Azure Backup and Snapshot Coverage Verifier

Overview

This flow verifies that Azure managed disks have a recent recovery point (snapshot) within the required RPO, using the Azure Resource Manager connector. It runs daily, lists every managed disk and every snapshot in the subscription, determines which disks lack a snapshot newer than the RPO window, logs each gap to a Dataverse table, and alerts the platform team in Teams plus an email summary.

Why it matters: "we have backups" is only true if recovery points are actually recent. A daily coverage check surfaces unprotected or stale-recovery-point disks before a failure proves them missing.

Ships Off (Stopped). Snapshot-based coverage avoids Recovery Services vault data-plane permissions.

Use Case

A platform / ops team needs assurance that every critical managed disk has a current, restorable recovery point, with gaps surfaced daily rather than discovered during an incident. The Dataverse table gives an auditable history of every gap, stamped with a per-run correlation id.

Flow Architecture

Environment Variables

Connectors & Connections

Note — All connections are referenced as solution connection references; the flow is portable between environments as long as a connection is mapped at import time.

Customization Guide

Almost every realistic variant of this flow can be implemented by changing environment variable values. A few cases require small edits inside the flow definition — those are called out explicitly below.

Scope to a group or tag

Add a resourceGroup or tag clause to the $filter on the disk/snapshot lists to limit the check to production targets.

Tiered RPO

Read a per-disk rpoHours tag inside the disk loop and compare against it instead of the single RPO value.

Alert-only

Wrap the Teams + email actions in a gap-count > 0 condition so they fire only when gaps exist.

Cover VMs

Add another Resources_List filtered to virtualMachines and correlate against Recovery Services restore points (requires that read scope).

Pagination

For very large subscriptions, follow nextLink in a Do Until to page through all results.

Key Expressions

The flow is intentionally light on Power Fx / WDL gymnastics — the heaviest expressions are the branch-name concatenation and the approval outcome check. They are listed below in the order they appear in the flow.

greaterOrEquals(ticks(coalesce(body('Get_Snapshot_Detail')?['properties']?['timeCreated'], '1900-01-01')), ticks(addHours(utcNow(), mul(variables('varRpoHours'), -1))))

equals(item()?['sourceDiskId'], toLower(items('For_Each_Disk')?['id']))

equals(length(body('Filter_Recent_Snapshots_For_Disk')), 0)

concat('snapshots/', item()?['name'])