Azure Resiliency Gets Real — Availability Zone Drills, Zonal Recovery Orchestration

Azure Resiliency, launched in June 2026, is the first platform-native toolset for validating Availability Zone resilience. Before this, testing AZ failover meant either hoping nothing broke in production or building expensive custom simulation environments. Now Azure provides built-in AZ Down Drills, Zonal Resiliency Goals with AI-powered recommendations, and automated Recovery Orchestration Plans.

For Malaysian enterprises that deployed across Availability Zones in Malaysia West but never actually tested failover — which is most of them — this changes the game.

What Azure Resiliency Actually Provides

Availability Zone Down Drills

The most significant feature: you can simulate an AZ outage for specific service groups without impacting production traffic.

How it works:

1. Define a "service group" — a logical collection of Azure resources that must survive an AZ failure together

2. Select the AZ to simulate down

3. Azure Resiliency blocks traffic to the selected resources in the target AZ

4. Monitor whether your remaining resources in other AZs absorb the load

5. Azure measures recovery time and reports actual RTO

Key difference from Chaos Studio: Azure Chaos Studio disrupts individual resources (kill a VM, block a network port). Azure Resiliency simulates AZ-level failure — an entire availability zone going dark. This tests the architectural resilience of your multi-AZ deployment, not just individual component fault tolerance.

Example service group definition:

# Create a service group for your web application tier
az rest --method put \
  --url "https://management.azure.com/subscriptions/{sub}/resourceGroups/{rg}/providers/Microsoft.Resiliency/serviceGroups/web-app-tier?api-version=2026-01-01" \
  --body '{
    "properties": {
      "members": [
        "/subscriptions/{sub}/resourceGroups/{rg}/providers/Microsoft.Compute/virtualMachines/web-vm-1",
        "/subscriptions/{sub}/resourceGroups/{rg}/providers/Microsoft.Network/loadBalancers/web-lb",
        "/subscriptions/{sub}/resourceGroups/{rg}/providers/Microsoft.Network/applicationGateways/web-agw"
      ]
    }

Zonal Resiliency Goals

Azure Resiliency assesses your resource group or subscription against defined resiliency goals:

Built-in goals:

  • All production VMs are deployed across 2+ AZs
  • Load balancers distribute traffic across AZs
  • Managed disks use zone-redundant storage (ZRS)
  • Databases have cross-AZ replicas
  • Storage accounts use GRS or ZRS

AI Resiliency Agent: An AI agent that analyzes your deployment, identifies gaps, and provides cost-aware recommendations. For example: "Your web VMs are single-AZ. Deploying a second VM in AZ2 would cost $0.096/hour and eliminate this single point of failure."

Cost-aware recommendations are critical: Many enterprises skip AZ deployment because they assume the cost is prohibitive. The AI agent shows the actual cost difference — often 10-20% more than single-AZ, not 2x as expensive.

Recovery Orchestration Plans

Automated recovery plans that execute across multiple resource types:

Supported resources:

  • Virtual Machines (with custom script extensions)
  • Azure SQL Database (failover groups)
  • Cosmos DB (multi-region failover)
  • Azure Kubernetes Service (node pool redistribution)
  • Azure Storage (failover to secondary region)

Plan structure:

Recovery Plan: WebApp-Failover
├── Step 1: Verify source AZ is degraded
├── Step 2: Start VMs in target AZ (parallel)
├── Step 3: Wait for VM health checks
├── Step 4: Update load balancer backend pool
├── Step 5: Trigger SQL failover group
├── Step 6: Verify application health

Custom scripts: Each step can run Azure CLI commands, PowerShell scripts, or Azure Automation runbooks. This handles application-specific recovery logic that platform-native failover does not cover.

The Malaysian Enterprise Context

Malaysia West AZ Availability

Malaysia West launched with Availability Zones, but not all services are zone-redundant. Before using Azure Resiliency, verify:

# Check zone-redundant services in Malaysia West
az provider show \
  --namespace Microsoft.Compute \
  --query "resourceTypes[].zoneMappings" \

Common single-AZ gaps in Malaysia West:

  • Some VM series may not be available in all 3 AZs
  • Certain managed disk SKUs may not support ZRS
  • Some Azure PaaS services may not be zone-redundant at launch

Verification approach: Before running AZ drills, confirm that your critical resources actually span multiple AZs. An AZ drill against single-AZ resources will cause an actual outage, not a simulation.

PDPA and DR Testing

Malaysia's PDPA requires organizations to implement measures to prevent unauthorized access, disclosure, or loss of personal data. DR testing is an implicit requirement — you cannot claim compliance if you have never validated your recovery procedures.

Azure Resiliency provides an audit trail of AZ drills, including:

  • Which resources were affected
  • Actual recovery time achieved
  • Resources that failed to recover
  • Recommendations for improvement

This documentation supports PDPA compliance audits by demonstrating that DR procedures are tested, not just documented.

Cost of Resiliency

Azure Resiliency itself has no additional cost — it is included in your Azure subscription. The cost is in the underlying infrastructure:

| Component | Single-AZ Cost | Multi-AZ Cost | Difference |

|-----------|---------------|---------------|------------|

| D2s_v5 VM (×2) | $0.192/hr | $0.192/hr (2 AZs) | 0% |

| ZRS Managed Disk | $0.076/GB/mo | $0.095/GB/mo | +25% |

| Zone-redundant Load Balancer | $0.025/hr | $0.025/hr | 0% |

| SQL failover group | Single: $0.34/hr | Paired: $0.68/hr | +100% |

Key insight: The cost of AZ resilience is primarily in database replication, not compute. VMs and load balancers have minimal cost difference; the real investment is in database zone redundancy.

Practical AZ Drill Checklist

Pre-Drill

1. Map your service groups. Identify which resources form a logical unit and must survive AZ failure together.

2. Verify multi-AZ deployment. Confirm all critical resources exist in 2+ AZs.

3. Set up monitoring. Ensure Azure Monitor alerts are configured for the target resources.

4. Notify stakeholders. Even though the drill is simulated, notify teams that monitoring may show anomalies.

5. Define success criteria. What RTO are you testing against? 5 minutes? 30 minutes? 1 hour?

During Drill

1. Start the drill. Use Azure Portal or CLI to initiate the AZ Down Drill.

2. Monitor in real-time. Watch Azure Monitor dashboards for resource health, traffic distribution, and error rates.

3. Document observations. Note any unexpected behavior — failover delays, error spikes, capacity issues.

4. Measure actual RTO. How long did it take for the application to fully recover in the target AZ?

Post-Drill

1. Compare actual vs. target RTO. Did recovery meet your SLA?

2. Identify gaps. Which resources failed to recover? Which took longer than expected?

3. Update recovery plans. Fix any issues discovered during the drill.

4. Schedule recurring drills. Azure Resiliency supports scheduled drills — automate monthly or quarterly AZ failover tests.

5. Document for compliance. Archive drill results for PDPA and internal audit purposes.

Integration with Existing DR Strategy

Azure Resiliency complements (does not replace) Azure Site Recovery:

| Capability | Azure Resiliency | Azure Site Recovery |

|-----------|-----------------|-------------------|

| Scope | AZ failover (same region) | Cross-region failover |

| Simulation | Non-disruptive drills | Test failover (isolated) |

| Automation | Recovery orchestration plans | Recovery plans |

| Best for | AZ resilience validation | Regional DR |

Recommended approach:

1. Use Azure Resiliency for monthly AZ drills — validate that your multi-AZ deployment actually works

2. Use Azure Site Recovery for quarterly cross-region DR tests — validate that you can recover in another region

3. Document both for compliance audits

Key Takeaways

1. Azure Resiliency enables non-disruptive AZ failover simulation — the first platform-native tool for testing multi-AZ resilience without impacting production.

2. Zonal Resiliency Goals with AI recommendations make it practical to identify and fix resilience gaps, with cost-aware guidance that shows the real price of redundancy.

3. Recovery Orchestration Plans automate multi-resource failover across VMs, SQL, Cosmos DB, AKS, and Storage — handling application-specific recovery that platform-native failover cannot.

4. The cost of AZ resilience is primarily in database replication, not compute — VMs and load balancers have minimal cost difference across zones.

5. Schedule recurring drills — Azure Resiliency supports automated monthly AZ drills that produce compliance-ready documentation for PDPA and internal audits.