Create Site Recovery private access before registering protected items

Source facts

Microsoft’s Site Recovery private-endpoint guide states that private endpoints can be created only for a new Recovery Services vault with no items registered, so they must be created before any items are added. Creating the vault endpoint locks the vault so it isn’t accessible from networks other than those with private endpoints. A storage endpoint is separate and optional: without it, protection still succeeds while replication traffic transits Site Recovery public endpoints. Microsoft Entra ID doesn’t support private endpoints, so outbound access to it must be allowed from the secured network. Microsoft Learn.

That guide is written for Azure virtual machines. For on-premises VMware machines, Microsoft’s modernized architecture article says replication traffic goes to Azure storage public endpoints over the internet or ExpressRoute Microsoft peering, and that replicating over a site-to-site VPN from an on-premises site is supported only when using private endpoints. Microsoft Learn.

Applicability

Use this ordering check when designing a new privately connected recovery vault. Identify the vault, cache storage, replication connectivity, and identity-service access before any workload registration is scheduled. The current documentation reviewed for this update states the vault-ordering rule in the Azure virtual machine guide; for on-premises machines, confirm the current Microsoft procedure for your replication appliance before creating the vault.

DSE recommendation

Make private connectivity a creation prerequisite in the vault handoff checklist. Require separate decisions for vault access and storage-data transport, with an accountable owner for each. Do not assume that an approved vault endpoint proves the data route is private. If the vault already contains registered items, pause this setup path and review the documented restriction rather than experimenting against the existing protection inventory.

Verification

Before adding workloads, verify the vault’s registration state and endpoint approval, then test the intended replication route and identity access. Inspect the storage endpoint separately if private replication traffic is required. Record the observed destination and resolution from the actual replication path. Accept the design only when its control, data, and identity dependencies have each been accounted for.

Official references

Microsoft Learn: Replicate machines with private endpoints in Azure Site Recovery. Microsoft Learn: VMware VM disaster recovery architecture in Azure Site Recovery – Modernized. Sources reviewed October 18, 2026.