This article describes the cloud-native architecture used to protect Azure Data Lake Storage (ADLS) accounts operating behind restricted networks or Azure Private Link. When public access is disabled or restricted, Druva provisions an on-demand, ephemeral Data Mover directly inside your Azure subscription to ensure backup traffic remains within authorized network boundaries.
Architecture overview
The architecture separates your production data plane from the air-gapped backup storage plane.
Components in your Azure environment
Customer Entra ID tenant
Service Principal: Provides the application identity used for authentication.
App Secret: The credential generated during App Registration in Microsoft Entra ID, used alongside the Service Principal for authentication.
Customer subscription
Custom Backup Role: Grants the permissions required to discover, back up, and restore selected ADLS resources.
Azure Key Vault: Stores the customer-managed encryption key (e-key) used to secure and govern backup data in Druva's air-gapped vault.
ADLS storage: Contains the production data selected for protection. The storage account can use private access or public access restricted to selected networks.
On-demand Data Mover: A temporary virtual machine (VM) deployed when a backup or restore operation begins. It transfers data between the ADLS storage and the air-gapped vault.
Network access options
The Data Mover supports two methods for accessing ADLS storage:
Private access
Connects through Azure Private Link using private endpoints in your Virtual Network (VNet).
Required Configuration: Dual private endpoints must exist in the same VNet and subnet:
privatelink.blob.core.windows.net (data-plane read/write)
privatelink.dfs.core.windows.net (directory structure, metadata, and POSIX ACLs)
Public access from selected networks
Connects through the storage account's public endpoint. Access is restricted by the storage account firewall to approved virtual networks or IP addresses.
Components in the backup environment
The Druva AI Resilience Cloud stores backup data in fully-managed secure Azure Storage or AWS Storage outside your Azure tenant and subscription. This physical and logical separation air-gaps backup copies from your production environment and potential threats.
Backup workflow
Authentication: Druva authenticates with your Entra ID tenant using the Service Principal and App Secret.
Authorization: The Custom Backup Role authorizes the required operations in your Azure subscription.
Worker Provisioning: An on-demand Data Mover is deployed in your subscription.
Data Access: The Data Mover connects to ADLS storage via Private Link or allowed network paths.
Processing & Transfer: The Data Mover reads and deduplicates data before transferring it to Druva cloud storage without egress charges.
De-provisioning: The Data Mover is removed after the backup operation is complete.
Restore workflow
Initiation: An authorized administrator selects a recovery point and starts a restore.
Worker Provisioning: An on-demand Data Mover is deployed in the customer subscription.
Retrieval: Selected backup data is retrieved from the backup environment without egress charges.
Restoration: The Data Mover connects to destination ADLS storage via Private Link or restricted networks and writes the recovered data.
De-provisioning: The Data Mover is removed after the restore operation is complete.
Security and isolation
Data Plane Isolation: Access to ADLS is strictly limited using Azure Private Link or storage firewall rules that restrict ingress to authorized networks.
Least-Privilege Access: The Custom Backup Role controls and restricts data-protection operations within your Azure subscription.
Logical Air-Gap: Backup copies are stored in isolated Druva-managed storage across separate Azure tenants and subscriptions, protecting backup data from security incidents affecting your production environment.