This cloud-native architecture protects Azure Data Lake Storage without requiring permanent backup infrastructure. It separates your production ADLS data from backup copies stored in the Druva AI Resilience Cloud.
During backup and restore, an on-demand Data Mover is deployed in your Azure subscription. Depending on your storage-account network configuration, the Data Mover accesses ADLS using either:
Private access: Connects through Azure Private Link when public network access to the storage account is disabled.
Public access from selected networks: Connects through the storage account’s public endpoint, with access restricted to approved virtual networks or IP addresses.
Both configurations restrict access to authorized network paths. Azure describes these access models in its documentation for private endpoints and storage firewall rules.
Solution architecture
The architecture consists of two environments:
Your Microsoft Azure environment: Contains the identity, access, storage, and data-movement components required to protect ADLS data.
Druva AI Resilience Cloud: Contains managed Azure or AWS storage for backup data.
Production data and backup copies are maintained in separate security environments, providing a logically air-gapped backup architecture.
Components in your Azure environment
Customer Entra ID tenant
The following components provide authorized access to your Microsoft Azure environment:
Service Principal: Provides the application identity used for authentication.
App Secret: Provides the credential associated with the service principal.
Customer subscription
The following components reside in your Azure subscription:
Custom Backup Role: Grants the permissions required to discover, back up, and restore selected ADLS resources.
Azure Key Vault: Stores the credential required by the data-protection workflow. Customer-managed keys are not supported.
ADLS storage: Contains the production data selected for protection. The storage account can use private access or public access restricted to selected networks.
On-demand Data Mover: A temporary component deployed when a backup or restore operation begins. It transfers data between the ADLS storage and the backup environment.
Network access options
The Data Mover supports the following methods for accessing ADLS storage.
Private access
For a storage account configured with private access, the Data Mover connects through Azure Private Link. Traffic uses a private endpoint in the virtual network and does not use the storage account’s public endpoint.
The architecture diagram illustrates this configuration.
Note: Microsoft recommends creating private endpoints for both the blob and dfs subresources when operations require both Blob Storage and Data Lake Storage endpoints.
Public access from selected networks
For a storage account configured with public network access, access must be restricted to selected virtual networks or IP addresses. The Data Mover connects through the storage account’s public endpoint from an approved network.
Requests originating outside the configured networks are denied by the storage-account firewall.
Components in the backup environment
The Druva AI Resilience Cloud stores backup data outside your Azure tenant and subscription. Backup copies can be stored in managed Azure Storage or AWS Storage.
This separation logically isolates backup copies from your production ADLS environment.
Backup workflow
The service authenticates with your Entra ID tenant using the configured service principal and App Secret.
The Custom Backup Role authorizes the required operations in your Azure subscription.
An on-demand Data Mover is deployed in your subscription.
The Data Mover accesses the selected ADLS storage using one of the following network paths:
A private endpoint through Azure Private Link.
A public endpoint restricted to selected networks.
The Data Mover reads and deduplicates the selected data.
The processed data is transferred to managed Azure or AWS backup storage.
The transfer does not incur egress charges.
The Data Mover is removed after the backup operation is complete.
Restore workflow
An authorized administrator selects a recovery point and starts a restore.
An on-demand Data Mover is deployed in the customer subscription.
The selected backup data is retrieved from the backup environment.
The recovered data is transferred without incurring egress charges.
The Data Mover connects to the destination ADLS storage using private access or public access restricted to selected networks.
The recovered data is written to the selected destination.
The Data Mover is removed after the restore operation is complete.
Security and isolation
Access to ADLS is limited using either Azure Private Link or storage firewall rules that allow only selected networks. The Custom Backup Role controls the operations that the backup service can perform.
Backup copies are stored outside your Azure tenant and subscription. This separation helps protect backup data from incidents affecting the production environment.