{Backup} Added support for Microsoft Defender for Cloud Source Scan configuration for Recovery Services vaults and Azure Virtual Machine backup items - #34076
Merged
Ethan Yang (necusjz) merged 13 commits intoSep 18, 2026
Conversation
…-delete) custom_base.py: - Restore containerSubscriptionId on the raw ARM item/recovery-point path, which regressed when `backup item`/`recoverypoint` show/list were repointed to the *_with_source_scan / *_with_threat_info wrappers (raw GET bypassed custom_help.set_container_subscription_id). Re-synthesize it from sourceResourceId. - Make `backup item source-scan-configuration set` idempotent (SourceScanStatusAlreadyInRequestedState -> Succeeded). test_backup_commands.py: - source-scan test: retry container/item name resolution; the registered-container list is eventually consistent right after enable-for-vm and could return empty. - vault soft-delete test: the ARG-backed `deleted-vault list-containers` does not surface the soft-deleted item within the test window, so make that check best-effort and keep the reliable undelete-lifecycle assertions; fix vm_found. - rg_mapping: update resourceGuardOperationDetails expected count 14 -> 16. test_ase_commands.py: - Skip the two SAP ASE tests (permanent fixtures removed); tracked by WI 39504009. Re-record affected cassettes and scrub the real subscription id from the raw-path recordings. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
microsoft-github-policy-service
Bot
requested review from
Yu Chen (jsntcy),
ZelinWang (wangzelin007) and
Yong Zhang (yonzhan)
September 14, 2026 11:57
microsoft-github-policy-service
Bot
added
Auto-Assign
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
Critical SDK deserialization and moderate serialization and test-coverage issues remain unresolved.
Get a fresh assessment by requesting another Copilot review.
Pull request overview
Adds Microsoft Defender for Cloud Source Scan configuration for Recovery Services vaults and Azure VM backup items, with Recovery Services SDK updates and expanded test coverage.
Changes:
- Adds vault and item Source Scan commands, validation, and help.
- Updates SDK dependencies, clients, models, and operation handling.
- Updates tests, preparers, and recordings.
File summaries
| File | Change summary | Final review note |
|---|---|---|
src/azure-cli/setup.py |
Updates Recovery Services SDK dependencies. | — |
src/azure-cli/requirements.py3.windows.txt |
Pins updated Windows packages. | — |
src/azure-cli/requirements.py3.Linux.txt |
Pins updated Linux packages. | — |
src/azure-cli/requirements.py3.Darwin.txt |
Pins updated Darwin packages. | — |
src/azure-cli/azure/cli/command_modules/backup/tests/unit/test_custom.py |
Adds Source Scan unit tests. | Moderate (2 votes): the module is not collected by normal backup test discovery. |
src/azure-cli/azure/cli/command_modules/backup/tests/latest/test_sql_commands.py |
Updates SQL test resources and lookup logic. | — |
src/azure-cli/azure/cli/command_modules/backup/tests/latest/test_backup_commands.py |
Adds vault, item, and recovery-point scenarios. | — |
src/azure-cli/azure/cli/command_modules/backup/tests/latest/test_ase_commands.py |
Updates ASE test execution. | Moderate (3 votes): newly skipped scenarios remove container and policy coverage. |
src/azure-cli/azure/cli/command_modules/backup/tests/latest/recordings/test_backup_wl_sql_policy.yaml |
Refreshes SQL policy playback. | — |
src/azure-cli/azure/cli/command_modules/backup/tests/latest/recordings/test_backup_wl_hana_snapshot.yaml |
Refreshes HANA snapshot playback. | — |
src/azure-cli/azure/cli/command_modules/backup/tests/latest/recordings/test_backup_source_scan_recovery_points.yaml |
Adds Source Scan recovery-point playback. | — |
src/azure-cli/azure/cli/command_modules/backup/tests/latest/recordings/test_backup_restore_multiple_containers_same_friendly_name.yaml |
Updates restore playback. | Moderate (3 votes): playback starts with ResourceGroupNotFound, bypassing the intended validation path. |
src/azure-cli/azure/cli/command_modules/backup/tests/latest/preparers.py |
Updates test preparation. | — |
src/azure-cli/azure/cli/command_modules/backup/custom.py |
Implements vault Source Scan handling and SDK migration. | — |
src/azure-cli/azure/cli/command_modules/backup/custom_wl.py |
Migrates workload operations to updated SDK handling. | — |
src/azure-cli/azure/cli/command_modules/backup/custom_help.py |
Adds model, serialization, and operation helpers. | Critical (1 vote): the fallback uses incompatible positional model construction and incorrect model types. Moderate (2 votes): synthetic resourceGroup is placed incorrectly for existing serialization and table checks. |
src/azure-cli/azure/cli/command_modules/backup/custom_common.py |
Updates filtering and model handling. | — |
src/azure-cli/azure/cli/command_modules/backup/custom_base.py |
Implements VM item Source Scan actions. | — |
src/azure-cli/azure/cli/command_modules/backup/custom_afs.py |
Migrates Azure Files operations. | — |
src/azure-cli/azure/cli/command_modules/backup/commands.py |
Registers Source Scan commands. | — |
src/azure-cli/azure/cli/command_modules/backup/_validators.py |
Updates command argument validation. | — |
src/azure-cli/azure/cli/command_modules/backup/_params.py |
Defines Source Scan arguments. | — |
src/azure-cli/azure/cli/command_modules/backup/_help.py |
Documents commands and options. | — |
src/azure-cli/azure/cli/command_modules/backup/_client_factory.py |
Updates active/passive Recovery Services client factories. | — |
Review details
Suppressed comments (1)
src/azure-cli/azure/cli/command_modules/backup/tests/latest/test_ase_commands.py:94
- This newly skips
test_bkp_res_ase, removing its ASE backup/recovery coverage from the automated suite without adding a replacement. Please restore runnable test resources/recordings or keep the test-resource repair separate from this feature change.
- Files reviewed: 25/67 changed files
- Comments generated: 5
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Member
|
/azp run |
|
Azure Pipelines: Successfully started running 3 pipeline(s). |
Collaborator
|
Backup |
Member
|
/azp run |
|
Azure Pipelines: Successfully started running 3 pipeline(s). |
Member
|
/azp run |
|
Azure Pipelines: Successfully started running 3 pipeline(s). |
Ethan Yang (necusjz)
changed the title
Julie Zhu (yanzhudd)
previously approved these changes
Sep 17, 2026
Contributor
|
please address above comments and also get approval from Zubair Abid (@zubairabid) as well. |
Zubair Abid (zubairabid)
approved these changes
Sep 17, 2026
Zubair Abid (zubairabid)
left a comment
Zubair Abid (zubairabid)
left a comment
Contributor
There was a problem hiding this comment.
Looks good, overall. Main concern that remains: Due to the split Python SDK, there is now some fragility that might impact customers. The -passivestamp recoveryservicesbackup SDK needs to be installed after the main SDK is installed.
Member
|
/azp run |
|
Azure Pipelines: Successfully started running 3 pipeline(s). |
Member
Author
Done |
Julie Zhu (yanzhudd)
approved these changes
Sep 18, 2026
Ethan Yang (necusjz)
approved these changes
Sep 18, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
🤖 PR Validation —⚠️ Review suggested
Related command
az backup vault updateaz backup item source-scan-configuration setaz backup item showaz backup recoverypoint showDescription
Adds Microsoft Defender for Cloud Source Scan configuration support for Recovery Services vaults and Azure VM backup items.
This PR adds
--source-scan-statetoaz backup vault updateand introducesaz backup item source-scan-configuration setto enable or disable Source Scan for individual Azure VM backup items. It also surfaces Source Scan and recovery-point threat information, upgrades the Recovery Services Backup SDK to version11.0.0with API version2026-07-01, and updates the related tests and recordingsTesting Guide
Verify the vault configuration:
Expected result:
"Enabled".az backup item source-scan-configuration set \ --resource-group MyResourceGroup \ --vault-name MyVault \ --container-name MyContainer \ --name MyItem \ --state Enabled \ --backup-management-type AzureIaasVM \ --workload-type VMVerify the item-level Source Scan status:
Expected result:
sourceSideScanStatuseventually becomesConfigured.az backup recoverypoint show \ --resource-group MyResourceGroup \ --vault-name MyVault \ --container-name MyContainer \ --item-name MyItem \ --name MyRecoveryPoint \ --backup-management-type AzureIaasVM \ --workload-type VM \ --query "properties.{threatStatus:threatStatus,threatInfo:threatInfo}"Expected result: the response contains populated
threatStatusandthreatInfofields.az backup item source-scan-configuration set \ --resource-group MyResourceGroup \ --vault-name MyVault \ --container-name MyContainer \ --name MyItem \ --state Disabled \ --backup-management-type AzureIaasVM \ --workload-type VM az backup vault update \ --resource-group MyResourceGroup \ --name MyVault \ --source-scan-state DisabledHistory Notes
[Backup]
az backup vault update: Add--source-scan-stateto configure Microsoft Defender for Cloud Source Scan[Backup]
az backup item source-scan-configuration set: Add support for enabling or disabling Source Scan for Azure VM backup itemsThis checklist is used to make sure that common guidelines for a pull request are followed.
The PR title and description has followed the guideline in Submitting Pull Requests.
I adhere to the Command Guidelines.
I adhere to the Error Handling Guidelines.