|
| 1 | +--- |
| 2 | +title: Azure Backup - Restore Confidential VM using Azure Backup (preview) |
| 3 | +description: Learn about restoring Confidential VM with Platform Managed Key (PMK) or Customer Managed Key (CMK) using Azure Backup. |
| 4 | +ms.topic: how-to |
| 5 | +ms.date: 01/28/2026 |
| 6 | +ms.custom: references_regions |
| 7 | +ms.service: azure-backup |
| 8 | +author: AbhishekMallick-MS |
| 9 | +ms.author: v-mallicka |
| 10 | +--- |
| 11 | + |
| 12 | +# Restore Confidential VM using Azure Backup (preview) |
| 13 | + |
| 14 | +[!INCLUDE [Confidential VM backup preview advisory.](../../includes/confidential-vm-backup-preview.md)] |
| 15 | + |
| 16 | +This article describes how to restore Confidential VM (CVM) encrypted with Platform Managed Key (PMK) or Customer Managed Key (CMK) using Azure Backup. It covers restore scenarios based on encryption key and Disk Encryption Set (DES) states, and provides the recovery procedure for restore failures. It also provides the procedure to extract virtual machine encryption details, restore missing keys, and assign necessary permissions. |
| 17 | + |
| 18 | +Learn about the [supported scenarios for Confidential VM backup](backup-support-matrix-iaas.md#support-for-confidential-vm-backup-preview). |
| 19 | + |
| 20 | +## Restore scenarios for Confidential VM |
| 21 | + |
| 22 | +Confidential VM restore behavior depends on the state of the DES, Key Vault, and keys at the time of restore. Key restore scenarios include: |
| 23 | + |
| 24 | +- **Original Key or Key Version intact**: Restore succeeds if the original Disk Encryption Set (DES) and key remain intact. |
| 25 | +- **Key Rotation**: Restore succeeds when a new key version is active, provided the previous key version isn't expired or deleted. |
| 26 | +- **Key Change**: If the DES uses a new key, restore succeeds only if the previous key still exists; it fails if the previous key is deleted. |
| 27 | +- **DES or Key Deleted**: Restore fails with errors, such as `UserErrorDiskEncryptionSetDoesNotExist` or `UserErrorDiskEncryptionSetKeyDoesNotExist`. To resolve, re-create the key and DES using restored key data, then retry the restore. |
| 28 | +- **Input DES Provided**: If you provide a new DES created from restored key data, restore can succeed if the key and version match the ones used at backup time. |
| 29 | +- **Mismatched DES or Key**: Restore fails with `UserErrorInputDESKeyDoesNotMatchWithOriginalKey`. To resolve this error, restore the missing keys. |
| 30 | + |
| 31 | +Learn how to [restore missing keys for Confidential VM restore](#restore-missing-keys-for-confidential-vm-restore). |
| 32 | + |
| 33 | +## Prerequisites |
| 34 | + |
| 35 | +Before you start the Confidential VM restore process, ensure you have the recovery points available in the Recovery Services vault. |
| 36 | + |
| 37 | +## Assign permissions to DES and Confidential Guest VM Agent for restore |
| 38 | + |
| 39 | +Disk Encryption Set and Confidential Guest VM Agent need permissions on the Key Vault or Managed HSM. To provide the permissions, follow these steps: |
| 40 | + |
| 41 | +**For Key vault**: To grant permissions to the Key vault, select the message *To associate a disk, image, or snapshot with this disk encryption set, you must grant permissions to the key vault*. |
| 42 | + |
| 43 | +**For Managed HSM**: To grant permissions to the Managed HSM, follow these steps: |
| 44 | + |
| 45 | +1. Assign newly created DES with the Managed HSM Crypto User Role: |
| 46 | + |
| 47 | + 1. In the [Azure portal](https://portal.azure.com/), go to **Managed HSM** > **Settings**, and then select **Local RBAC**. |
| 48 | + 2. To add a new Role Assignment, select **Add**. |
| 49 | + 3. Under **Role**, select **Managed HSM Crypto User Role**. |
| 50 | + 4. Under **Scope**, select the restored key. You can also select **All Keys**. |
| 51 | + 5. On the **Security principal**, select *newly created DES*. |
| 52 | + |
| 53 | +2. Assign required permissions to the Confidential Guest VM Agent for booting up CVM: |
| 54 | + |
| 55 | + 1. In the [Azure portal](https://portal.azure.com/), go to **Managed HSM** > **Settings**, and then select **Local RBAC**. |
| 56 | + 2. To add a new Role Assignment, select **Add**. |
| 57 | + 3. Under **Role**, select **Managed HSM Crypto Service Encryption User**. |
| 58 | + 4. Under **Scope**, select the restored key. You can also select **All Keys**. |
| 59 | + 5. On the **Security principal**, select **Confidential Guest VM Agent**. |
| 60 | + |
| 61 | +## Restore the Confidential VM |
| 62 | + |
| 63 | +After you assign the required permissions, you can run the restore operation. [Learn how to restore an Azure VM](backup-azure-arm-restore-vms.md). |
| 64 | + |
| 65 | +## Restore missing keys for Confidential VM restore |
| 66 | + |
| 67 | +If the restore operation fails, you need to restore the PMK or CMK that Azure Backup backed up. |
| 68 | + |
| 69 | +To restore the key using PowerShell, follow these steps: |
| 70 | + |
| 71 | +1. To select the vault containing the protected CVM + CMK, enter the resource group and name of the vault in the cmdlet, and then run the cmdlet. |
| 72 | + |
| 73 | + ```azurepowershell |
| 74 | + $vault = Get-AzRecoveryServicesVault -ResourceGroupName "<vault-rg>" -Name "<vault-name>" |
| 75 | + ``` |
| 76 | + |
| 77 | +2. To list all failed restore jobs from the last 7 days, run the following cmdlet: |
| 78 | + |
| 79 | + ```azurepowershell |
| 80 | + $Jobs = Get-AzRecoveryServicesBackupJob -From (Get-Date).AddDays(-7).ToUniversalTime() -Status Failed -Operation Restore -VaultId $vault.ID |
| 81 | + ``` |
| 82 | + |
| 83 | + >[!Note] |
| 84 | + >If you want to fetch older jobs, update the day range in the cmdlet. |
| 85 | +
|
| 86 | +3. To select the failed restore job from the result and get the job details, run the following cmdlet: |
| 87 | + |
| 88 | + *Example* |
| 89 | + |
| 90 | + ```azurepowershell |
| 91 | + $JobDetails = Get-AzRecoveryServicesBackupJobDetail -Job $Jobs[0] -VaultId $vault.ID |
| 92 | + ``` |
| 93 | + |
| 94 | +4. To get all the necessary parameters required for key restore from the job details, run the following cmdlet: |
| 95 | + |
| 96 | + ```azurepowershell |
| 97 | + $properties = $JobDetails.properties |
| 98 | + $storageAccountName = $properties["Target Storage Account Name"] |
| 99 | + $containerName = $properties["Config Blob Container Name"] |
| 100 | + $securedEncryptionInfoBlobName = $properties["Secured Encryption Info Blob Name"] |
| 101 | + ``` |
| 102 | + |
| 103 | +5. To select the target storage account used for restore, enter its resource group in the following cmdlet, and then run the cmdlet: |
| 104 | + |
| 105 | + |
| 106 | + ```azurepowershell |
| 107 | + Set-AzCurrentStorageAccount -Name $storageaccountname -ResourceGroupName '<storage-account-rg >' |
| 108 | + ``` |
| 109 | + |
| 110 | +6. To restore the JSON configuration file containing key details for CVM with CMK, run the following cmdlet: |
| 111 | + |
| 112 | + ```azurepowershell |
| 113 | + $destination_path = 'C:\cvmcmkencryption_config.json' |
| 114 | + Get-AzStorageBlobContent -Blob $securedEncryptionInfoBlobName -Container $containerName -Destination $destination_path |
| 115 | + $encryptionObject = Get-Content -Path $destination_path | ConvertFrom-Json |
| 116 | + ``` |
| 117 | + |
| 118 | +7. After the JSON file is generated in the destination path mentioned previously, generate key blob file from the JSON data by running the following cmdlet: |
| 119 | + |
| 120 | + ```azurepowershell |
| 121 | + $keyDestination = 'C:\keyDetails.blob' |
| 122 | + [io.file]::WriteAllBytes($keyDestination, [System.Convert]::FromBase64String($encryptionObject.OsDiskEncryptionDetails.KeyBackupData)) |
| 123 | + ``` |
| 124 | + |
| 125 | +8. To restore the key back in the Key Vault or Managed Hardware Security Module (HSM), run the following cmdlet: |
| 126 | + |
| 127 | + ```azurepowershell |
| 128 | + Restore-AzKeyVaultKey -VaultName '<target_key_vault_name> ' -InputFile $keyDestination |
| 129 | + For MHSM Use, |
| 130 | + Restore-AzKeyVaultKey -HsmName '<target_mhsm_name>' -InputFile $keyDestination |
| 131 | + ``` |
| 132 | + |
| 133 | +Now, you can create a new DES with Encryption type as *Confidential disk encryption with CMK*, which should point to the restored key. This DES should have enough permissions to perform a successful restore. If you use a new Key Vault or Managed HSM to restore the key, then *Backup Management Service* has enough permissions on it. [Learn how to grant permission for Key Vault or Managed HSM access](confidential-vm-backup.md#assign-permissions-for-confidential-vm-backup). |
| 134 | + |
| 135 | +## Related content |
| 136 | + |
| 137 | +- [Support matrix for Confidential VM backup](backup-support-matrix-iaas.md#support-for-confidential-vm-backup-preview). |
| 138 | +- [Back up CVM using Azure Backup (preview)](confidential-vm-backup.md). |
0 commit comments