Ransomware attackers specifically target and attempt to destroy backup systems to increase the probability of payment. Hardening your system is critical. Please ensure you have reviewed your platform security using the Security Hardening Checklist
Cohesity

COHESITY Documentation

Explore our documentation to get started, discover products & new features, access troubleshooting guides, register sources, platforms support.

Products
Data Security Alliance
Visit Cohesity.com
Demos
Support
Blogs
Developers
Partner Portals
Cohesity Community
© 2026 Cohesity, Inc. All Rights Reserved.
Terms of Use|
Privacy Policy|
Legal|
  1. Home
  2. Veritas NetBackup™ CloudPoint Install and Upgrade Guide
  3. Section I. CloudPoint installation and configuration
  4. CloudPoint cloud plug-ins
  5. Microsoft Azure plug-in configuration notes
Veritas NetBackup™ CloudPoint Install and Upgrade Guide

Microsoft Azure plug-in configuration notes

The Microsoft Azure plug-in lets you create, delete, and restore snapshots at the virtual machine level and the managed disk level.

Before you configure the Azure plug-in, complete the following preparatory steps:

  • Use the Microsoft Azure Portal to create an Azure Active Directory (AAD) application for the Azure plug-in.

  • Assign the service principal to a role to access resources.

For more details, follow the steps in the following Azure documentation:

https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-group-create-service-principal-portal

Table: Microsoft Azure plug-in configuration parameters

CloudPoint configuration parameter

Microsoft equivalent term and description

Tenant ID

The ID of the AAD directory in which you created the application.

Client ID

The application ID.

Secret Key

The secret key of the application.

Regions

One or more regions in which to discover cloud assets.

Note:

If you configure a government cloud, select US Gov Arizona, US Gov Texas US, or Gov Virginia.

Resource Group prefix

The string with which you want to append all the resources in a resource group.

Protect assets even if prefixed Resource Groups are not found

The check box determines whether the assets are protected if they are not associated to any resource groups. The prefixed Resource Group must exist in the same region as the source asset's Resource Group.

Azure plug-in considerations and limitations

Consider the following before you configure the Azure plug-in:

  • The current release of the plug-in does not support snapshots of blobs.

  • CloudPoint currently only supports creating and restoring snapshots of Azure-managed disks and the virtual machines that are backed up by managed disks.

  • CloudPoint does not support snapshot tagging for assets in the Azure cloud environment. Even though Azure supports a maximum of up to 15 tags per snapshot, you cannot assign tags to snapshots, either manually using the APIs or via a protection policy, using CloudPoint.

  • CloudPoint does not support snapshot operations for Ultra SSD disk types in an Azure environment. Even though CloudPoint discovers the ultra disks successfully, any snapshot operation that is triggered on such disk assets fails with the following error:

    Snapshots of UltraSSD_LRS disks are not supported. 
  • If you are creating multiple configurations for the same plug-in, ensure that they manage assets from different Tenant IDs. Two or more plug-in configurations should not manage the same set of cloud assets simultaneously.

    CloudPoint currently does not block you from creating such a configuration. If there is an overlap of cloud assets between plug-in configurations, you may have to resolve the configuration issue by deleting such plug-in configurations and adding them again, ensuring that there are no overlapping assets.

    However, CloudPoint does not allow you to delete a plug-in configuration if there are any snapshots associated with the assets in that configuration.

  • When you create snapshots, the Azure plug-in creates an Azure-specific lock object on each of the snapshots. The snapshots are locked to prevent unintended deletion either from the Azure console or from an Azure CLI or API call. The lock object has the same name as that of the snapshot. The lock object also includes a field named "notes" that contains the ID of the corresponding VM or asset that the snapshot belongs to.

    You must ensure that the "notes" field in the snapshot lock objects is not modified or deleted. Doing so will disassociate the snapshot from its corresponding original asset. It will also disable the Overwrite existing restore option for the snapshots that are created in CloudPoint 2.2.1 or later.

    The Azure plug-in uses the ID from the "notes" fields of the lock objects to associate the snapshots with the instances whose source disks are either replaced or deleted, for example, as part of a in-place restore operation. Therefore, if you have upgraded to NetBackup 2.2.1 release, then the Overwrite existing restore option will not be available for the snapshots that are created using an older version of CloudPoint.

  • Azure plug-in supports the following GovCloud (US) regions:

    • US Gov Arizona

    • US Gov Texas

    • US Gov Virginia

  • CloudPoint Azure plug-in does not support the following Azure regions:

    Location

    Region

    US

    • US DoD Central

    • US DoD East

    • US Sec West

    China

    CloudPoint does not support any regions in China.

    • China East

    • China East 2

    • China North

    • China North 2

    Germany

    • Germany Central (Sovereign)

    • Germany Northeast (Sovereign)

  • Microsoft Azure gen2 type of virtual machines are not supported. Ensure that you use a gen1 type image to create a VM.

  • CloudPoint does not support application consistent snapshots and granular file restores for Windows systems with virtual disks or storage spaces that are created from a storage pool. If a Microsoft SQL server snapshot job uses disks from a storage pool, the job fails with an error. But if a snapshot job for virtual machine which is in a connected state is triggered, the job might be successful. In this case, the file system quiescing and indexing is skipped. The restore job for such an individual disk to original location also fails. In this condition, the host might move to an unrecoverable state and requires a manual recovery.

Feedback

Was this page helpful?
Previous

Preparing the GCP service account for plug-in configuration

Next

Configuring permissions on Microsoft Azure

Feedback

Was this page helpful?