Treat SQL backup discovery as a VM registration change

Source facts

During SQL database discovery, Azure Backup registers the VM with the Recovery Services vault; all databases on that registered VM can be protected only in that vault.

Discovery also installs AzureBackupWindowsWorkload and creates NT Service\AzureWLBackupPluginSvc. That account performs backup and restore operations and requires SQL sysadmin permissions. The source describes using the SQL IaaS extension to obtain those permissions on Marketplace SQL Server VMs. Microsoft Learn.

Applicability

Identify the VM by resource group as well as name, its intended vault, existing protection, and SQL instance owners. Review the source’s connectivity and permission prerequisites before starting discovery. Do not present the action to an application owner as a passive inventory scan.

DSE recommendation

DSE recommends approving the VM-to-vault association before initiating discovery. Have the SQL and backup administrators agree how the required service permissions will be established and reviewed. Preserve the prior protection state and record any existing backup arrangements that need separate assessment; do not disable them merely to complete an inventory request.

Verification

On an authorized representative VM, inspect the resulting vault registration, workload extension, discovered databases, and service-account permissions. Compare them with the approved mapping. Treat discovery success as completion of that stage only, then separately validate the intended protection configuration and a representative recovery before calling the database protected.

Official references

Microsoft Learn: Back up multiple SQL Server VMs from the vault. Source retrieved September 9, 2026.