[Backup] Added support for Microsoft Defender for Cloud Source Scan configuration for Recovery Services vaults and Azure Virtual Machine backup items by vidyadharijami · Pull Request #34076 · Azure/azure-cli

vidyadharijami · 2026-09-14T11:57:12Z

🤖 PR Validation — ⚠️ Review suggested

Breaking Changes	Tests
⚠️ None	️✔️ 130/130

⚠️AzureCLI-BreakingChangeTest

⚠️backup

rule cmd_name rule_message suggest_message

⚠️ 1011 - SubgroupAdd backup item source-scan-configuration sub group backup item source-scan-configuration added

⚠️ 1006 - ParaAdd backup vault update cmd backup vault update added parameter source_scan_state

⚠️mysql

rule cmd_name rule_message suggest_message

⚠️ 1009 - ParaPropRemove mysql flexible-server create cmd mysql flexible-server create update parameter tier: removed property type=custom_type

⚠️ 1009 - ParaPropRemove mysql flexible-server geo-restore cmd mysql flexible-server geo-restore update parameter tier: removed property type=custom_type

⚠️ 1009 - ParaPropRemove mysql flexible-server import create cmd mysql flexible-server import create update parameter tier: removed property type=custom_type

⚠️ 1009 - ParaPropRemove mysql flexible-server replica create cmd mysql flexible-server replica create update parameter tier: removed property type=custom_type

⚠️ 1009 - ParaPropRemove mysql flexible-server restore cmd mysql flexible-server restore update parameter tier: removed property type=custom_type

⚠️ 1009 - ParaPropRemove mysql flexible-server update cmd mysql flexible-server update update parameter tier: removed property type=custom_type

Related command

az backup vault update
az backup item source-scan-configuration set
az backup item show
az backup recoverypoint show

Description

Adds Microsoft Defender for Cloud Source Scan configuration support for Recovery Services vaults and Azure VM backup items.

This PR adds --source-scan-state to az backup vault update and introduces az backup item source-scan-configuration set to enable or disable Source Scan for individual Azure VM backup items. It also surfaces Source Scan and recovery-point threat information, upgrades the Recovery Services Backup SDK to version 11.0.0 with API version 2026-07-01, and updates the related tests and recordings

Testing Guide

Enable Source Scan on a Recovery Services vault. This configures the vault to support Microsoft Defender for Cloud Source Scan.

az backup vault update \
  --resource-group MyResourceGroup \
  --name MyVault \
  --source-scan-state Enabled

Verify the vault configuration:

az backup vault show \
  --resource-group MyResourceGroup \
  --name MyVault \
  --query properties.securitySettings.sourceScanConfiguration.state

Expected result: "Enabled".

Enable Source Scan for an Azure VM backup item. The set command completes without output on success.

az backup item source-scan-configuration set \
  --resource-group MyResourceGroup \
  --vault-name MyVault \
  --container-name MyContainer \
  --name MyItem \
  --state Enabled \
  --backup-management-type AzureIaasVM \
  --workload-type VM

Verify the item-level Source Scan status:

az backup item show \
  --resource-group MyResourceGroup \
  --vault-name MyVault \
  --container-name MyContainer \
  --name MyItem \
  --backup-management-type AzureIaasVM \
  --workload-type VM \
  --query properties.sourceSideScanInfo

Expected result: sourceSideScanStatus eventually becomes Configured.

View threat information for a scanned recovery point.

az backup recoverypoint show \
  --resource-group MyResourceGroup \
  --vault-name MyVault \
  --container-name MyContainer \
  --item-name MyItem \
  --name MyRecoveryPoint \
  --backup-management-type AzureIaasVM \
  --workload-type VM \
  --query "properties.{threatStatus:threatStatus,threatInfo:threatInfo}"

Expected result: the response contains populated threatStatus and threatInfo fields.

Disable Source Scan for the backup item and vault.

az backup item source-scan-configuration set \
  --resource-group MyResourceGroup \
  --vault-name MyVault \
  --container-name MyContainer \
  --name MyItem \
  --state Disabled \
  --backup-management-type AzureIaasVM \
  --workload-type VM

az backup vault update \
  --resource-group MyResourceGroup \
  --name MyVault \
  --source-scan-state Disabled

History Notes

[Component Name 1] BREAKING CHANGE: az command a: Make some customer-facing breaking change
[Component Name 2] az command b: Add some customer-facing feature

[Backup] az backup vault update: Add --source-scan-state to configure Microsoft Defender for Cloud Source Scan

[Backup] az backup item source-scan-configuration set: Add support for enabling or disabling Source Scan for Azure VM backup items

This checklist is used to make sure that common guidelines for a pull request are followed.

The PR title and description has followed the guideline in Submitting Pull Requests.
I adhere to the Command Guidelines.
I adhere to the Error Handling Guidelines.

…-delete) custom_base.py: - Restore containerSubscriptionId on the raw ARM item/recovery-point path, which regressed when `backup item`/`recoverypoint` show/list were repointed to the *_with_source_scan / *_with_threat_info wrappers (raw GET bypassed custom_help.set_container_subscription_id). Re-synthesize it from sourceResourceId. - Make `backup item source-scan-configuration set` idempotent (SourceScanStatusAlreadyInRequestedState -> Succeeded). test_backup_commands.py: - source-scan test: retry container/item name resolution; the registered-container list is eventually consistent right after enable-for-vm and could return empty. - vault soft-delete test: the ARG-backed `deleted-vault list-containers` does not surface the soft-deleted item within the test window, so make that check best-effort and keep the reliable undelete-lifecycle assertions; fix vm_found. - rg_mapping: update resourceGuardOperationDetails expected count 14 -> 16. test_ase_commands.py: - Skip the two SAP ASE tests (permanent fixtures removed); tracked by WI 39504009. Re-record affected cassettes and scrub the real subscription id from the raw-path recordings. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot

🟡 Changes recommended

Critical SDK deserialization and moderate serialization and test-coverage issues remain unresolved.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Adds Microsoft Defender for Cloud Source Scan configuration for Recovery Services vaults and Azure VM backup items, with Recovery Services SDK updates and expanded test coverage.

Changes:

Adds vault and item Source Scan commands, validation, and help.
Updates SDK dependencies, clients, models, and operation handling.
Updates tests, preparers, and recordings.

File summaries

File	Change summary	Final review note
`src/azure-cli/setup.py`	Updates Recovery Services SDK dependencies.	—
`src/azure-cli/requirements.py3.windows.txt`	Pins updated Windows packages.	—
`src/azure-cli/requirements.py3.Linux.txt`	Pins updated Linux packages.	—
`src/azure-cli/requirements.py3.Darwin.txt`	Pins updated Darwin packages.	—
`src/azure-cli/azure/cli/command_modules/backup/tests/unit/test_custom.py`	Adds Source Scan unit tests.	Moderate (2 votes): the module is not collected by normal backup test discovery.
`src/azure-cli/azure/cli/command_modules/backup/tests/latest/test_sql_commands.py`	Updates SQL test resources and lookup logic.	—
`src/azure-cli/azure/cli/command_modules/backup/tests/latest/test_backup_commands.py`	Adds vault, item, and recovery-point scenarios.	—
`src/azure-cli/azure/cli/command_modules/backup/tests/latest/test_ase_commands.py`	Updates ASE test execution.	Moderate (3 votes): newly skipped scenarios remove container and policy coverage.
`src/azure-cli/azure/cli/command_modules/backup/tests/latest/recordings/test_backup_wl_sql_policy.yaml`	Refreshes SQL policy playback.	—
`src/azure-cli/azure/cli/command_modules/backup/tests/latest/recordings/test_backup_wl_hana_snapshot.yaml`	Refreshes HANA snapshot playback.	—
`src/azure-cli/azure/cli/command_modules/backup/tests/latest/recordings/test_backup_source_scan_recovery_points.yaml`	Adds Source Scan recovery-point playback.	—
`src/azure-cli/azure/cli/command_modules/backup/tests/latest/recordings/test_backup_restore_multiple_containers_same_friendly_name.yaml`	Updates restore playback.	Moderate (3 votes): playback starts with `ResourceGroupNotFound`, bypassing the intended validation path.
`src/azure-cli/azure/cli/command_modules/backup/tests/latest/preparers.py`	Updates test preparation.	—
`src/azure-cli/azure/cli/command_modules/backup/custom.py`	Implements vault Source Scan handling and SDK migration.	—
`src/azure-cli/azure/cli/command_modules/backup/custom_wl.py`	Migrates workload operations to updated SDK handling.	—
`src/azure-cli/azure/cli/command_modules/backup/custom_help.py`	Adds model, serialization, and operation helpers.	Critical (1 vote): the fallback uses incompatible positional model construction and incorrect model types. Moderate (2 votes): synthetic `resourceGroup` is placed incorrectly for existing serialization and table checks.
`src/azure-cli/azure/cli/command_modules/backup/custom_common.py`	Updates filtering and model handling.	—
`src/azure-cli/azure/cli/command_modules/backup/custom_base.py`	Implements VM item Source Scan actions.	—
`src/azure-cli/azure/cli/command_modules/backup/custom_afs.py`	Migrates Azure Files operations.	—
`src/azure-cli/azure/cli/command_modules/backup/commands.py`	Registers Source Scan commands.	—
`src/azure-cli/azure/cli/command_modules/backup/_validators.py`	Updates command argument validation.	—
`src/azure-cli/azure/cli/command_modules/backup/_params.py`	Defines Source Scan arguments.	—
`src/azure-cli/azure/cli/command_modules/backup/_help.py`	Documents commands and options.	—
`src/azure-cli/azure/cli/command_modules/backup/_client_factory.py`	Updates active/passive Recovery Services client factories.	—

Review details

Suppressed comments (1)

src/azure-cli/azure/cli/command_modules/backup/tests/latest/test_ase_commands.py:94

This newly skips test_bkp_res_ase, removing its ASE backup/recovery coverage from the automated suite without adding a replacement. Please restore runnable test resources/recordings or keep the test-resource repair separate from this feature change.

Files reviewed: 25/67 changed files
Comments generated: 5
Review effort level: Lite

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

+    if class_name in dependencies:
+        param = client._deserialize(class_name, json_obj)  # pylint: disable=protected-access
+    else:
+        param = getattr(backup_models, class_name)(json_obj)


+    if item is None or not getattr(item, 'id', None) or not hasattr(item, 'properties'):
+        return item
+    resource_group = get_resource_group_from_id(item.id)
+    item.properties['resourceGroup'] = resource_group


+      string: '{"error":{"code":"ResourceGroupNotFound","message":"Resource group
+        ''sgholapDMTesting-rg'' could not be found."}}'



 class ASEBackupTests(ScenarioTest, unittest.TestCase):

+    @unittest.skip("TODO @kumarutkarsh3b2166: 39504009 recreate ASE test resources.")


@@ -0,0 +1,77 @@
+# --------------------------------------------------------------------------------------------


Aditya Pujara (a0x1ab) · 2026-09-14T12:54:19Z

/azp run

azure-pipelines · 2026-09-14T12:54:40Z

Azure Pipelines: Successfully started running 3 pipeline(s).

Yong Zhang (yonzhan) · 2026-09-14T23:07:10Z

Backup

Zubair Abid (zubairabid) · 2026-09-15T08:29:07Z


 def _backup_client_factory(cli_ctx, **_):
-    from azure.mgmt.recoveryservicesbackup.activestamp import RecoveryServicesBackupClient
+    from azure.mgmt.recoveryservicesbackup import RecoveryServicesBackupClient


Are we not importing the new passivestamp client?

Zubair Abid (zubairabid) · 2026-09-15T08:30:49Z



 def _backup_passive_client_factory(cli_ctx, **_):
    from azure.mgmt.recoveryservicesbackup.passivestamp import RecoveryServicesBackupPassiveClient


Won't this fail? We should have the new passivestamp client.

Zubair Abid (zubairabid) · 2026-09-15T08:31:34Z

-from azure.mgmt.recoveryservicesbackup.activestamp.models import OperationStatusValues, JobStatus
+from azure.mgmt.recoveryservicesbackup import models as backup_models
+from azure.mgmt.recoveryservicesbackup.models import OperationStatusValues
 from azure.mgmt.recoveryservicesbackup.passivestamp.models import CrrJobRequest


Ref the passivestamp comments from earlier.

Aditya Pujara (a0x1ab) · 2026-09-16T09:47:03Z

/azp run

azure-pipelines · 2026-09-16T09:47:21Z

Azure Pipelines: Successfully started running 3 pipeline(s).

Ethan Yang (necusjz) · 2026-09-16T12:27:56Z

/azp run

azure-pipelines · 2026-09-16T12:28:14Z

Azure Pipelines: Successfully started running 3 pipeline(s).

vidyadharijami and others added 9 commits August 25, 2026 12:24

MDC changes

436f3f9

Updated few changes

ce1592b

Merge mdc backup test fixes

e8249e6

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Re-recorded all the tests

0d8a9b1

Fixed recordings along with test

251b8fb

Updated failed recording

ec7e785

Fixed all the rcordings

6c25c5b

Added few more tests

dfa36ee

Copilot AI lite review requested due to automatic review settings September 14, 2026 11:57

vidyadharijami requested review from a team as code owners September 14, 2026 11:57

azure-client-tools-bot-prd Bot added this to the October 2026 (2026-10-06) milestone Sep 14, 2026

microsoft-github-policy-service Bot requested review from Yu Chen (jsntcy), ZelinWang (wangzelin007) and Yong Zhang (yonzhan) September 14, 2026 11:57

microsoft-github-policy-service Bot added Auto-Assign Auto assign by bot Backup act-observability-squad labels Sep 14, 2026

Copilot started reviewing on behalf of vidyadharijami September 14, 2026 11:58 View session

Copilot AI reviewed Sep 14, 2026

View reviewed changes

Resolving merge conflcist

8c6cd26

Yong Zhang (yonzhan) assigned Ethan Yang (necusjz) Sep 14, 2026

Zubair Abid (zubairabid) reviewed Sep 15, 2026

View reviewed changes

Comment thread src/azure-cli/azure/cli/command_modules/backup/tests/latest/test_sql_commands.py

Zubair Abid (zubairabid) reviewed Sep 15, 2026

View reviewed changes

vidyadharijami added 2 commits September 16, 2026 14:53

Updated failed recordings and addressed review commnets

31a2ff8

Fixed linter failures

ffff3f0

Navigation Menu

Uh oh!

[Backup] Added support for Microsoft Defender for Cloud Source Scan configuration for Recovery Services vaults and Azure Virtual Machine backup items - #34076

[Backup] Added support for Microsoft Defender for Cloud Source Scan configuration for Recovery Services vaults and Azure Virtual Machine backup items#34076
vidyadharijami wants to merge 12 commits into
Azure:devfrom
vidyadharijami:deve/vijami/mdcchanges

vidyadharijami commented Sep 14, 2026 •

edited by x-engineering-agent Bot

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Aditya Pujara (a0x1ab) commented Sep 14, 2026

Uh oh!

azure-pipelines Bot commented Sep 14, 2026

Uh oh!

Yong Zhang (yonzhan) commented Sep 14, 2026

Uh oh!

Uh oh!

Zubair Abid (zubairabid) Sep 15, 2026

Uh oh!

Zubair Abid (zubairabid) Sep 15, 2026

Uh oh!

Zubair Abid (zubairabid) Sep 15, 2026

Uh oh!

Aditya Pujara (a0x1ab) commented Sep 16, 2026

Uh oh!

azure-pipelines Bot commented Sep 16, 2026

Uh oh!

Ethan Yang (necusjz) commented Sep 16, 2026

Uh oh!

azure-pipelines Bot commented Sep 16, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

rule	cmd_name	rule_message	suggest_message
⚠️ 1011 - SubgroupAdd	backup item source-scan-configuration	sub group `backup item source-scan-configuration` added
⚠️ 1006 - ParaAdd	backup vault update	cmd `backup vault update` added parameter `source_scan_state`

rule	cmd_name	rule_message
⚠️ 1009 - ParaPropRemove	mysql flexible-server create	cmd `mysql flexible-server create` update parameter `tier`: removed property `type=custom_type`
⚠️ 1009 - ParaPropRemove	mysql flexible-server geo-restore	cmd `mysql flexible-server geo-restore` update parameter `tier`: removed property `type=custom_type`
⚠️ 1009 - ParaPropRemove	mysql flexible-server import create	cmd `mysql flexible-server import create` update parameter `tier`: removed property `type=custom_type`
⚠️ 1009 - ParaPropRemove	mysql flexible-server replica create	cmd `mysql flexible-server replica create` update parameter `tier`: removed property `type=custom_type`
⚠️ 1009 - ParaPropRemove	mysql flexible-server restore	cmd `mysql flexible-server restore` update parameter `tier`: removed property `type=custom_type`
⚠️ 1009 - ParaPropRemove	mysql flexible-server update	cmd `mysql flexible-server update` update parameter `tier`: removed property `type=custom_type`

		string: '{"error":{"code":"ResourceGroupNotFound","message":"Resource group
		''sgholapDMTesting-rg'' could not be found."}}'


		class ASEBackupTests(ScenarioTest, unittest.TestCase):

		@unittest.skip("TODO @kumarutkarsh3b2166: 39504009 recreate ASE test resources.")

		@@ -0,0 +1,77 @@
		# --------------------------------------------------------------------------------------------



		def _backup_passive_client_factory(cli_ctx, **_):
		from azure.mgmt.recoveryservicesbackup.passivestamp import RecoveryServicesBackupPassiveClient

Uh oh!

Conversation

vidyadharijami commented Sep 14, 2026 • edited by x-engineering-agent Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🤖 PR Validation — ⚠️ Review suggested

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Suppressed comments (1)

Uh oh!

Aditya Pujara (a0x1ab) commented Sep 14, 2026

Uh oh!

azure-pipelines Bot commented Sep 14, 2026

Uh oh!

Yong Zhang (yonzhan) commented Sep 14, 2026

Uh oh!

Uh oh!

Zubair Abid (zubairabid) Sep 15, 2026

Choose a reason for hiding this comment

Uh oh!

Zubair Abid (zubairabid) Sep 15, 2026

Choose a reason for hiding this comment

Uh oh!

Zubair Abid (zubairabid) Sep 15, 2026

Choose a reason for hiding this comment

Uh oh!

Aditya Pujara (a0x1ab) commented Sep 16, 2026

Uh oh!

azure-pipelines Bot commented Sep 16, 2026

Uh oh!

Ethan Yang (necusjz) commented Sep 16, 2026

Uh oh!

azure-pipelines Bot commented Sep 16, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

vidyadharijami commented Sep 14, 2026 •

edited by x-engineering-agent Bot

Loading