Introduction
This article provides the guidance for setting up cross subscription restoration that allows customers/Engineers to restore SAP Database (SAP HANA or MS SQL) backups across subscriptions on the same tenant using Azure Backup.
This solution aligns with
Azure recommendation that PROD and non-PROD landscapes should be in different subscriptions. This capability allows customers to create copies of their PROD deployments in their non-Prod environments and/or perform refresh of Non-PRD SAP Applications using PRD backups, within the same region but in a different subscription, directly using Azure Backup.
Overview
Azure Backup helps protect your critical business systems and backup data residing in SQL or SAP HANA into Azure Recovery Service Vaults.
MS SQL and SAP HANA databases are critical workloads that require a low recovery-point objective (RPO) and long-term retention. You can back up MS SQL and SAP HANA databases running on Azure virtual machines (VMs) by using
Azure Backup.
However, customers following
Azure recommendation for their landing zone architecture face problems when there is a need to move backups between subscription. Especially in SAP Applications, there would be requirement for customers to perform SAP Application refresh aka system refresh where recent backup data from PRD workloads would be restored to non-Prod. Considerable amount of time were spent in download and transfer of files manually between subscriptions.
Cross Subscription restore feature available in Azure Backup helps customers overcome the above-mentioned difficulty and administrative overheads. This capability allows customers to create copies of their PROD deployments in their non-PROD environments, within the same region but in a different subscription, directly using Azure Backup.
Overview of deployment steps
This article shows how to perform restore of SAP HANA databases present in same region under two different subscriptions on the same tenant using Azure Backup. We can use the same article as reference for performing restoration of SAP Applications running on MS SQL DB using Azure Backup.
Scope
As part of Cross subscription restore, only certain scenarios are supported and the support matrix for the scenarios are listed below.
Feature |
Support Matrix |
Cross subscription Restore within primary region |
Supported |
Cross subscription Restore for distributed configurations such as SQL AG (availability groups) and HANA HSR (HANA System Replication) |
Supported |
Cross subscription restore in between vaults with soft-delete on, CMK (customer-managed keys) to encrypt data in the vault |
Supported |
Cross subscription Restore from secondary region |
Not supported |
Restore between subscriptions of different tenants |
Not supported |
Pre-requisites
The article assumes that customer/Engineer has an active backup configuration for SAP HANA database using Azure Backup for HANA on the subscriptions involved.
If you have not configured backups yet for your SAP HANA databases, see
Back up SAP HANA databases on Azure VMs. To learn more about the supported configurations and scenarios, see
Support matrix for backup of SAP HANA databases on Azure VMs.
- Cross Subscription Restore is enabled by default at the Recovery Services Vault when it is deployed part of Azure Backup configuration. Same can be verified by navigating to Azure Recovery Services Vault holding the backups --> Properties --> Cross Subscription Restore.

- Customers/Engineers can disable this setting at any given point of time by navigating to Properties --> Cross Subscription Restore as shown above.
- Choose the “Disable Cross Subscription Restore” if the feature must be disabled temporarily. You can enable the Cross subscription restore at later point in time if you choose this option.

- Choose “Permanently disable Cross Subscription Restore” on this vault option only if you/customer doesn’t require this feature or for security reasons. Please note that it is not possible to turn on Cross subscription feature at later point of time if this is chosen.
System Architecture
- For performing restoration using cross subscription feature, we use two SAP Applications (S4HANA 2021) running on different subscriptions under the same tenant.
- ]Our source subscription contains SAP application (S4HANA 2021) running on HANA with HSR enabled (mimicking typical PRD environment) as shown below. Please note that we are taking source SAP application as HSR enabled system only for testing purpose. Your source system can either be HSR enabled HANA DB or a single node HANA DB. Azure backup is configured using Back up SAP HANA System Replication databases on Azure VMs - Azure Backup | Microsoft Learn

- Ensure the backup status of the source system is in healthy status as shown below on the Azure Recovery Services Vault.

- Our target subscription contains SAP application (S4HANA 2021) running on HANA in distributed VM (virtual machines) setup.

- Ensure the backup status of the target system is in healthy status as shown below on the Azure Recovery Services Vault.

- Below tabular column provides information about the source and the target subscriptions, SAP Application ID, HANA SYSTEM used in the reference.
|
Source |
Target |
Subscription |
Subscription A |
Subscription B |
Backup Vault |
USESAPBKPVAULT |
SAPBackupVault |
Host |
s4adbvm00 |
sahdbvm |
HANA SYSTEM SID |
S4A |
SAH |
Tenant SID (System ID) |
S4A |
SAH |
Security impact
The
RBAC principles that are present for same subscription restore also apply to cross subscription restore as well. User needs to have permissions on source VM AND target VM to trigger restore from backups of source to the target VM.
Perform Cross-Subscription Restoration
- Create a test user TEST-S4A in source DB using SAP TCODE SU01. This is to verify and ensure our backup/restore is successful at the end of this exercise.

- Restoration will be performed from 1st Subscription (HANA in HSR) to 2nd We will be using the S4A SID in source as the backup source.

- Click on the restore button as shown below.

- The restore flows were earlier locked between 2 machines which belong to same subscription, region and registered to the same vault. With the cross-subscriptions, we are now introducing a subscription selection, vault selection and the corresponding target machine selection in these flows.
- Choose alternative location in the tab and choose the target subscription from the lists where your backup must be restored, and the target backup vault as shown below.

- Now select the target host from the list and the target SAP HANA system as shown below.
- Provide the restored DB name i.e., the target tenant SID (SAH) and proceed if you want to restore on top of the current tenant at the target. Do not forget to choose the option “Overwrite if the DB with same name already exists on selected HANA instance.”

- If a new tenant DB must be created using source backup without disturbing the HANA DB tenant in target, then provide input as shown below.

- Select the restore point and decide whether the full backup or point in time backups are to be used for restoration based on your requirement as shown below.

- Let us choose Logs (point in time) and select the restore date & time.

- Once all the inputs are provided, click OK button to start the restoration.

- Once the job is triggered, the same can be monitored under the settings on the left side --> Backup Jobs tab in the source subscription.

- Executing select * from M_DATABASES on SYSTEMDB where the backup is restored would show the active status of the recovery and tenant ID.

- On the database level, the recovery can be monitored by checking the backup log file present in path /usr/sap/SID/HDB<<inst no>>/<<hostname>>/trace/DB_SID where SID is your target SID and hostname is the hostname of the target VM.


- Status of the restore job in the backup jobs tab should be completed once the restore is successful as shown below.

- Execute the SQL command select * from M_DATABASES on the SYSTEMDB in the target to check the status of the TENANT DB.

- Now check if the user created in the source HANA DB is reflecting on the target by executing below SQL command on the tenant db. SELECT * from USR02 where BNAME = ‘TEST-S4A’

- If overwrite existing Tenant DB is selected during restoration as shown below, then monitor the existing tenant on the target HANA system for the restoration process and the backup log file for detailed information.

- Status of the command Select * from M_DATABASES during restoration process.

- Status of the command Select * from M_DATABASES on completion of successful restore.

- Detailed information of the restoration job available in Backup Jobs tab on the settings in Azure portal can be seen as shown below.

- Once the restore is completed and SAP application is up, login into target SAP Application and check if the test user created in source i.e., TEST-S4A user is present in SAH SID (target DB) using TCODE SU01.

Cross-subscription restoration flow

References
Resource provider registration errors - Azure Resource Manager | Microsoft Learn
Overview of Backup vaults - Azure Backup | Microsoft Learn
Overview of Recovery Services vaults - Azure Backup | Microsoft Learn
What is Azure Backup? - Azure Backup | Microsoft Learn
SAP on Azure: Backup SAP HANA databases with HSR enabled on Azure VMs | SAP Blogs
Back up an SAP HANA database to Azure with Azure Backup - Azure Backup | Microsoft Learn
Back up SAP HANA System Replication databases on Azure VMs - Azure Backup | Microsoft Learn
Manage backed up SAP HANA databases on Azure VMs - Azure Backup | Microsoft Learn