# Ensure 'Cross Region Restore' is Set to 'Enabled' on Backup Vaults

- Source: https://support.icompaas.com/support/solutions/articles/62000234831-ensure-cross-region-restore-is-set-to-enabled-on-backup-vaults
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Azure Storage Services Benchmark v1.0.0](https://support.icompaas.com/support/solutions/62000112694) › [Azure Storage Services Benchmark](https://support.icompaas.com/support/solutions/folders/62000169262)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Profile Applicability:** Level 1

**Description:** Cross Region Restore (CRR) allows Azure Backup Vaults to restore backup data to a different Azure region than where it was originally backed up. Enabling CRR provides enhanced disaster recovery capabilities by ensuring data availability even if the primary region experiences an outage or disaster.

**Rationale:** Enabling Cross Region Restore strengthens business continuity and resiliency by allowing recovery of critical backup data in an alternate region. This reduces downtime risks caused by regional failures and supports compliance with disaster recovery policies.

**Impact:**

-   Pros:  
    
    -   Improves disaster recovery options and reduces recovery time objectives (RTO).  
        
    -   Provides geographic redundancy and higher availability.  
        
    -   Supports compliance with data residency and disaster recovery regulations.  
        
-   Cons:  
    
    -   May increase costs due to data transfer and storage in multiple regions.  
        
    -   Requires proper planning and validation of cross-region restore procedures.  
        

**Default Value:** Cross Region Restore is disabled by default and must be explicitly enabled on Backup Vaults.

**Pre-requisites:**

-   Azure Recovery Services Vault configured with backup data replication enabled.  
    
-   Permissions to modify backup vault settings.  
    
-   Understanding of organizational disaster recovery requirements.  
    

### **Remediation**

**Test Plan:**

**Using Azure Portal:**

1.  Navigate to [https://portal.azure.com](https://portal.azure.com/).  
    
2.  Open Recovery Services Vaults and select the target vault.  
    
3.  Go to Backup Infrastructure > Backup Configuration or Properties.  
    
4.  Verify that Cross Region Restore is enabled.  
    

**Using Azure CLI:**

1\. Check the Cross Region Restore status:  

az backup vault show --name <vault-name> --resource-group <resource-group> --query properties.crossRegionRestoreFlag

2\. Confirm the value is Enabled or true.  

### **Implementation Plan**

**Using Azure Portal:**

1.  Navigate to the Backup Vault’s Backup Configuration or Properties.  
    
2.  Enable Cross Region Restore option.  
    
3.  Save the settings and verify status.  
    

**Using Azure CLI:**

1\. Enable Cross Region Restore:  

az backup vault update --name <vault-name> --resource-group <resource-group> --set properties.crossRegionRestoreFlag=Enabled

2\. Confirm the update by re-checking the vault properties.  

### **Backout Plan**

**Using Azure Portal:**

1.  Disable Cross Region Restore if needed by toggling off the setting.  
    
2.  Communicate potential impacts on disaster recovery plans.  
    

**Using Azure CLI:**

1\. Disable Cross Region Restore:  

az backup vault update --name <vault-name> --resource-group <resource-group> --set properties.crossRegionRestoreFlag=Disabled

  

**References:**

-   [Azure Backup Cross Region Restore  
    ](https://learn.microsoft.com/en-us/azure/backup/backup-cross-region-restore)
    
-   [Configure Disaster Recovery for Backup Vaults](https://learn.microsoft.com/en-us/azure/backup/backup-disaster-recovery)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.