Skip to content

sap-hana-database-instances-backup.md

Latest commit

 

History

History
161 lines (93 loc) · 13.4 KB

sap-hana-database-instances-backup.md

File metadata and controls

161 lines (93 loc) · 13.4 KB
title Back up SAP HANA database instances on Azure VMs
description In this article, you'll learn how to back up SAP HANA database instances that are running on Azure virtual machines.
ms.topic how-to
ms.date 02/16/2026
ms.service azure-backup
author AbhishekMallick-MS
ms.author v-mallicka

Back up SAP HANA database instance snapshots on Azure VMs

This article describes how to back up SAP HANA database instances that are running on Azure VMs to an Azure Backup Recovery Services vault.

Azure Backup now performs an SAP HANA storage snapshot-based backup of an entire database instance. Backup combines an Azure managed disk full or incremental snapshot with HANA snapshot commands to provide instant HANA backup and restore.

Note

  • You can now store the Snapshot backups in a Recovery Services vault by using Enhanced backup policy (preview) for HANA Snapshot backup. This provides all the vault level features, such as Immutability, Soft-delete, cross-region restore, and more, for SAP HANA snapshot backups. This policy also ensures faster restores from instant tier.
  • For pricing, as per SAP advisory, you must do a weekly full backup + logs streaming/Backint based backup so that the existing protected instance fee and storage cost are applied. For snapshot backup, the snapshot data created by Azure Backup is saved in your storage account and incurs snapshot storage charges. Thus, in addition to streaming/Backint backup charges, you're charged for per GB data stored in your snapshots, which is charged separately. Learn more about Snapshot pricing and Streaming/Backint based backup pricing.

To learn about the supported SAP HANA database backup and restore scenarios, region availability, and limitations, see the support matrix. For common questions, see the frequently asked questions.

You can also back up SAP HANA System Replication databases on Azure VMs using Azure portal.

Before you start

Policy

According to SAP, it's mandatory to run a weekly full backup of all databases within an instance. Currently, logs are also mandatory for a database when you're creating a policy. With snapshots happening daily, we don’t see a need for incremental or differential backups in the database policy. Therefore, all databases in the database instance, which is required to be protected by a snapshot, should have a database policy of only weekly fulls + logs ONLY, along with daily snapshots at an instance level.

Important

  • As per SAP advisory, we recommend you to configure Database via Backint with weekly fulls + log backup only policy before configuring DB Instance via Snapshot backup. If weekly fulls + logs backup only using Backint based backup isn't enabled, snapshot backup configuration will fail. :::image type="content" source="./media/sap-hana-database-instances-backup/backup-goal-database-via-backint.png" alt-text="Screenshot shows the 'Database via Backint' backup goal." lightbox="./media/sap-hana-database-instances-backup/backup-goal-database-via-backint.png":::
  • Because the policy doesn’t call for differential or incremental backups, we do not recommend that you trigger on-demand differential backups from any client.

To summarize the backup policy:

  • Always protect all databases within an instance with a database policy before you apply daily snapshots to the database instance.
  • Make sure that all database policies have only Weekly fulls + logs and no differential/incremental backups.
  • Do not trigger on-demand Backint-based streaming differential or incremental backups for these databases.

Permissions required for backup

You must assign the required permissions to the Azure Backup service, which resides on a HANA virtual machine (VM), to take snapshots of the managed disks and place them in a user-specified resource group that's mentioned in the policy. To do so, you can use the system-assigned managed identity of the source VM.

The following table lists the resource, permissions, and scope.

Entity Built-in role Scope of permission Description
Source VM Virtual Machine Contributor The backup admin who configures and runs the HANA snapshot backup Configures the HANA instance
Source disk resource group (where all disks are present for backup) Disk Backup Reader The source VM system-assigned managed identity Creates disk snapshots
Source snapshot resource group Disk Snapshot Contributor The source VM system-assigned managed identity Creates disk snapshots and stores them in the source snapshot resource group
Source snapshot resource group Disk Snapshot Contributor Backup Management Service Deletes old snapshots in the source snapshot resource group.

When you're assigning permissions, consider the following:

  • The credentials that are used should have permissions to grant roles to other resources and should be either Owner or User Access Administrator, as mentioned in the steps for assigning user roles.

  • During backup configuration, you can use the Azure portal to assign the previously mentioned permissions, except Disk Snapshot Contributor to the Backup Management Service principal for the snapshot resource group. You need to manually assign this permission.

  • We recommend that you not change the resource groups after they're given or assigned to Azure Backup, because it makes it easier to handle the permissions.

Learn about the permissions required for snapshot restore and the SAP HANA instance snapshot backup architecture.

Establish network connectivity

Learn about the network configurations required for HANA instance snapshot.

[!INCLUDE How to create a Recovery Services vault]

Create a policy

To create a policy for the SAP HANA database instance backup, follow these steps:

  1. In the Azure portal, select a Recovery Services vault.

  2. Under Backup, select Backup Policies.

  3. Select Add.

  4. On the Select policy type pane, select SAP HANA in Azure VM (DB Instance via snapshot).

    :::image type="content" source="./media/sap-hana-database-instances-backup/select-sap-hana-instance-policy-type.png" alt-text="Screenshot that shows a list of policy types." lightbox="./media/sap-hana-database-instances-backup/select-sap-hana-instance-policy-type.png":::

  5. On the Create policy pane, select the Policy sub type. Select the Enhanced(Preview) policy to retain your snapshot backups for long term in a Recovery Services Vault and leverage additional security features like immutability, soft-delete, MUA etc.

    :::image type="content" source="./media/sap-hana-database-instances-backup/hana-vaulted-snapshot-enhanced-policy.png" alt-text="Screenshot that shows policy sub types." lightbox="./media/sap-hana-database-instances-backup/hana-vaulted-snapshot-enhanced-policy.png":::

  6. On the Create policy pane, enter the following details:

    :::image type="content" source="./media/sap-hana-database-instances-backup/create-policy.png" alt-text="Screenshot that shows the 'Create policy' pane for configuring backup and restore." lightbox="./media/sap-hana-database-instances-backup/create-policy.png":::

    1. Policy name: Enter a unique policy name.

    2. Snapshot Backup: Set the Time and Timezone for backup in the dropdown lists. The default settings are 10:30 PM and (UTC) Coordinated Universal Time.

      [!Note] Azure Backup currently supports Daily backup only.

    3. Instant Restore: Set the retention of recovery snapshots from 1 to 35 days. The default value is 2.

    4. Resource group: Select the appropriate resource group in the drop-down list.

    5. Retention range: If you have selected Enhanced(Preview) as the policy sub type, you can now provide the retention durations for backups stored in Recovery Services Vault. Provide the retention duration for your daily, weekly, monthly and yearly backup points as required.

      :::image type="content" source="./media/sap-hana-database-instances-backup/create-policy.png" alt-text="Screenshot that shows the 'Create policy' pane for configuring backup and restore." lightbox="./media/sap-hana-database-instances-backup/create-policy.png":::

    6. Managed Identity: Select a managed identity in the dropdown list to assign permissions for taking snapshots of the managed disks and place them in the resource group that you've selected in the policy.

      You can also create a new managed identity for snapshot backup and restore. To create a managed identity and assign it to the VM with SAP HANA database, follow these steps:

      1. Select + Create.

        :::image type="content" source="./media/sap-hana-database-instances-backup/start-create-managed-identity.png" alt-text="Screenshot that shows how to create managed identity." lightbox="./media/sap-hana-database-instances-backup/start-create-managed-identity.png":::

      2. On the Create User Assigned Managed Identity page, choose the required Subscription, Resource group, Instance region, and add an Instance name.

      3. Select Review + create.

        :::image type="content" source="./media/sap-hana-database-instances-backup/configure-new-managed-identity.png" alt-text="Screenshot that shows how to configure a new managed identity." lightbox="./media/sap-hana-database-instances-backup/configure-new-managed-identity.png":::

      4. Go to the VM with SAP HANA database, and then select Identity > User assigned tab.

      5. Select User assigned managed identity.

        :::image type="content" source="./media/sap-hana-database-instances-backup/assign-vm-user-assigned-managed-identity.png" alt-text="Screenshot shows how to assign user-assigned managed identity to VM with SAP HANA database." lightbox="./media/sap-hana-database-instances-backup/assign-vm-user-assigned-managed-identity.png":::

      6. Select the subscription, resource group, and the new user-assigned managed identity.

      7. Select Add.

        :::image type="content" source="./media/sap-hana-database-instances-backup/add-user-assigned-permission-to-vm.png" alt-text="Screenshot shows how to add the new user-assigned managed identity." lightbox="./media/sap-hana-database-instances-backup/add-user-assigned-permission-to-vm.png":::

      8. On the Create policy page, under Managed Identity, select the newly created user-assigned managed identity > OK.

        :::image type="content" source="./media/sap-hana-database-instances-backup/add-new-user-assigned-managed-identity-to-backup-policy.png" alt-text="Screenshot shows how to add new user-assigned managed identity to the backup policy." lightbox="./media/sap-hana-database-instances-backup/add-new-user-assigned-managed-identity-to-backup-policy.png":::

    You need to manually assign the permissions for the Azure Backup service to delete the snapshots as per the policy. Other permissions are assigned in the Azure portal.

    To assign the Disk Snapshot Contributor role to the Backup Management Service manually in the snapshot resource group, see Assign Azure roles by using the Azure portal.

  7. Select Create.

You'll also need to create a policy for SAP HANA database backup.

Discover the database instance

To discover the database instance where the snapshot is present, see the Back up SAP HANA databases in Azure VMs.

[!INCLUDE How to configure backup for SAP HANA instance snapshot, run an on-demand backup, and monitor the backup job]

Next steps

Learn how to: