Azure Backup vs Veeam on Azure: Which DR Strategy for Malaysian SMEs?

Small and medium enterprises in Malaysia face a specific challenge: they need enterprise-grade disaster recovery on a budget, but the options can be overwhelming. Azure Backup and Veeam on Azure are the two most common paths, and while both protect your data, they serve fundamentally different use cases, budgets, and operational models. Getting this choice wrong means either overpaying for capabilities you don't need or — worse — discovering during an actual outage that your backup solution can't recover what matters.

This article provides a practical, Malaysia-specific comparison to help you decide.

The Malaysian SME DR Reality

Before comparing tools, it is worth understanding the constraints most Malaysian SMEs operate under:

• IT teams of 1-3 people — there is no dedicated backup administrator. Whoever sets up backups also manages the network, the ERP system, and the office Wi-Fi.
• PDPA compliance is mandatory but enforcement is growing — Malaysia's Personal Data Protection Act 2010 applies if you process personal data, even if you are a small business. Regulators are becoming more active.
• Hybrid infrastructure is the norm — most SMEs run some workloads on-premises (ERP, accounting) and some in Azure (web apps, email, file shares). The backup solution must bridge both.
• Ringgit sensitivity — every dollar spent on backup is a dollar not spent on growth. The total cost of ownership must be predictable and justifiable.

With these constraints in mind, let us examine the two contending solutions.

Azure Backup: The Native Option

Azure Backup is Microsoft's fully managed backup-as-a-service. It is designed to protect Azure-native workloads with minimal configuration and zero infrastructure to maintain.

What It Covers

Azure Backup natively protects:

• Azure VMs — full VM-level backups with application-consistent snapshots for Windows (VSS) and file-consistent for Linux.
• SQL Server on Azure VMs — log, differential, and full backups with point-in-time restore.
• SAP HANA on Azure VMs — full support including backint integration.
• Azure File Shares — share-level snapshots with soft delete.
• On-premises Windows servers — via the Microsoft Azure Recovery Services (MARS) agent.
• Azure Blob storage — operational backup with point-in-time restore for supported blob scenarios.
• Azure Database for PostgreSQL — vaulted backup support is available for supported PostgreSQL deployments; confirm the exact server type and region before relying on it for long-term retention.

Strengths in the Malaysian Context

Zero infrastructure overhead. You do not need to provision, patch, or monitor any backup VMs. The backup engine runs on Microsoft infrastructure. For an IT team of two, this is invaluable — there is simply no time to manage yet another server.

Pay-per-use pricing. Azure Backup pricing is based on protected instances plus backup storage consumed. There are no upfront commitments, but the actual monthly cost depends on instance size, retention, storage redundancy, archive tier usage, and whether cross-region restore is enabled.

Built-in long-term retention. Azure Backup stores backup data in Microsoft-managed backup storage and supports archive tiering for eligible long-retention recovery points. Use Azure Pricing Calculator for the selected region, redundancy, retention, and archive assumptions rather than relying on a fixed RM/GB estimate.

Cross-Region Restore (CRR). If you enable geo-redundant storage and CRR for supported Azure VM backups, Azure Backup lets you restore vault-tier recovery points in the secondary Azure paired region. Do not assume an arbitrary secondary region for new or unpaired regions; confirm CRR support and the available target region for the selected Azure region before using it as the DR design basis.

Soft delete protection. Accidentally deleting a backup vault does not lose your data — soft delete holds deleted backup data for 14 days. This prevents the most common data loss scenario: human error.

Limitations You Must Know

Azure Backup is not a universal backup platform. The key gaps:

• No application-aware backup for non-Microsoft applications. Oracle, MySQL (self-managed), PostgreSQL (self-managed), and custom applications on Linux are backed up at the file or VM level only. You cannot do log-truncation-aware Oracle backups through Azure Backup alone.
• Limited granularity. Restore is VM-level or file-level (for Windows). There is no item-level restore for Exchange, SharePoint, or third-party applications without additional tooling.
• No built-in cross-cloud restore. You cannot natively restore an Azure Backup to AWS, GCP, or an on-premises hypervisor other than Hyper-V.
• Immutable vault support available. Azure Backup now supports immutable vault settings with WORM (write once, read many) storage. You can enable and lock immutability on Recovery Services vaults to prevent any operations that could lead to loss of recovery points — even administrators cannot delete backup data once the vault is locked. However, immutability applies at the vault level, not per individual backup item, and operational backups (blobs, files, disks) are not covered. For granular per-item immutability policies, Veeam still offers more flexibility.

Veeam on Azure: The Enterprise Option

Veeam Backup for Microsoft Azure is a purpose-built solution for protecting Azure workloads with the full Veeam feature set. It runs as a marketplace application in your Azure subscription.

What It Covers

Veeam on Azure protects:

• Azure VMs (Windows and Linux) — agentless, application-consistent backups.
• Azure SQL Database and Managed Instance — native integration for database backups.
• Azure Files, Azure SQL, Cosmos DB, and selected Azure-native resources — coverage depends on the Veeam Backup for Microsoft Azure version and licensed edition.
• Cross-subscription and separate repository designs — useful when you need backup storage separated from the production subscription or management boundary.
• Hybrid scenarios — unified management with on-premises Veeam deployments via a single console.

Strengths for Malaysian SMEs with Complex Requirements

True immutability. Veeam supports Azure Blob immutability (WORM policy) at the storage account level. Once a backup is written to immutable storage, not even an administrator with full Azure rights can modify or delete it for the retention period. This is the gold standard for ransomware protection. For Malaysian SMEs worried about the rising threat of ransomware attacks targeting local businesses — including the 2024 wave targeting Malaysian manufacturing firms — this is a significant advantage.

Application-aware and scriptable processing. Veeam supports guest processing and application-aware options for supported workloads, and can use pre-freeze/post-thaw scripting patterns for Linux or custom applications. Treat Oracle, MySQL, PostgreSQL, and bespoke application consistency as design items to validate, not as automatic coverage for every deployment.

Cross-account restore. You can back up production VMs in one Azure subscription and restore them into a completely separate subscription or account. This protects against the scenario where an attacker compromises your production subscription — your backups live in a separate trust boundary.

Unified hybrid platform. If your organization runs Veeam on-premises today (common among Malaysian enterprises that have been using Veeam for years), Veeam Backup for Azure integrates into the same management console. One pane of glass for on-premises, Azure, and even AWS backup. This reduces training overhead and operational complexity.

Free edition cap. Veeam Backup for Microsoft Azure Free Edition protects up to 10 instances free of charge, subject to edition limitations. You still pay for the Azure infrastructure, repositories, worker resources, and storage consumed.

Limitations

Infrastructure overhead. Veeam deploys worker VMs in your subscription to orchestrate backups. A typical deployment requires at least one worker VM (Standard_B2s or similar, approximately RM 200-300/month) plus storage accounts for backup data. This is operational overhead that Azure Backup does not require.

Higher learning curve. Veeam's feature depth means more configuration options — more places to make mistakes. Policies, repositories, proxies, gateways, and backup chains all need to be understood and maintained.

Licensing complexity. Veeam licensing has moved to a per-workload instance model with subscription tiers. Understanding what you are paying for — especially across hybrid environments — requires careful reading of the licensing terms. The Free Edition has documented feature limitations, including limitations around certain advanced capabilities such as Azure Files indexing, virtual network configuration backup, and Cosmos DB protection. Validate the current licensing guide before assuming a feature is included.

Real Cost Comparison: A Malaysian SME Scenario

The figures below are an illustrative planning scenario, not a vendor quote. Confirm current prices in Azure Pricing Calculator, Veeam licensing guidance, and the selected Azure region before making a purchasing decision.

Let us model a typical Malaysian SME with:

• 6 Azure VMs (4 Windows, 2 Linux) — 2-4 vCPUs each
• 1 SQL Server Standard instance on Azure VM
• 500 GB of protected data across all VMs
• Retention policy: 30 daily, 12 monthly, 3 yearly
• 1 TB of Azure File Shares

Azure Backup Costs (Monthly)

Veeam on Azure Costs (Monthly)

The difference is approximately RM 70/month — not enough to be the deciding factor for most SMEs, but enough that it compounds over three years (approximately RM 2,500).

The Hybrid Approach Many SMEs Miss

The most pragmatic strategy for Malaysian SMEs is often a hybrid approach:

1. Azure Backup for routine protection of all Azure VMs and File Shares. Set it up in one afternoon, configure CRR, and forget about it.
2. Veeam for critical workloads only — the single SQL Server or ERP database that drives the business. Protect it with application-aware processing and immutable storage.

This gives you the simplicity of Azure Backup for 80% of your workloads and the enterprise resilience of Veeam for the 20% that genuinely require it. Total cost: approximately RM 260/month, which is only RM 50 more than Azure Backup alone.

Common Pitfalls to Avoid

Pitfall 1: Never testing restores. Both Azure Backup and Veeam can fail in subtle ways — corrupted restore points, missing network permissions, changed firewall rules. Run a quarterly restore test using a separate Azure subscription or isolated VNet. Schedule it on your calendar now.

Pitfall 2: Choosing by feature count instead of workflow. The tool with the longest feature list is not the tool you will actually use every week. If your team is comfortable with Azure Portal and PowerShell, Azure Backup will generate fewer operational surprises. If you already have Veeam on-premises, extending to Azure is the lower-risk choice.

Pitfall 3: Ignoring outbound data transfer costs. Restoring large backups from Azure to on-premises or to another region incurs egress charges at approximately RM 0.50/GB (Azure egress from Asia to internet at $0.12/GB). A 500 GB restore could cost approximately RM 250 in egress alone. Account for this in your DR budget.

Pitfall 4: Underestimating RPO with Azure Backup. Azure Backup for VMs runs once per day by default. If your SQL database grows by 20 GB daily, the RPO is 24 hours. For many SMEs this is acceptable. For e-commerce platforms processing orders around the clock, it may not be. Veeam can support more frequent policy schedules for selected workloads, but the achievable RPO depends on workload type, snapshot frequency, repository design, and operational constraints.

Pitfall 5: Overprovisioning Veeam infrastructure. The Veeam worker VM sizing guide tends to over-recommend. Start with the vendor sizing guidance and a small pilot, then scale worker resources only after measuring backup window, restore time, and repository throughput.

Step-by-Step: Setting Up a Basic Azure Backup Policy

# Connect to Azure
Connect-AzAccount -Subscription "your-subscription-id"

# Create a Recovery Services Vault
$vault = New-AzRecoveryServicesVault `
    -ResourceGroupName "RG-Backup" `
    -Name "Vault-MalaysiaWest" `
    -Location "malaysiawest"

# Set storage replication to Geo-Redundant
Set-AzRecoveryServicesBackupProperty `
    -Vault $vault `
    -BackupStorageRedundancy GeoRedundant

# Configure a daily backup policy with 30-day retention
$policy = Get-AzRecoveryServicesBackupProtectionPolicy `
    -VaultId $vault.ID `
    -WorkloadType "AzureVM"
$schPolicy = Get-AzRecoveryServicesBackupSchedulePolicyObject `
    -WorkloadType "AzureVM"
$retPolicy = Get-AzRecoveryServicesBackupRetentionPolicyObject `
    -WorkloadType "AzureVM"
$retPolicy.DailySchedule.DurationCountInDays = 30

New-AzRecoveryServicesBackupProtectionPolicy `
    -VaultId $vault.ID `
    -Name "Daily30Day-Retention" `
    -WorkloadType "AzureVM" `
    -SchedulePolicy $schPolicy `
    -RetentionPolicy $retPolicy

Step-by-Step: Deploying Veeam Backup for Azure

# Deploy Veeam Backup for Azure via Azure Marketplace
# Step 1: Open https://portal.azure.com/#create/veeam.veeam-backup-for-azure
# Step 2: Select the resource group and VM size for the worker
# Step 3: Configure storage and networking
# Step 4: Deploy and connect via Veeam UI
#
# For automated deployment, see the official Veeam documentation:
# https://helpcenter.veeam.com/docs/vbazure/guide/deploying_vb.html

# After deployment, configure via Veeam UI:
# 1. Add Azure account credentials
# 2. Create backup policy with immutable storage target
# 3. Select VMs to protect
# 4. Enable application-aware processing

PDPA Compliance: What Both Solutions Offer

Under Malaysia's PDPA, data principals have rights to access, correct, and withdraw consent for their personal data. For backup and DR, the key compliance requirements are:

• Data residency must be explicitly configured — PDPA does not make a backup tool compliant by default. Select Malaysia West where residency is required, understand whether geo-redundancy or CRR sends data to another jurisdiction, and confirm any cross-border transfer basis with legal counsel.
• Data lifecycle must be governed — backup retention, legal hold, immutability, and deletion workflows must be aligned with privacy obligations and business recovery requirements. Do not promise instant deletion if immutable retention is enabled.
• Data must be protected from unauthorized access — use Azure platform encryption, role-based access control, MFA, private endpoints where appropriate, key management, and operational monitoring. Tool configuration matters more than product selection alone.

For a deeper dive into PDPA requirements for cloud backup, consult Jabatan Perlindungan Data Peribadi (JDP/PDP) and your legal advisor. No backup tool substitutes for a proper data governance framework.

Conclusion: Making the Call

Choose Azure Backup if: all your workloads are Azure-native, you have fewer than 10 VMs, your budget is tight, and you want set-and-forget protection. It is the sensible default for most Malaysian SMEs.

Choose Veeam on Azure if: you run hybrid infrastructure, need immutable backups for ransomware protection, must back up non-Microsoft databases, or already use Veeam on-premises. The additional complexity is justified by the additional protection.

Consider the hybrid approach if: you want the best of both — Azure Backup for broad coverage, Veeam for critical workloads. It keeps complexity manageable while providing enterprise-grade protection where it matters most.

Key Takeaways

1. Azure Backup is the sensible default — fully managed, pay-per-use, covers 80% of scenarios. Start here.
2. Veeam provides enterprise-grade protection — immutability, application-aware, cross-account restore.
3. The cost difference may be small or material depending on retention and storage design — treat the RM figures above as a worked example, not a quote.
4. Test your restores quarterly — a backup is only as good as its last successful recovery.
5. The hybrid approach works well — Azure Backup for broad coverage, Veeam for critical workloads.

Backup and DR architecture is one of the areas where I see Malaysian SMEs either overpaying or under-protecting. If you want a second pair of eyes on your DR strategy — whether Azure-native, Veeam-based, or hybrid — I review these setups regularly. Message me on LinkedIn.