Architecture and security
EIDGuard runs in a resource group you own, in your own Azure subscription. The dashboard, the jobs, the recovery points and the credentials all live there, and Vambris has no access to them. This page explains how access is separated, where your data is stored and what leaves your subscription.
How the pieces fit#
Your browser
| sign in with Microsoft Entra ID
v
+------------------- Your resource group -------------------+
| |
| Dashboard ---- starts jobs ----> Azure Automation -------+--> Microsoft Graph
| | | ^ | (your External ID
| | | | | tenants)
| v | | |
| Storage account <------------------+ Key Vault |
| (recovery points, reports, (certificates) |
| settings) |
| |
+-----------------------------------------------------------+
Dashboard ---- license check ----> Vambris (activate.vambris.com)
- You sign in to the dashboard with your workforce account. The dashboard shows recovery points and reports, saves your settings and starts jobs. It holds no Microsoft Graph permissions of its own.
- Backups, comparisons, restores and other long-running work run as Azure Automation jobs, started by a schedule or from the dashboard. A job signs in to Microsoft Graph in an External ID tenant as that tenant's backup or restore app, using a certificate from Key Vault, and writes recovery points and reports to the storage account.
- Onboarding and offboarding a tenant run in your browser with your own sign-in, directly against Microsoft Graph. The deployment never receives your token.
- The only connection to Vambris is the license check.
Identities and what they can do#
Backup and restore apps. Onboarding creates two app registrations in each External ID tenant you protect:
- EIDGuard-Backup-ReadOnly holds only read Microsoft Graph permissions. Backups and comparisons sign in as this app, so they cannot change your tenant.
- EIDGuard-Restore-ReadWrite holds the read-write permissions a restore needs. Only restores use it to change your tenant.
Both apps sign in with certificates only. The certificates are created and kept in your Key Vault, jobs read them only while they run, and only the public part of each certificate is attached to its app. There is no client secret anywhere in EIDGuard.
Dashboard sign-in. Users sign in with Microsoft Entra ID in your workforce tenant, through the EIDGuard-WebUI (<web app name>) app registration that first-run setup creates. It is a single-page application with no client secret. Only users and groups assigned the Viewer, Operator or Admin role can sign in, and the dashboard checks the caller's role on every request. See Manage access.
The dashboard's own identity holds no Microsoft Graph permissions and cannot read the private keys of the certificates in Key Vault.
Azure resources. The deployment's managed identities are given Azure roles only inside its resource group, and none can shorten or remove deletion protection. Every identity authenticates with Microsoft Entra ID, and key-based access to the storage accounts is turned off. See Permissions.
Where your data lives#
| Data | Where |
|---|---|
| Recovery points, comparison reports and restore reports | The storage account in your resource group |
| Dashboard settings, including onboarded tenants and the stored license | The same storage account. No secrets. |
| Certificates | The Key Vault in your resource group |
| Logs | A Log Analytics workspace in your subscription, kept for 30 days when EIDGuard creates it |
| Exports | A storage account you choose, written only when you start an export. See Export recovery points. |
How recovery points are protected:
- Deletion protection. Azure refuses to delete or overwrite a recovery point inside its deletion protection window, for anyone, including a subscription Owner and Vambris. The window is 1 day by default. An Admin can raise it; nobody can shorten it. See Protect recovery points from deletion.
- Retention. Recovery points older than your retention are deleted automatically: 90 days by default, and 0 keeps them forever.
- Redundancy. You choose Storage redundancy on the deployment form. Zone-redundant storage (ZRS) is the default.
Vambris receives no copy of your recovery points, settings, logs or tenant data.
Microsoft Graph does not return some data, such as passwords, client secrets, identity provider secrets, MFA registrations and branding images, so recovery points cannot contain it. See Supported resource types.
What leaves your subscription#
Apart from the license check, EIDGuard talks only to Microsoft services and to resources you own:
- Microsoft Entra ID and Microsoft Graph, to sign in and to read and (for restores) write your tenants' configuration.
- Azure Resource Manager, to manage the deployment's own resources.
- Azure Monitor, which sends alert emails to the addresses you set.
- Your export storage account, when you start an export.
The license check. The dashboard contacts https://activate.vambris.com (HTTPS, port
443) during first-run setup and then every 6 hours. It sends only the dashboard's host name
and the version of EIDGuard it is running. The request is authenticated as the
dashboard's managed identity, which identifies your workforce tenant. Nothing from your
External ID tenants is sent: no configuration, object names or counts, user data,
recovery points, settings or logs.
If the licensing service cannot be reached, backups carry on. After 7 days without contact the dashboard shows a banner and an alert email is sent, after 30 days onboarding new tenants pauses, and after 60 days scheduled backups stop. On-demand backup, restore, comparison and export are never affected. See Licensing and activation.
EIDGuard sends no telemetry: no usage or diagnostic data goes to Vambris.
For every host each part of EIDGuard needs, see Network requirements. To take Key Vault, storage and, if you choose, the dashboard off the public internet, see Private networking.