Learn Veeam - Cloud & Hybrid Backup

#Introduction

In episode 18 we built a SOBR with a capacity tier toward object storage; the natural next step is to bring the whole strategy to the cloud. In episode 19 we cover cloud & hybrid backup — backing up to cloud object storage (AWS/Azure/GCP and S3-compatible), Veeam Cloud Connect through a service provider (VCSP), Azure VM backups, then weaving everything into a hybrid 3-2-1 pattern with off-site copies and DR to cloud.

The end goal is simple: an on-prem environment that no longer depends on a single physical location.

#Backing Up to Cloud Object Storage

#AWS / Azure / GCP and S3-Compatible

Object storage as a capacity tier is already familiar (episode 18). Here, cloud buckets become the primary target — not just a place to offload old data. The process is the same: create the bucket, prepare credentials with minimal rights, then register it via Backup Infrastructure → Backup Repositories:

$cred = Get-VBRCredential -Name "AWS-S3"
Add-VBRBackupRepository -Name "AWS-Object" -Type S3Compatible `
    -Folder "veeam/prod" -Credentials $cred -EncryptionEnabled $true

Provider options:

• AWS S3 — the de facto standard; supports Object Lock (episode 13) and lifecycle to Glacier.
• Azure Blob — Hot/Cool/Archive tiers; natural for environments already on Azure.
• Google Cloud Storage — storage classes and integrated lifecycle policies.
• Other S3-compatible — Wasabi, MinIO, Backblaze B2, Cloudflare R2; free of vendor lock-in and often more economical.

#Azure VM Backup

For VMs living in Azure, there are two official paths:

1. Veeam Backup for Microsoft Azure — native backup via the Azure API, including disk snapshots, without an agent inside the VM.
2. Veeam Agent for Windows/Linux — installed inside the Azure VM; the resulting backups go to a VBR repository (on-prem or object storage).

v13 expands cloud integration: Azure Blob can be a direct repository and restore points can be replicated across regions. A practical pattern: agent in an Azure VM → Azure blob → either an off-site copy for on-prem, or the only copy for workloads that are already all-in cloud.

#Veeam Cloud Connect

#The Service Provider Model (VCSP)

Veeam Cloud Connect connects your VBR to a service provider licensed under VCSP (Veeam Cloud & Service Provider). Instead of building a second data center, you "rent" backup/replication capacity through a Cloud Connect Gateway — a secure outbound connection (port 6180, episode 14) without needing a site-to-site VPN:

Add-VBRServiceProvider -Name "VCSP-Nexus" `
    -Address "cloud.nexus.example:6180" -Credentials $cred

Add it via Backup Infrastructure → Service Providers. Once connected, two services are available:

• Cloud Repository — a repository on the provider's side; perfect for off-site backup copies.
• Cloud Replication — VM replicas on the provider's infrastructure; DR-as-a-Service without your own hardware.

#Provider Considerations

• No capex for a second location; opex cost per GB/month.
• Built-in TLS encryption and bandwidth throttling controlled from the client side.
• Data lives in the provider's hands — verify SLA, retention, and data location (compliance, episode 15).

#Hybrid: 3-2-1 Off-Site and DR to Cloud

#Off-Site Copies via Cloud

The 3-2-1 rule (episode 7) requires one off-site copy — and the cloud is the easiest way to meet it. Two patterns:

• Backup Copy Job to a provider's Cloud Repository — periodic, with retention separate from the primary.
• SOBR capacity tier to cloud object storage (episode 18) — automatic policy-based offload.

Primary repo (on-prem)  ──▶ Backup Copy Job ──▶ Cloud Repository (provider)
            ── or ──
SOBR performance tier  ──▶ capacity tier ──▶ Cloud object storage

#DR to Cloud

Backups in the cloud are only half the story; DR means being able to recover in the cloud when on-prem is down:

• Instant Recovery from cloud — run VMs directly from backups in object storage/cloud repos (episode 8).
• Cloud Connect Replication — failover to the provider's infrastructure with a failover plan (episode 9).
• Restore to Azure/AWS — moving workloads from on-prem to the cloud when needed.

#Verification

After this episode, make sure:

• Cloud object storage is registered (AWS/Azure/GCP/S3-compatible) with encryption active.
• Azure VMs are backed up (Veeam Backup for Microsoft Azure or an agent).
• The Cloud Connect service provider is connected; the cloud repository is active.
• A backup copy job or capacity tier copies data off-site.
• One Instant Recovery test from the cloud succeeded.

#Closing

Key takeaways:

• Cloud object storage (AWS/Azure/GCP/S3-compatible) can be a primary repository, not just a capacity tier.
• Azure VMs are backed up via Veeam Backup for Microsoft Azure or an agent inside the VM.
• Veeam Cloud Connect rents backup/replication capacity through a VCSP service provider.
• 3-2-1 off-site: a Backup Copy Job to a cloud repo or a SOBR capacity tier.
• DR to cloud must be tested — a failover plan without drills is just hope.

In the next episode, episode 20, we will cover monitoring & reporting — Veeam ONE (alarms, AI anomaly detection), status from the VBR console, compliance reports (backup job success, retention), and alerting via email/SNMP. Your infrastructure will become measurable and observable!