{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-351-treat-sql-backup-discovery-as-a-vm-registration-change/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-351-treat-sql-backup-discovery-as-a-vm-registration-change/", "slug": "dse-20260909-351-treat-sql-backup-discovery-as-a-vm-registration-change", "url": "https://update.dsesecurity.com/updates/dse-20260909-351-treat-sql-backup-discovery-as-a-vm-registration-change/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-351-treat-sql-backup-discovery-as-a-vm-registration-change.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-351-treat-sql-backup-discovery-as-a-vm-registration-change/" }, "title": "Treat SQL backup discovery as a VM registration change", "summary": "Starting discovery from a Recovery Services vault changes workload registration and installs backup components.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "continuity-recovery", "label": "Continuity & recovery", "alt": "Paired infrastructure paths converging on a stable recovered service.", "card_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "business-continuity", "name": "Business Continuity", "url": "https://update.dsesecurity.com/topic/business-continuity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:26:05+00:00", "modified_at": "2026-09-10T02:01:55+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 231, "potentially_affected": "SQL Server databases on Azure VMs being discovered for Recovery Services vault backup.", "dse_recommendation": "Confirm the destination vault and required service identity before starting database discovery.", "primary_source": { "name": "Back up multiple SQL Server VMs from the vault - Azure Backup | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/backup/backup-sql-server-database-azure-vms", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

During SQL database discovery, Azure Backup registers the VM with the Recovery Services vault; all databases on that registered VM can be protected only in that vault.

\n

Discovery also installs AzureBackupWindowsWorkload and creates NT Service\AzureWLBackupPluginSvc. That account performs backup and restore operations and requires SQL sysadmin permissions. The source describes using the SQL IaaS extension to obtain those permissions on Marketplace SQL Server VMs. Microsoft Learn.

\n

Applicability

\n

Identify the VM by resource group as well as name, its intended vault, existing protection, and SQL instance owners. Review the source’s connectivity and permission prerequisites before starting discovery. Do not present the action to an application owner as a passive inventory scan.

\n

DSE recommendation

\n

DSE recommends approving the VM-to-vault association before initiating discovery. Have the SQL and backup administrators agree how the required service permissions will be established and reviewed. Preserve the prior protection state and record any existing backup arrangements that need separate assessment; do not disable them merely to complete an inventory request.

\n

Verification

\n

On an authorized representative VM, inspect the resulting vault registration, workload extension, discovered databases, and service-account permissions. Compare them with the approved mapping. Treat discovery success as completion of that stage only, then separately validate the intended protection configuration and a representative recovery before calling the database protected.

\n

Official references

\n

Microsoft Learn: Back up multiple SQL Server VMs from the vault. Source retrieved September 9, 2026.

", "content_text": "Source facts\nDuring SQL database discovery, Azure Backup registers the VM with the Recovery Services vault; all databases on that registered VM can be protected only in that vault.\nDiscovery also installs AzureBackupWindowsWorkload and creates NT Service\\AzureWLBackupPluginSvc. That account performs backup and restore operations and requires SQL sysadmin permissions. The source describes using the SQL IaaS extension to obtain those permissions on Marketplace SQL Server VMs. Microsoft Learn.\nApplicability\nIdentify the VM by resource group as well as name, its intended vault, existing protection, and SQL instance owners. Review the source’s connectivity and permission prerequisites before starting discovery. Do not present the action to an application owner as a passive inventory scan.\nDSE recommendation\nDSE recommends approving the VM-to-vault association before initiating discovery. Have the SQL and backup administrators agree how the required service permissions will be established and reviewed. Preserve the prior protection state and record any existing backup arrangements that need separate assessment; do not disable them merely to complete an inventory request.\nVerification\nOn an authorized representative VM, inspect the resulting vault registration, workload extension, discovered databases, and service-account permissions. Compare them with the approved mapping. Treat discovery success as completion of that stage only, then separately validate the intended protection configuration and a representative recovery before calling the database protected.\nOfficial references\nMicrosoft Learn: Back up multiple SQL Server VMs from the vault. Source retrieved September 9, 2026.", "content_markdown": "## Source facts\n\nDuring SQL database discovery, Azure Backup registers the VM with the Recovery Services vault; all databases on that registered VM can be protected only in that vault.\n\nDiscovery also installs AzureBackupWindowsWorkload and creates NT Service\\AzureWLBackupPluginSvc. That account performs backup and restore operations and requires SQL sysadmin permissions. The source describes using the SQL IaaS extension to obtain those permissions on Marketplace SQL Server VMs. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/backup/backup-sql-server-database-azure-vms).\n\n## Applicability\n\nIdentify the VM by resource group as well as name, its intended vault, existing protection, and SQL instance owners. Review the source’s connectivity and permission prerequisites before starting discovery. Do not present the action to an application owner as a passive inventory scan.\n\n## DSE recommendation\n\nDSE recommends approving the VM-to-vault association before initiating discovery. Have the SQL and backup administrators agree how the required service permissions will be established and reviewed. Preserve the prior protection state and record any existing backup arrangements that need separate assessment; do not disable them merely to complete an inventory request.\n\n## Verification\n\nOn an authorized representative VM, inspect the resulting vault registration, workload extension, discovered databases, and service-account permissions. Compare them with the approved mapping. Treat discovery success as completion of that stage only, then separately validate the intended protection configuration and a representative recovery before calling the database protected.\n\n## Official references\n\n[Microsoft Learn: Back up multiple SQL Server VMs from the vault](https://learn.microsoft.com/en-us/azure/backup/backup-sql-server-database-azure-vms). Source retrieved September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-351-treat-sql-backup-discovery-as-a-vm-registration-change/", "url": "https://update.dsesecurity.com/updates/dse-20260909-351-treat-sql-backup-discovery-as-a-vm-registration-change/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-351-treat-sql-backup-discovery-as-a-vm-registration-change/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Treat SQL backup discovery as a VM registration change", "item": "https://update.dsesecurity.com/updates/dse-20260909-351-treat-sql-backup-discovery-as-a-vm-registration-change/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-351-treat-sql-backup-discovery-as-a-vm-registration-change/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-351-treat-sql-backup-discovery-as-a-vm-registration-change/", "url": "https://update.dsesecurity.com/updates/dse-20260909-351-treat-sql-backup-discovery-as-a-vm-registration-change/", "headline": "Treat SQL backup discovery as a VM registration change", "description": "Starting discovery from a Recovery Services vault changes workload registration and installs backup components.", "abstract": "Starting discovery from a Recovery Services vault changes workload registration and installs backup components.", "articleBody": "Source facts\nDuring SQL database discovery, Azure Backup registers the VM with the Recovery Services vault; all databases on that registered VM can be protected only in that vault.\nDiscovery also installs AzureBackupWindowsWorkload and creates NT Service\\AzureWLBackupPluginSvc. That account performs backup and restore operations and requires SQL sysadmin permissions. The source describes using the SQL IaaS extension to obtain those permissions on Marketplace SQL Server VMs. Microsoft Learn.\nApplicability\nIdentify the VM by resource group as well as name, its intended vault, existing protection, and SQL instance owners. Review the source’s connectivity and permission prerequisites before starting discovery. Do not present the action to an application owner as a passive inventory scan.\nDSE recommendation\nDSE recommends approving the VM-to-vault association before initiating discovery. Have the SQL and backup administrators agree how the required service permissions will be established and reviewed. Preserve the prior protection state and record any existing backup arrangements that need separate assessment; do not disable them merely to complete an inventory request.\nVerification\nOn an authorized representative VM, inspect the resulting vault registration, workload extension, discovered databases, and service-account permissions. Compare them with the approved mapping. Treat discovery success as completion of that stage only, then separately validate the intended protection configuration and a representative recovery before calling the database protected.\nOfficial references\nMicrosoft Learn: Back up multiple SQL Server VMs from the vault. Source retrieved September 9, 2026.", "datePublished": "2026-09-10T00:26:05+00:00", "dateModified": "2026-09-10T02:01:55+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-351-treat-sql-backup-discovery-as-a-vm-registration-change/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-351-treat-sql-backup-discovery-as-a-vm-registration-change/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Treat SQL backup discovery as a VM registration change" }, "articleSection": [ "Business Continuity", "IT" ], "keywords": [ "Business Continuity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Business Continuity", "url": "https://update.dsesecurity.com/topic/business-continuity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 231, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Back up multiple SQL Server VMs from the vault - Azure Backup | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/backup/backup-sql-server-database-azure-vms" } } ] } }