Welcome! This guide helps you set up agentless backup and recovery for your critical data stored in Azure Data Lake Storage (ADLS) accounts.
ADLS serves as the primary data repository for enterprise analytics workloads, including Azure Synapse Analytics, Azure Databricks, Azure Data Factory, Azure Machine Learning, Azure HDInsight, and Azure Stream Analytics. Druva safeguards data stored within these account hierarchies, including Microsoft Fabric OneLake endpoints.
Understand Azure Data Lake Storage protection
Druva provides air-gapped, policy-driven protection against accidental deletion, ransomware, and regional outages:
Unified analytics workload coverage: Protects ADLS hierarchical namespace (HNS) data structures and unified Microsoft Fabric OneLake storage.
Agentless architecture: Integrates directly using native Azure APIs: no VM provisioning, agent installation, or maintenance required.
Air-gapped security: Backup data is isolated in dedicated, Druva-managed AWS or Azure cloud storage instances.
Flexible recovery options: Perform point-in-time restores directly to the source account or an alternate Azure subscription, region, or storage account.
Prerequisites
Before onboarding your environment, verify that your setup meets the necessary tenant and subscription prerequisites.
1. Register required Azure resource providers
In the Azure portal, go to Subscriptions, select your target subscription, and then select Resource providers. Verify that the following providers show a status of Registered:
Microsoft.Storage
Microsoft.KeyVault
Microsoft.Compute (Required only if storage accounts reside behind restricted networks or Azure Private Endpoints)
Microsoft.Network (Required only if storage accounts reside behind restricted networks or Azure Private Endpoints)
2. Verify administrator roles and permissions
Ensure the account performing the onboarding workflow has the following required roles assigned:
Microsoft Entra ID Tenant Level
Global Administrator: Required to register the enterprise application in Microsoft Entra ID and grant tenant-wide administrative consent.
Azure Subscription Scope
Owner: Required to assign custom Azure RBAC roles and configure resource-level permissions.
Cloud Application Administrator: Required to grant application access rights and manage service principals within the subscription scope.
Step 1: Prepare the Enterprise Workloads Management Console
Sign in to the Enterprise Workloads Management Console.
Select an existing organization or select Default Organization.
Configure Administrators and assign them to an Administrative Group.
For comprehensive deployment instructions, see Quick reference guide to deploy Enterprise Workloads.
Step 2: Onboard your Azure tenant and subscriptions
Grant Access: Authorize Druva to configure your selected Azure subscriptions. This process creates necessary resources, including an eKey, role assignment, and primary/secondary Key Vaults, to secure your backups with customer-controlled keys. To know more, see Prerequisites to protecting Azure resources.
Register Tenant: Onboard your Microsoft Entra ID Tenant in the Management Console. Review Troubleshooting Azure onboarding issues if you encounter issues.
Automatic Discovery: Druva instantly scans your subscriptions and lists all Azure resources available for protection.
After connection, Druva automatically discovers and lists all HNS-enabled ADLS storage accounts within the authorized subscription.
Step 3: Configure backup policies
In the Enterprise Workloads Management Console, select the ADLS storage accounts you want to protect.
Select Configure Backup and define the policy settings:
Backup frequency: Set the automated snapshot schedule.
Backup window: Define the permitted execution timeframe.
Retention rule: Specify the retention period for compliant data lifecycle management.
Step 4: Restore data from a backup set
Select the storage account backup set and select Restore.
Select your target restore location:
Original location: Restores data to the original file path in the source storage account. Learn More
Alternate location: Restores data to a designated alternate Azure subscription, region, storage account, or container. Learn More
Monitor resources and activities
Use the following console features to monitor backup, restore, and administrative activities across your deployment:
Reports: View comprehensive logs and detailed execution histories for backup and restore jobs. For more information, see Reports.
Dashboard: View high-level operational health, active alerts, total protected storage, and deduplication efficiency. For more information, see Dashboard.
Storage: Monitor global storage consumption metrics and deduplication savings across subscriptions. For more information, see Storage.
Analytics: Track overall credit consumption rates, source data growth trends, and storage efficiency. For more information, see Analytics.
Audit Trails: Review chronological logs of administrative actions for compliance and auditing purposes. For more information, see Audit Trails.
Billing: Manage Cost Allocation tags and configure Credit Limits to prevent unexpected overages.
đ Additional resources to help you get started