Staging storage account overview
This article describes the staging storage account that Cayosoft Guardian uses when a Forest Recovery site is deployed into customer-provided Azure resources.
What the staging storage account is
The staging storage account is an Azure Blob Storage account that you create and own. Cayosoft Guardian uses it to hand backup data and agent installers to the recovery site virtual machines.
The staging storage account is used only when Use precreated resources is selected in the recovery site settings, which is available in Cayosoft Guardian 7.4 and later.
| Content | Cayosoft Guardian-created resources (default) | Customer-provided resources |
|---|---|---|
| Storage used for backup transfer | Temporary blob storage | Staging storage account |
| Created by | Cayosoft Guardian | You |
| Location | Inside the recovery site resource group | Inside your resource group |
| Lifetime | Created and deleted with the recovery site | Permanent; survives recovery sites |
| Private endpoint support | No | Yes |
NOTE Temporary blob storage is not discontinued. It remains the default and is still used in every scenario where Cayosoft Guardian creates the Azure resources, including all recovery plans created in version 7.3 or earlier.
What Cayosoft Guardian stores in it
| Content | When Cayosoft Guardian writes it | When Cayosoft Guardian removes it |
|---|---|---|
Cayosoft Guardian Forest Recovery agent installers (.msi) |
During recovery site creation, if the files are missing or obsolete | Kept for reuse by later recoveries |
| Backup data for the domain controllers in the plan | During the recovery process | Immediately after recovery finishes, regardless of the result |
Before each recovery, Cayosoft Guardian checks whether the agent installers already exist in the staging storage account and compares their file size and version. Existing, current installers are reused, which shortens deployment time.
NOTE NOTE: No backup data is present in the staging storage account outside an active recovery process. If backup data remains after a recovery finishes, see Troubleshoot private connectivity for the staging storage account.
Concurrent recovery sites
One staging storage account can serve several recovery sites at the same time. Each recovery site writes its own instance of the backup files, so parallel restore jobs never overwrite or reuse each other's data. Cayosoft Guardian removes only the files that belong to the recovery that finished.
Planning recommendations
- Consider one staging storage account per Azure region in which you deploy recovery sites. Each virtual network that reaches the account privately needs its own private endpoint, and keeping storage close to the recovery site reduces transfer time and cross-region egress charges.
- Place the storage account in the same subscription as the recovery site and the precreated virtual network. This keeps role assignments and private endpoint management in one place.
- Size for your largest recovery. The account must hold the agent installers plus the backup data for every domain controller recovered concurrently.
- Do not store anything else in the account. Cayosoft Guardian manages the containers that it creates. It deletes backup data automatically.
- Grant the service principal the Storage Blob Data Contributor role on the account. See Permissions for Forest Recovery in Cayosoft Guardian.
Restricting network access
By default, Azure Storage accounts are reachable over a public endpoint on TCP 443. This is also how Cayosoft Guardian transfers backup data by default, because public endpoints stay reachable when private networking, VPNs, DNS, or routing are degraded during an incident.
If your security policy requires that backup data never traverse a public Azure endpoint, you can disable public network access on the staging storage account and reach it over Azure Private Link instead. This requires two private endpoints and working name resolution. See Configure Azure private endpoints for the staging storage account.
Comments
0 comments
Please sign in to leave a comment.