Build managed disk snapshot policies with incremental snapshots, retention schedules, cross-region copy, and encryption settings.
Build managed disk snapshot policies with incremental snapshots, retention schedules, cross-region copy, and encryption settings.
Required Fields
snapshotPolicyNameresourceGrouptargetDiskstargetDisks[0].diskNamesnapshotSettings.incrementalschedule.frequencyschedule.retentionDaysOutput will appear here...The builder validates that snapshotPolicyName, resourceGroup, targetDisks, the first disk's diskName, snapshotSettings.incremental, schedule.frequency, and schedule.retentionDays all resolve before accepting the JSON as a valid combined snapshot policy specification; it can't verify the referenced disks actually exist in their stated resource groups or that the target cross-region copy region has sufficient quota, those are only confirmed against the live Azure Compute API.
Build an Azure managed disk snapshot policy combining incremental snapshots (storing only changed blocks since the last snapshot, dramatically cheaper than full snapshots for disks with modest daily change rates) with a tiered daily/weekly/monthly retention schedule and optional crossRegionCopy for disaster recovery. networkAccessPolicy: DenyAll paired with publicNetworkAccess: Disabled means the snapshots are only accessible via private endpoint or from within the same network boundary as the source disks, a genuinely different (and more restrictive) security posture than the default, which matters for a snapshot policy protecting disks subject to a compliance requirement that backups can't be reachable over the public internet under any circumstance.
Incremental snapshots are close to a free efficiency win for any disk with a low-to-moderate daily change rate, verify there's no specific reason your workload needs full snapshots before defaulting away from incremental.
DenyAll/Disabled network access on snapshots is the right posture for regulated data but requires private endpoint infrastructure to actually restore from those snapshots later, make sure the restore path (not just the backup path) has been tested against this restrictive network configuration.
Layer daily/weekly/monthly retention deliberately rather than keeping every daily snapshot for the full compliance period, the tiered approach in the example achieves long-term retention at a fraction of the storage cost of keeping daily granularity for a full year.
The incremental snapshot chain does depend on prior snapshots in the same series for its underlying storage efficiency and restore capability, but each incremental snapshot can still be independently used to create a full, restorable disk, Azure manages reconstructing the full disk state from the chain of incremental snapshots transparently, you don't need to worry about manually chaining them for a restore operation.
The default network access policy for a snapshot generally allows access via a broader path (matching the disk export/access model), DenyAll combined with publicNetworkAccess Disabled specifically requires a private endpoint (or same-VNet access) for anything touching the snapshot, meaning even someone with valid credentials can't reach the snapshot data from outside the private network boundary, a meaningfully stronger posture for regulated or highly sensitive disk backups.
It has its own independent retentionDays setting, distinct from the primary region's schedule.retentionDays, this is deliberate, a DR copy often needs a different (frequently shorter) retention window than the primary compliance-driven retention, since its purpose is recovery-readiness rather than long-term compliance archival.
Was this tool helpful?
Disclaimer: This tool runs entirely in your browser. No data is sent to our servers. Always verify outputs before using them in production. AWS, Azure, and GCP are trademarks of their respective owners.