This article summarizes the supported configurations, limits, and capabilities for Azure Data Lake Storage (ADLS) Protection.
Supported Storage Account Configurations
Feature / Attribute | Support Status |
|
Storage Account Type | Supported |
|
Flat Namespace (FNS) | Supported (via Azure Blob Storage protection) | Standard Azure Blob storage accounts without HNS enabled should be protected with Azure Blob Storage protection. |
Performance Tiers | Supported |
|
Blob Types | Supported |
|
Storage Access Tiers | Supported |
|
Archive Tier Smart Tier | Not Supported | Objects stored in the Archive tier and Smart cannot be backed up directly. Rehydration to a warm tier is required before protection. |
Encryption (MMK) | Supported | Microsoft-Managed Keys (MMK) transparently supported. |
Encryption (CMK) | Supported | Customer-Managed Keys (CMK) supported via Azure Key Vault integration. |
Infrastructure Encryption | Supported | Double-encryption at rest supported. |
Network and Access Support
Network Model | Support Status | Requirements / Limitations |
Public Endpoint (All Networks) | Supported | Requires standard public DNS resolution and outbound TLS 1.3 connectivity over HTTPS. |
Public Endpoint (Selected Networks) | Supported | Storage Account firewalls must allow Druva IP ranges or trusted service exceptions. Learn more. |
Azure Private Link (Private Endpoints) | Supported | Dual Endpoints Required: Both blob (blob.core.windows.net) and dfs (dfs.core.windows.net) private endpoints must exist in the same Virtual Network and Subnet. |
Missing DFS Private Endpoint | Not Supported | Configuring only a blob private endpoint causes backup jobs to fail with error AZURE_BLOB 32884. |
Data, Metadata, and Recovery Scope
Object / Attribute | Backup | Restore (Same Tenant) | Restore (Cross-Tenant) | Notes |
Filesystems (Containers) | Supported | Supported | Supported | Full container hierarchy and structure preserved. |
Directories & Nested Folders | Supported | Supported | Supported | Includes empty directories (preserved as 0-byte marker objects). |
Files & Object Content | Supported | Supported | Supported | Full data payload preserved; granular file and path-based restores supported. |
File Timestamps & Hashes | Supported | Supported | Supported | Captured for incremental tracking and data integrity validation. |
Custom Blob Metadata | Supported | Supported | Supported | User-defined key-value blob metadata preserved. |
POSIX Access & Default ACLs | Supported | Supported | Not Supported | Preserved for same-tenant restores. Stripped during cross-tenant restores due to tenant-specific Entra ID OID isolation. |
Owner / Group OIDs | Supported | Supported | Supported with Limitations | Preserved within the same tenant; mapped to the destination root owner/group during cross-tenant recovery. |
Delta Lake Logs | Supported | Supported | Supported | Protected and restored as standard path files (_delta_log). |
Blob Index Tags | Not Supported | Not Supported | Not Supported | Not available for ADLS backup scope filtering or search. Use file extension or path filters. |
Symbolic Links | Not Supported | Not Supported | Not Supported | ADLS native platform limitation. |
Azure RBAC Role Assignments | Not Supported | Not Supported | Not Supported | RBAC roles are managed at the Azure control plane and must be reapplied manually post-restore. |
Protocols and Endpoints
Item | Status | Notes / Limitations |
Blob endpoint (blob.core.windows.net) | Supported | Used for data-plane blob read/write operations. |
DFS endpoint (dfs.core.windows.net) | Supported | Required for HNS operations, directories, and ACLs. |
Both endpoints required (private endpoint) | Supported | Both Blob and DFS endpoints must exist in the same VNet/Subnet. If only the Blob endpoint is configured, backup jobs fail. |