Guidance on Transitioning Microsoft Azure Backup Server (MABS) to Private Endpoint & Handling Existing Recovery Vault Data

Question

Guidance on Transitioning Microsoft Azure Backup Server (MABS) to Private Endpoint & Handling Existing Recovery Vault Data

kartik Sarsawat 0

I am currently seeking architecture and operational feedback regarding transitioning an on-premises Microsoft Azure Backup Server (MABS) deployment from public routing to an Azure Private Endpoint.

Current Environment & Security Requirement

Current Setup: MABS running on-premises, backing up workloads with both disk (offline) and cloud (online) protection groups pointing to an existing Azure Recovery Services Vault over the public endpoint.
New Security Mandate: Our InfoSec team requires all backup traffic to Azure to traverse dedicated private channels via an Azure Private Endpoint (over ExpressRoute/Site-to-Site VPN) with public network access disabled on the vault.
Current Retention: Several weeks of active online and offline recovery points in the current vault. From my understanding of Azure Backup limitations:
- Azure Backup does not support native migration or copying of recovery points between Recovery Services Vaults.
- Private Endpoints strictly require a brand-new, pristine vault (no items previously protected or registered).
- Question: How to handle existing data when enforcing private endpoints on MABS, or is there an alternative seamless approach to preserve cloud history?

Mohammad Saif 0 Reputation points Microsoft External Staff Moderator

2026-09-10T13:54:33.83+00:00
Hello @kartik Sarsawat ,

As you have mentioned there isn't a supported way to migrate existing MABS recovery points from an existing Recovery Services vault to a new vault and retain the backup history.

For private endpoints, the Recovery Services vault needs to be newly created and must not have had protected or registered items. Azure Backup also doesn't support moving backup data from one vault to another.

Here recommended approach is to run both vaults in parallel

Create a new Recovery Services vault and configure the private endpoint before registering MABS.

Make sure MABS is running a supported version (MABS v4 / 14.0.30.0 or later).

Register MABS with the new vault and start new protection groups/backups.

Keep the existing vault available so its current recovery points can be used during the retention period.

Once the old recovery points expire based on your retention policy, the old vault can be decommissioned.

If the security requirement requires public access to be removed immediately, there isn't a supported Azure Backup mechanism to transfer those existing recovery points into the private-endpoint vault.

Any data that must be retained outside the old vault would need to be restored through MABS/DPM rather than migrated directly between vaults.

This is therefore more of a parallel vault cutover than an in-place migration.

You can also refer the Microsoft Reference Documents:

https://learn.microsoft.com/azure/backup/backup-azure-private-endpoints-configure-manage

https://learn.microsoft.com/azure/backup/private-endpoints

https://learn.microsoft.com/azure/backup/backup-azure-backup-faq

https://learn.microsoft.com/azure/backup/backup-azure-recovery-services-vault-overview

I hope this helps clarify the supported approach. If it helps, please consider upvoting the answer.

Regards,
Mohammad Saif

Your answer

Mohammad Saif 0 Reputation points Microsoft External Staff Moderator

2026-09-10T13:54:33.83+00:00

Hello @kartik Sarsawat ,

As you have mentioned there isn't a supported way to migrate existing MABS recovery points from an existing Recovery Services vault to a new vault and retain the backup history.

For private endpoints, the Recovery Services vault needs to be newly created and must not have had protected or registered items. Azure Backup also doesn't support moving backup data from one vault to another.

Here recommended approach is to run both vaults in parallel

Create a new Recovery Services vault and configure the private endpoint before registering MABS.

Make sure MABS is running a supported version (MABS v4 / 14.0.30.0 or later).

Register MABS with the new vault and start new protection groups/backups.

Keep the existing vault available so its current recovery points can be used during the retention period.

Once the old recovery points expire based on your retention policy, the old vault can be decommissioned.

If the security requirement requires public access to be removed immediately, there isn't a supported Azure Backup mechanism to transfer those existing recovery points into the private-endpoint vault.

Any data that must be retained outside the old vault would need to be restored through MABS/DPM rather than migrated directly between vaults.

This is therefore more of a parallel vault cutover than an in-place migration.

You can also refer the Microsoft Reference Documents:

https://learn.microsoft.com/azure/backup/backup-azure-private-endpoints-configure-manage

https://learn.microsoft.com/azure/backup/private-endpoints

https://learn.microsoft.com/azure/backup/backup-azure-backup-faq

https://learn.microsoft.com/azure/backup/backup-azure-recovery-services-vault-overview

I hope this helps clarify the supported approach. If it helps, please consider upvoting the answer.

Regards,
Mohammad Saif