vinayaklatthe/microsoft-security-skills/azure-site-recovery

$npx -y skills add vinayaklatthe/microsoft-security-skills --skill azure-site-recovery

Installs into the current project.

Summary

Guidance for Azure Site Recovery (ASR) — disaster-recovery-as-a-service that replicates Azure VMs and on-premises machines to a secondary region for orchestrated failover. Covers RPO / RTO design, replication setup, recovery plans with start-up ordering and scripts, test failover

Files · 1

View on GitHub

SKILL.md

1	# Azure Site Recovery
2
3	Azure Site Recovery (ASR) is Disaster-Recovery-as-a-Service that replicates Azure VMs and
4	on-premises machines to a secondary region, orchestrating failover and failback to keep
5	workloads available during regional outages. It's a critical piece of business continuity -
6	distinct from, and complementary to, backup.
7
8	## When to use
9	Providing regional disaster recovery for critical workloads with a tested, orchestrated
10	failover capability. Use this skill to set RPO / RTO, design recovery plans, and run test
11	failovers.
12
13	Do not use this skill for point-in-time backup (`use Azure Backup`), database-only HA,
14	or generic BCDR strategy without Azure-specific design.
15
16	## Tier workloads by RPO / RTO
17
18	\| Workload tier \| RPO target \| RTO target \| Strategy \|
19	\|---\|---\|---\|---\|
20	\| Tier 0 - mission critical \| < 1 minute \| < 15 minutes \| Active-active multi-region (not ASR alone); ASR as warm fallback \|
21	\| Tier 1 - business critical \| < 15 minutes \| < 1 hour \| ASR continuous replication + automated recovery plan \|
22	\| Tier 2 - important \| < 1 hour \| < 4 hours \| ASR replication + manual failover \|
23	\| Tier 3 - standard \| < 24 hours \| < 24 hours \| Azure Backup + restore in secondary region \|
24	\| Tier 4 - dev / test \| 7 days \| 7 days \| Azure Backup only; no DR \|
25
26	> Rule of thumb: if RPO is sub-minute or RTO is sub-15-minute, ASR alone isn't enough
27	> - design active-active. ASR is the right answer for Tier 1 and Tier 2 (RPO minutes,
28	> RTO < 4 hours).
29
30	## Approach
31
32	1. Define RPO and RTO per workload — Workload owners + business sign-off, not IT
33	guessing. Tier per the table. Document the assumption that "Tier 3 = backup-restore,
34	not failover".
35	Verify: RPO / RTO documented and signed off per Tier 1 / Tier 2 workload.
36
37	2. Set up the Recovery Services vault in the paired region — Use Azure **paired
38	region** (e.g. North Europe ↔ West Europe) for latency, billing, and Microsoft-
39	coordinated patching. One vault per region pair per business unit.
40	*Verify: vault in the secondary region; replication policy created (e.g. 24-hour
41	retention, 4-hour app-consistent snapshots).*
42
43	3. Enable replication on Tier 1 / Tier 2 VMs — Replication is per-VM. Choose target
44	region, target VNet, target storage, and Availability Zone alignment if used in
45	source. Initial replication can take hours - plan bandwidth.
46	*Verify: replication health = healthy on all in-scope VMs; latest recovery point time
47	stamp within the RPO target.*
48
49	4. Build recovery plans with ordered start-up — Group VMs by application; specify
50	start-up order (DB tier first, then app, then web). Add pre / post scripts
51	(Automation runbooks) for DNS update, IP changes, app warm-up. Add **manual action
52	pauses** where a human must validate.
53	*Verify: recovery plan dry-runs in test failover; documented runbook for the on-call
54	team.*
55
56	5. Account for dependencies in the recovery region — Identity (Entra is global; AD DCs
57	need a regional DC or DR DC), DNS (private DNS zones), Key Vault (regional or geo-
58	replicated), Storage accounts (GRS or RA-GRS), networking (peerings, gateways, firewall),
59	licences.
60	*Verify: dependency map; recovery region has working DNS, DC reachability, Key Vault,
61	gateway connectivity.*
62
63	6. Test failover on a schedule — Run test failover into an isolated network in
64	the secondary region at least every 6 months for Tier 1 (quarterly is better). Validate
65	app functionality, document timing vs RTO target, capture issues.
66	*Verify: test failover report shows actual RTO ≤ documented RTO; issues triaged within
67	30 days.*
68
69	7. Plan failover / failback procedure — Planned failover (with sync) for graceful;
70	unplanned (data-loss-bounded by last recovery point) for outage. Failback procedure
71	tested as part of the test failover lifecycle.
72
73	## Guardrails
74	- **DR is not backup - pair ASR with Azure Backup for point-in-time restore and ransomware
75	recovery (immutable / soft-deleted recovery points).** ASR replicates the corruption too;
76	you need immutable backup f

People who liked this also viewed

6 picks

Type

azure-site-recovery

53installs34forks

View on GitHub

How to install azure-site-recovery?

vinayaklatthe/microsoft-security-skills/azure-site-recovery

$npx -y skills add vinayaklatthe/microsoft-security-skills --skill azure-site-recovery

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Azure Site Recovery
2
3	Azure Site Recovery (ASR) is Disaster-Recovery-as-a-Service that replicates Azure VMs and
4	on-premises machines to a secondary region, orchestrating failover and failback to keep
5	workloads available during regional outages. It's a critical piece of business continuity -
6	distinct from, and complementary to, backup.
7
8	## When to use
9	Providing regional disaster recovery for critical workloads with a tested, orchestrated
10	failover capability. Use this skill to set RPO / RTO, design recovery plans, and run test
11	failovers.
12
13	Do not use this skill for point-in-time backup (`use Azure Backup`), database-only HA,
14	or generic BCDR strategy without Azure-specific design.
15
16	## Tier workloads by RPO / RTO
17
18	\| Workload tier \| RPO target \| RTO target \| Strategy \|
19	\|---\|---\|---\|---\|
20	\| Tier 0 - mission critical \| < 1 minute \| < 15 minutes \| Active-active multi-region (not ASR alone); ASR as warm fallback \|
21	\| Tier 1 - business critical \| < 15 minutes \| < 1 hour \| ASR continuous replication + automated recovery plan \|
22	\| Tier 2 - important \| < 1 hour \| < 4 hours \| ASR replication + manual failover \|
23	\| Tier 3 - standard \| < 24 hours \| < 24 hours \| Azure Backup + restore in secondary region \|
24	\| Tier 4 - dev / test \| 7 days \| 7 days \| Azure Backup only; no DR \|
25
26	> Rule of thumb: if RPO is sub-minute or RTO is sub-15-minute, ASR alone isn't enough
27	> - design active-active. ASR is the right answer for Tier 1 and Tier 2 (RPO minutes,
28	> RTO < 4 hours).
29
30	## Approach
31
32	1. Define RPO and RTO per workload — Workload owners + business sign-off, not IT
33	guessing. Tier per the table. Document the assumption that "Tier 3 = backup-restore,
34	not failover".
35	Verify: RPO / RTO documented and signed off per Tier 1 / Tier 2 workload.
36
37	2. Set up the Recovery Services vault in the paired region — Use Azure **paired
38	region** (e.g. North Europe ↔ West Europe) for latency, billing, and Microsoft-
39	coordinated patching. One vault per region pair per business unit.
40	*Verify: vault in the secondary region; replication policy created (e.g. 24-hour
41	retention, 4-hour app-consistent snapshots).*
42
43	3. Enable replication on Tier 1 / Tier 2 VMs — Replication is per-VM. Choose target
44	region, target VNet, target storage, and Availability Zone alignment if used in
45	source. Initial replication can take hours - plan bandwidth.
46	*Verify: replication health = healthy on all in-scope VMs; latest recovery point time
47	stamp within the RPO target.*
48
49	4. Build recovery plans with ordered start-up — Group VMs by application; specify
50	start-up order (DB tier first, then app, then web). Add pre / post scripts
51	(Automation runbooks) for DNS update, IP changes, app warm-up. Add **manual action
52	pauses** where a human must validate.
53	*Verify: recovery plan dry-runs in test failover; documented runbook for the on-call
54	team.*
55
56	5. Account for dependencies in the recovery region — Identity (Entra is global; AD DCs
57	need a regional DC or DR DC), DNS (private DNS zones), Key Vault (regional or geo-
58	replicated), Storage accounts (GRS or RA-GRS), networking (peerings, gateways, firewall),
59	licences.
60	*Verify: dependency map; recovery region has working DNS, DC reachability, Key Vault,
61	gateway connectivity.*
62
63	6. Test failover on a schedule — Run test failover into an isolated network in
64	the secondary region at least every 6 months for Tier 1 (quarterly is better). Validate
65	app functionality, document timing vs RTO target, capture issues.
66	*Verify: test failover report shows actual RTO ≤ documented RTO; issues triaged within
67	30 days.*
68
69	7. Plan failover / failback procedure — Planned failover (with sync) for graceful;
70	unplanned (data-loss-bounded by last recovery point) for outage. Failback procedure
71	tested as part of the test failover lifecycle.
72
73	## Guardrails
74	- **DR is not backup - pair ASR with Azure Backup for point-in-time restore and ransomware
75	recovery (immutable / soft-deleted recovery points).** ASR replicates the corruption too;
76	you need immutable backup f

People who liked this also viewed

6 picks

Type