{Backup} az backup: Add Cross Subscription Backup (CSB) support for AzureIaaSVM#33703
Open
Prabhkiratnitp wants to merge 5 commits into
Open
{Backup} az backup: Add Cross Subscription Backup (CSB) support for AzureIaaSVM#33703Prabhkiratnitp wants to merge 5 commits into
az backup: Add Cross Subscription Backup (CSB) support for AzureIaaSVM#33703Prabhkiratnitp wants to merge 5 commits into
Conversation
…zure VM - az backup protection enable-for-vm: accept a full VM ARM id in a different subscription than the vault (CSB); skip discovery and construct the container/protected-item URIs and sourceResourceId directly, after validating the VM exists and is in the vault's region - az backup restore restore-disks: support OLR for CSB protected items by deriving the container subscription from the item sourceResourceId; fail with a clear error when a friendly container name matches multiple containers - az backup item list/show: add containerSubscriptionId to the Azure VM backup item response - az backup job show: add containerSubscriptionId to the Azure VM backup job response - Add tests, recording, help examples and history notes Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
️✔️AzureCLI-FullTest
|
️✔️AzureCLI-BreakingChangeTest
|
microsoft-github-policy-service
Bot
requested review from
jsntcy,
wangzelin007 and
yonzhan
Contributor
There was a problem hiding this comment.
Pull request overview
This PR extends the az backup command module to support Cross Subscription Backup (CSB) scenarios for Azure VM protection and restore, and surfaces the protected VM’s subscription on item/job responses to help customers operate across vault/VM subscription boundaries.
Changes:
- Enable
az backup protection enable-for-vmto accept a full cross-subscription VM ARM ID and bypass protectable-item discovery by constructing container/item URIs directly. - Improve restore flows for CSB, including Original Location Recovery behavior and clearer failures when friendly names are ambiguous.
- Add
containerSubscriptionIdto Azure VM backup item and job outputs, plus tests/recordings/help/history notes.
Reviewed changes
Copilot reviewed 7 out of 7 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| src/azure-cli/HISTORY.rst | Adds history notes documenting new CSB behavior and response fields. |
| src/azure-cli/azure/cli/command_modules/backup/tests/latest/test_backup_commands.py | Adds validation for containerSubscriptionId on Azure VM backup items and introduces a playback-only ambiguity regression test. |
| src/azure-cli/azure/cli/command_modules/backup/tests/latest/recordings/test_backup_restore_multiple_containers_same_friendly_name.yaml | Recording supporting the new ambiguity regression scenario. |
| src/azure-cli/azure/cli/command_modules/backup/custom.py | Implements CSB enable-for-vm path, ambiguity validation, OLR subscription derivation, and job response augmentation. |
| src/azure-cli/azure/cli/command_modules/backup/custom_help.py | Adds helpers to surface containerSubscriptionId for items/jobs. |
| src/azure-cli/azure/cli/command_modules/backup/custom_common.py | Ensures item list/show consistently set containerSubscriptionId. |
| src/azure-cli/azure/cli/command_modules/backup/_help.py | Adds help examples/long-summary guidance for CSB/native names. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Collaborator
|
Backup |
…e job-subscription check Rework the Cross Subscription Backup (CSB) live-only tests so they are fully self-contained via VaultPreparer, and fold the job containerSubscriptionId validation into the restore test. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…Id parsing Add unit tests for set_job_container_subscription_id covering the 'VM Subscription ID' property-bag key name and parsing, so the containerSubscriptionId field on 'az backup job show' is guarded in CI without a live cross-subscription setup. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
zubairabid
approved these changes
Jul 14, 2026
zubairabid
left a comment
zubairabid
left a comment
Contributor
There was a problem hiding this comment.
Minor change to be made, looks good otherwise.
zubairabid
reviewed
Jul 14, 2026
…release process) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: fe45641d-3d74-4e8e-882f-6d2cebb8839a
Prabhkiratnitp
force-pushed
the
users/singhprab/csb-cli
branch
from
8b555ad to
07c4aef
Compare
|
Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run. |
yanzhudd
changed the title
az backup: Add Cross Subscription Backup (CSB) support for A…
Contributor
|
/azp run |
|
Azure Pipelines: Successfully started running 3 pipeline(s). |
Prabhkiratnitp
changed the title
az backup: Add Cross Subscription Backup (CSB) support for A…az backup: Add Cross Subscription Backup (CSB) support for AzureIaaSVM
Author
@microsoft-github-policy-service agree company="Microsoft" |
Contributor
|
/azp run |
|
Azure Pipelines: Successfully started running 3 pipeline(s). |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Related command
az backup protection enable-for-vm , az backup restore restore-disks , az backup item list , az backup item show , az backup job show
Description
This PR adds Cross Subscription Backup (CSB) support for Azure VMs, allowing a VM to be protected by a Recovery Services vault in a different subscription.
• enable-for-vm : accepts a full VM ARM ID whose subscription differs from the vault's. Since discovery ( RefreshContainers / ListProtectableItems ) only runs in the vault's subscription and cannot see a cross-subscription VM, we skip discovery and construct the container URI, protected-item URI, and sourceResourceId directly from the ARM ID. Before calling the backend we validate the VM exists and is in the vault's region (fail-fast on a wrong ID or region mismatch). The backend derives the VM's subscription from sourceResourceId .
• restore-disks : supports Original Location Recovery (OLR) for CSB items — the container subscription is derived from the recovery point / item sourceResourceId , so no --target-subscription is needed, and the staging storage account is resolved in the VM's subscription. Native container/item names are used because friendly-name resolution is unreliable for cross-subscription containers. Also, a friendly container name that matches multiple containers now fails with a clear error instead of crashing.
• item list / item show and job show : surface a new containerSubscriptionId field on the Azure VM backup item and job responses, so users can see the VM's subscription for CSB items/jobs.
Includes help examples, history notes, and self-contained @live_only integration tests covering enable → on-demand backup → OLR restore → containerSubscriptionId assertions → disable.
Testing Guide
Enable backup for a VM in a different subscription than the vault (CSB):
az backup protection enable-for-vm
--resource-group myVaultRg --vault-name myVault
--policy-name DefaultPolicy
--vm "/subscriptions//resourceGroups//providers/Microsoft.Compute/virtualMachines/"
Confirm the item/job carry the VM's subscription:
az backup item show -g myVaultRg -v myVault -c -n
--backup-management-type AzureIaasVM --workload-type VM
--query properties.containerSubscriptionId
OLR restore of a CSB item (native names; subscription derived from the recovery point):
az backup restore restore-disks
--resource-group myVaultRg --vault-name myVault
--container-name "IaasVMContainer;iaasvmcontainerv2;;"
--item-name "VM;iaasvmcontainerv2;;"
--rp-name
Automated tests ( @live_only , run live because playback sanitizes subscription IDs and collapses the "VM sub ≠ vault sub" distinction):
azdev test test_backup_csb_enable_for_vm test_backup_csb_restore_olr --live
Both pass live; both correctly skip in playback/CI.
History Notes
[Backup]
az backup protection enable-for-vm: Support Cross Subscription Backup by accepting the complete ARM ID of a VM residing in a different subscription than the vault via--vm[Backup]
az backup restore restore-disks: Support Original Location Recovery (OLR) for Cross Subscription Backup protected items; the container subscription is derived from the recovery point, no additional input required[Backup]
az backup restore restore-disks: Fail with a clear error instead of crashing when a friendly container name matches multiple containers in the vault; pass the native container name instead[Backup]
az backup item list/show: AddcontainerSubscriptionIdto the Azure VM backup item response[Backup]
az backup job show: AddcontainerSubscriptionIdto the Azure VM backup job responseThis checklist is used to make sure that common guidelines for a pull request are followed.
The PR title and description has followed the guideline in Submitting Pull Requests.
I adhere to the Command Guidelines.
I adhere to the Error Handling Guidelines.