Backing up databases in cloud environments is a foundational requirement for disaster recovery, compliance, and business continuity. Azure Database for PostgreSQL (Flexible Server) provides two primary backup mechanisms through the Azure Portal: Operational Backups (native automated snapshots and WAL logs for point-in-time restoration up to 35 days) and Vaulted Backups / Long-Term Retention (LTR) (managed via Azure Backup for extended compliance up to 10 years).

This guide walks through configuring, managing, and executing both backup strategies directly from the Azure Portal.

1. Understanding Azure PostgreSQL Backup Architecture

Before configuring backups, it is essential to distinguish between the two available tiers:

FeatureOperational Backups (Native)Vaulted Backups (Azure Backup LTR)
Primary ScopeFull server snapshot + Write-Ahead Logs (WAL)Long-term compliance & isolated offsite copy
Retention Window7 to 35 daysUp to 10 years
Storage IsolationStored in regional storage accountsIsolated in a dedicated Backup Vault (separate security domain)
Redundancy OptionsLRS, ZRS, or Geo-Redundant (GRS)Configurable vault redundancy (LRS / GRS)
Use CasesDay-to-day recovery, accidental edits, pre-deployment snapshotsRegulatory compliance, ransomware air-gapping, audit retention

2. Managing Operational Backups (0–35 Days)

Azure Database for PostgreSQL Flexible Server automatically executes daily storage volume snapshots and continuous transaction log backups out of the box.

Configuring Retention Period & Storage Redundancy

  1. Log in to the Azure Portal.

  2. In the top search bar, search for Azure Database for PostgreSQL flexible servers and select your server instance.

  3. Under the left-hand navigation menu, select Settings > Compute + storage.

  4. In the Backup section:

    • Backup Retention Period: Drag or enter your preferred retention window (between 7 and 35 days).

    • Backup Redundancy: Review your storage redundancy setting (Locally Redundant or Zone Redundant).

    Note: Geo-redundancy (GRS) can only be selected during initial server creation and cannot be modified post-provisioning.

  5. Click Save at the top of the pane.

Triggering an On-Demand Snapshot

If you are preparing to deploy code, execute database migrations, or make major schema modifications, create an immediate manual backup:

  1. In your PostgreSQL flexible server pane, navigate to Settings > Backup and Restore (or Overview depending on your Portal layout).

  2. Click Backup now.

  3. Enter a descriptive Backup Name (e.g., pre-migration-v2-1-0) and confirm.

3. Configuring Long-Term Retention (LTR) via Azure Backup

For compliance frameworks requiring data preservation beyond 35 days, integrate your PostgreSQL instance with an Azure Backup Vault.

Step 1: Create a Backup Vault

  1. In the Azure Portal search bar, type Backup vaults and select it.

  2. Click + Create.

  3. Under Project Details, choose your Subscription and Resource Group.

  4. Set the Vault Name (e.g., bv-postgresql-prod-eastus) and select the Region (must match the region of your PostgreSQL server).

  5. Select your desired Vault Redundancy (Locally redundant or Geo-redundant).

  6. Click Review + create, then create.

Step 2: Define a Backup Policy

  1. Open your newly created Backup Vault.

  2. Under Policies, select Backup policies, then click + Add.

  3. Set Datasource type to Azure Database for PostgreSQL flexible servers.

  4. Provide a Policy Name (e.g., daily-weekly-postgresql-policy).

  5. On the Schedule + retention tab:

    • Configure the Backup Frequency (Weekly, Monthly, or Yearly).

    • Define retention durations (e.g., retain weekly backups for 12 weeks, annual backups for 5 years).

  6. Click Create.

Step 3: Enable Protection on the Server

  1. Return to your Azure Database for PostgreSQL flexible server instance.

  2. On the left menu under Settings, select LTR (Vaulted Backups).

  3. Click + Configure protection (or Configure Backup).

  4. Choose your Backup Vault and the Backup Policy created in the previous step.

  5. Grant RBAC Permissions:

    • Azure Backup requires Managed Identity permissions on your PostgreSQL server to execute dumps.

    • The Portal will run an automated validation check. If roles are missing, click Assign missing roles directly in the configuration wizard.

  6. Once permission status shows Success, click Configure backup to complete registration.

4. Monitoring Backup Health and Storage

To ensure backups complete successfully and do not cause unforeseen storage costs:

Best Practices Checklist

  1. Test Point-In-Time Restoration Periodically: Validate recovery objectives (RTO/RPO) by staging point-in-time restores into a sandbox environment quarterly.

  2. Align Retention with Regulatory Requirements: Maintain 7–14 days in the operational tier for cost efficiency, delegating multi-year retention entirely to Vaulted Backups.

  3. Lock Backup Vaults Against Accidental Deletion: Enable Resource Locks (CanNotDelete) and Soft Delete / Immutability on your Backup Vaults to safeguard against accidental deletion or ransomware threats.