Azure Backup versus third-party for IaaS

Overview

Azure Backup (Recovery Services Vault) covers many IaaS patterns with native integration; third-party tools add cross-cloud, deeper app consistency, or long-term immutability semantics the client already bought.

When native fits

• Windows/Linux VM file-consistent backups acceptable for the workload.
• Retention and compliance fit vault policies; encryption with CMK ok.
• Ops team wants lowest integration friction and Azure-only estate.

When to involve third-party

• Multi-cloud or hybrid mandates single pane; immutable + air-gap to another vendor; granular SQL/Oracle application tools; legal hold workflows the legal team already uses.

Design notes

Watch soft delete and multi-region vault options for ransomware resilience. For cross-subscription restores, plan RBAC and vault access up front—retroactive permission fixes burn incident hours.

Sales hygiene

Map RPO/RTO in the SOW to the actual backup architecture; “Azure backs up itself” is not a sentence to utter near auditors.