{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-579-create-site-recovery-private-access-before-registering-protected-items/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-579-create-site-recovery-private-access-before-registering-protected-items/", "slug": "dse-20260909-579-create-site-recovery-private-access-before-registering-protected-items", "url": "https://update.dsesecurity.com/updates/dse-20260909-579-create-site-recovery-private-access-before-registering-protected-items/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-579-create-site-recovery-private-access-before-registering-protected-items.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-579-create-site-recovery-private-access-before-registering-protected-items/" }, "title": "Create Site Recovery private access before registering protected items", "summary": "At what point must private access be designed for a new Site Recovery vault, and what traffic does the vault endpoint leave separate?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "continuity-recovery", "label": "Continuity & recovery", "alt": "Paired infrastructure paths converging on a stable recovered service.", "card_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "business-continuity", "name": "Business Continuity", "url": "https://update.dsesecurity.com/topic/business-continuity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:22:17+00:00", "modified_at": "2026-10-18T22:22:11+00:00", "reviewed_on": "2026-10-18", "reading_minutes": 2, "word_count": 363, "potentially_affected": "Use this ordering check when designing a new privately connected recovery vault. Identify the vault, cache storage, replication connectivity, and identity-service access before any workload registration is scheduled.", "dse_recommendation": "Make private connectivity a creation prerequisite in the vault handoff checklist.", "primary_source": { "name": "Replicate machines with private endpoints in Azure Site Recovery - Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/site-recovery/azure-to-azure-how-to-enable-replication-private-endpoints", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Microsoft’s Site Recovery private-endpoint guide states that private endpoints can be created only for a new Recovery Services vault with no items registered, so they must be created before any items are added. Creating the vault endpoint locks the vault so it isn’t accessible from networks other than those with private endpoints. A storage endpoint is separate and optional: without it, protection still succeeds while replication traffic transits Site Recovery public endpoints. Microsoft Entra ID doesn’t support private endpoints, so outbound access to it must be allowed from the secured network. Microsoft Learn.

\n

That guide is written for Azure virtual machines. For on-premises VMware machines, Microsoft’s modernized architecture article says replication traffic goes to Azure storage public endpoints over the internet or ExpressRoute Microsoft peering, and that replicating over a site-to-site VPN from an on-premises site is supported only when using private endpoints. Microsoft Learn.

\n

Applicability

\n

Use this ordering check when designing a new privately connected recovery vault. Identify the vault, cache storage, replication connectivity, and identity-service access before any workload registration is scheduled. The current documentation reviewed for this update states the vault-ordering rule in the Azure virtual machine guide; for on-premises machines, confirm the current Microsoft procedure for your replication appliance before creating the vault.

\n

DSE recommendation

\n

Make private connectivity a creation prerequisite in the vault handoff checklist. Require separate decisions for vault access and storage-data transport, with an accountable owner for each. Do not assume that an approved vault endpoint proves the data route is private. If the vault already contains registered items, pause this setup path and review the documented restriction rather than experimenting against the existing protection inventory.

\n

Verification

\n

Before adding workloads, verify the vault’s registration state and endpoint approval, then test the intended replication route and identity access. Inspect the storage endpoint separately if private replication traffic is required. Record the observed destination and resolution from the actual replication path. Accept the design only when its control, data, and identity dependencies have each been accounted for.

\n

Official references

\n

Microsoft Learn: Replicate machines with private endpoints in Azure Site Recovery. Microsoft Learn: VMware VM disaster recovery architecture in Azure Site Recovery – Modernized. Sources reviewed October 18, 2026.

", "content_text": "Source facts\nMicrosoft’s Site Recovery private-endpoint guide states that private endpoints can be created only for a new Recovery Services vault with no items registered, so they must be created before any items are added. Creating the vault endpoint locks the vault so it isn’t accessible from networks other than those with private endpoints. A storage endpoint is separate and optional: without it, protection still succeeds while replication traffic transits Site Recovery public endpoints. Microsoft Entra ID doesn’t support private endpoints, so outbound access to it must be allowed from the secured network. Microsoft Learn.\nThat guide is written for Azure virtual machines. For on-premises VMware machines, Microsoft’s modernized architecture article says replication traffic goes to Azure storage public endpoints over the internet or ExpressRoute Microsoft peering, and that replicating over a site-to-site VPN from an on-premises site is supported only when using private endpoints. Microsoft Learn.\nApplicability\nUse this ordering check when designing a new privately connected recovery vault. Identify the vault, cache storage, replication connectivity, and identity-service access before any workload registration is scheduled. The current documentation reviewed for this update states the vault-ordering rule in the Azure virtual machine guide; for on-premises machines, confirm the current Microsoft procedure for your replication appliance before creating the vault.\nDSE recommendation\nMake private connectivity a creation prerequisite in the vault handoff checklist. Require separate decisions for vault access and storage-data transport, with an accountable owner for each. Do not assume that an approved vault endpoint proves the data route is private. If the vault already contains registered items, pause this setup path and review the documented restriction rather than experimenting against the existing protection inventory.\nVerification\nBefore adding workloads, verify the vault’s registration state and endpoint approval, then test the intended replication route and identity access. Inspect the storage endpoint separately if private replication traffic is required. Record the observed destination and resolution from the actual replication path. Accept the design only when its control, data, and identity dependencies have each been accounted for.\nOfficial references\nMicrosoft Learn: Replicate machines with private endpoints in Azure Site Recovery. Microsoft Learn: VMware VM disaster recovery architecture in Azure Site Recovery – Modernized. Sources reviewed October 18, 2026.", "content_markdown": "## Source facts\n\nMicrosoft’s Site Recovery private-endpoint guide states that private endpoints can be created only for a new Recovery Services vault with no items registered, so they must be created before any items are added. Creating the vault endpoint locks the vault so it isn’t accessible from networks other than those with private endpoints. A storage endpoint is separate and optional: without it, protection still succeeds while replication traffic transits Site Recovery public endpoints. Microsoft Entra ID doesn’t support private endpoints, so outbound access to it must be allowed from the secured network. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/site-recovery/azure-to-azure-how-to-enable-replication-private-endpoints).\n\nThat guide is written for Azure virtual machines. For on-premises VMware machines, Microsoft’s modernized architecture article says replication traffic goes to Azure storage public endpoints over the internet or ExpressRoute Microsoft peering, and that replicating over a site-to-site VPN from an on-premises site is supported only when using private endpoints. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/site-recovery/vmware-azure-architecture-modernized).\n\n## Applicability\n\nUse this ordering check when designing a new privately connected recovery vault. Identify the vault, cache storage, replication connectivity, and identity-service access before any workload registration is scheduled. The current documentation reviewed for this update states the vault-ordering rule in the Azure virtual machine guide; for on-premises machines, confirm the current Microsoft procedure for your replication appliance before creating the vault.\n\n## DSE recommendation\n\nMake private connectivity a creation prerequisite in the vault handoff checklist. Require separate decisions for vault access and storage-data transport, with an accountable owner for each. Do not assume that an approved vault endpoint proves the data route is private. If the vault already contains registered items, pause this setup path and review the documented restriction rather than experimenting against the existing protection inventory.\n\n## Verification\n\nBefore adding workloads, verify the vault’s registration state and endpoint approval, then test the intended replication route and identity access. Inspect the storage endpoint separately if private replication traffic is required. Record the observed destination and resolution from the actual replication path. Accept the design only when its control, data, and identity dependencies have each been accounted for.\n\n## Official references\n\n[Microsoft Learn: Replicate machines with private endpoints in Azure Site Recovery](https://learn.microsoft.com/en-us/azure/site-recovery/azure-to-azure-how-to-enable-replication-private-endpoints). [Microsoft Learn: VMware VM disaster recovery architecture in Azure Site Recovery – Modernized](https://learn.microsoft.com/en-us/azure/site-recovery/vmware-azure-architecture-modernized). Sources reviewed October 18, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-579-create-site-recovery-private-access-before-registering-protected-items/", "url": "https://update.dsesecurity.com/updates/dse-20260909-579-create-site-recovery-private-access-before-registering-protected-items/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-18" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-579-create-site-recovery-private-access-before-registering-protected-items/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Business Continuity", "item": "https://update.dsesecurity.com/topic/business-continuity/" }, { "@type": "ListItem", "position": 3, "name": "Create Site Recovery private access before registering protected items", "item": "https://update.dsesecurity.com/updates/dse-20260909-579-create-site-recovery-private-access-before-registering-protected-items/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-579-create-site-recovery-private-access-before-registering-protected-items/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-579-create-site-recovery-private-access-before-registering-protected-items/", "url": "https://update.dsesecurity.com/updates/dse-20260909-579-create-site-recovery-private-access-before-registering-protected-items/", "headline": "Create Site Recovery private access before registering protected items", "description": "At what point must private access be designed for a new Site Recovery vault, and what traffic does the vault endpoint leave separate?", "abstract": "At what point must private access be designed for a new Site Recovery vault, and what traffic does the vault endpoint leave separate?", "articleBody": "Source facts\nMicrosoft’s Site Recovery private-endpoint guide states that private endpoints can be created only for a new Recovery Services vault with no items registered, so they must be created before any items are added. Creating the vault endpoint locks the vault so it isn’t accessible from networks other than those with private endpoints. A storage endpoint is separate and optional: without it, protection still succeeds while replication traffic transits Site Recovery public endpoints. Microsoft Entra ID doesn’t support private endpoints, so outbound access to it must be allowed from the secured network. Microsoft Learn.\nThat guide is written for Azure virtual machines. For on-premises VMware machines, Microsoft’s modernized architecture article says replication traffic goes to Azure storage public endpoints over the internet or ExpressRoute Microsoft peering, and that replicating over a site-to-site VPN from an on-premises site is supported only when using private endpoints. Microsoft Learn.\nApplicability\nUse this ordering check when designing a new privately connected recovery vault. Identify the vault, cache storage, replication connectivity, and identity-service access before any workload registration is scheduled. The current documentation reviewed for this update states the vault-ordering rule in the Azure virtual machine guide; for on-premises machines, confirm the current Microsoft procedure for your replication appliance before creating the vault.\nDSE recommendation\nMake private connectivity a creation prerequisite in the vault handoff checklist. Require separate decisions for vault access and storage-data transport, with an accountable owner for each. Do not assume that an approved vault endpoint proves the data route is private. If the vault already contains registered items, pause this setup path and review the documented restriction rather than experimenting against the existing protection inventory.\nVerification\nBefore adding workloads, verify the vault’s registration state and endpoint approval, then test the intended replication route and identity access. Inspect the storage endpoint separately if private replication traffic is required. Record the observed destination and resolution from the actual replication path. Accept the design only when its control, data, and identity dependencies have each been accounted for.\nOfficial references\nMicrosoft Learn: Replicate machines with private endpoints in Azure Site Recovery. Microsoft Learn: VMware VM disaster recovery architecture in Azure Site Recovery – Modernized. Sources reviewed October 18, 2026.", "datePublished": "2026-09-10T00:22:17+00:00", "dateModified": "2026-10-18T22:22:11+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-579-create-site-recovery-private-access-before-registering-protected-items/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-579-create-site-recovery-private-access-before-registering-protected-items/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Create Site Recovery private access before registering protected items" }, "articleSection": [ "Business Continuity", "Networks & Infrastructure" ], "keywords": [ "Business Continuity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Business Continuity", "url": "https://update.dsesecurity.com/topic/business-continuity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 363, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Replicate machines with private endpoints in Azure Site Recovery - Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/site-recovery/azure-to-azure-how-to-enable-replication-private-endpoints" } } ] } }