Export recovery points

Export copies every recovery point the deployment holds to a storage account you own, outside the deployment.

When to export#

• Before you remove EIDGuard, which deletes its resource group and the recovery points in it. See Remove EIDGuard.
• Before you offboard a tenant whose recovery points you need longer than the retention that will then apply. See Offboard a tenant.
• To keep a copy under your own controls, such as your own retention or immutability policy.

Before you export#

You need:

• The Admin role on the dashboard.
• A storage account you own, outside the deployment's resource group. It can be in another subscription of the same Microsoft Entra tenant. EIDGuard refuses the deployment's own storage accounts and any account in its resource group, because deleting that resource group is how EIDGuard is removed.
• The Storage Blob Data Contributor role on that storage account for the managed identity of the deployment's Automation account. The export uses Microsoft Entra ID only, with no access keys or shared access signatures.
• If the destination account restricts network access, it must allow the export job to reach it.
• With private networking, start the export while the worker VM is on (from 15 minutes before each scheduled backup until about 2 hours after), or power it on first. See Private networking.

Grant access to the destination#

When you enter a destination on the Export tab, the dashboard checks whether the Automation identity already has access (Checking access…, then Access granted). If it does not:

• Grant access (one click) assigns the role using your own account, which needs Owner or User Access Administrator on the storage account. If you use Privileged Identity Management, activate that role first.
• If your account cannot assign roles, the tab says "Your account can't assign roles here — grant it manually." Ask someone who can to assign the role in the storage account's Access control (IAM) to the Automation account's managed identity (the tab shows its principal ID), then select Re-check.

Role assignments can take a minute or two to apply. Until access is confirmed, the tab says "Access isn't confirmed yet — you can still start." A job that cannot write to the destination stops at once with an error.

Start an export#

1. Go to Manage > Configuration > Export.
2. In Destination storage account resource ID, paste the storage account's resource ID from its Properties page in the Azure portal.
3. In Destination container, keep eidguard-export or enter another name (3 to 63 lowercase letters, digits and single hyphens). The job creates the container, as private, if it does not exist.
4. Grant access if the tab asks for it (see above).
5. Select Start export. The tab shows "Export started — watch the job. Re-run it any time; only new or changed blobs are copied."

Only one export runs at a time.

What is copied#

The export copies every recovery point of every tenant, including offboarded tenants, with its manifest and the comparison and restore reports stored with it. The destination has the same layout as the source: a folder per tenant ID, and in it a folder per recovery point (<tenant ID>/<yyyyMMdd-HHmmss>/).

The export does not copy the dashboard's settings, the certificates in Key Vault or the logs.

Run an export again#

Exports are incremental: a re-run copies only files that are new or changed. Re-run whenever you want the destination to catch up, for example shortly before removing EIDGuard.

A backup can run during an export; if recovery points are still being written when the export finishes, the job reports it as incomplete. A very large export may also need more than one run, because Azure Automation limits how long a job can run, and a job that Azure stops may end without reporting a result. Rely on the export only once a run reports it complete.

Verify the export#

1. Open the job: select watch the job on the Export tab, or find the Export operation on Jobs.
2. Check that the job shows Completed and that the Operation log ends with "Export complete: … Your recovery points now also live in '<account>/<container>'." The Structured result shows how many files were copied, skipped and failed.
3. If the log says "Export INCOMPLETE", run the export again and wait for a run that reports complete.
4. In the Azure portal, check that the destination container holds a folder for each tenant.

Troubleshoot#

For other errors, see Troubleshooting.

Related pages#

• Remove EIDGuard
• Protect recovery points from deletion
• Permissions
• Private networking