Managed in Azure: Disaster Recovery
With the Regional recovery or Warm standby level of protection (Overview), your production environment gets a recovery setup in a second Azure region. This page explains what we set up there, what your teams prepare, and what happens when a region fails.
The setup is active-passive: your main region serves your users, and the second region takes over only when the main region, or its storage account, cannot. Your test environment has no recovery region.
Choosing the Second Region
You choose the second region, inside your residency boundary. It needs Azure Container Apps and Azure Storage.
The AI services need an account of their own outside your main region. Whatever the AI processing option, the application reaches the models through an Azure OpenAI account in your main region, and a region loss takes that account down with it. We therefore add a second Azure OpenAI account and a second Document Intelligence account, used only during a failover:
- In the second region, when it offers them.
- Otherwise, in another region you approve. With the Data zone option it lies in the same data zone, so processing stays where it already was. Australia Southeast offers neither service, so for Australia East the failover accounts are outside Australia: with Global or Data zone the models already process requests outside Australia, but OCR then does too.
- With the Provisioned option, the reserved capacity exists only in your main region, so AI processing stops while that region is down.
What We Set Up
| Regional recovery | Warm standby | |
|---|---|---|
| Your documents and results | Copied continuously to a storage account in the second region | Same |
| Key Vault, Redis, registry | Created in the second region during recovery | Already running in the second region |
| The application | Rebuilt in the second region by a tested script | Already running there, on the same release as production |
| Switching users over | We rebuild, then point your hostname at the second region | Automatic, driven by health checks on both regions |
| RTO / RPO for region loss | 4 h / 1 h | 1 h / 15 min |
Every release reaches the standby through the same pipeline and at the same time as production, so the two never drift apart.
Health-checked switching for a private application happens inside your network. We agree with your network team where it takes place: in your internal DNS, or in a load balancer or application gateway you already run in front of internal applications. Your users keep the same hostname.
What Your Teams Prepare
The second region needs the same as the main one (Setup Guide, Step 2.4):
- Subnets: an application subnet and a private-endpoint subnet in the second region, connected to your corporate network.
- Outbound rules: the same destinations, from the second region's application subnet, with
Storage.<second-region>in place of the main region's storage tag. - DNS: your private DNS resolves the second region's private endpoints and application address.
- Hostname and certificate: the production hostname and certificate are reused; nothing new to issue.
- Azure Policy: resources may be created in the second region.
- AI quota: quota for the failover AI account, in the region where it runs. We tell you the amounts.
When a Region Fails
- We declare a recovery event and tell you, with the time it started.
- Users are switched to the second region: automatically with Warm standby, or once the rebuild completes with Regional recovery.
- We point the application at the copy of your data in the second region and scale it to production size.
- Work in progress resumes on its own. Transactions that were running are picked up again from their last completed step.
A storage account outage in the main region, with the region otherwise healthy, takes the same path from step 3: the application switches to the copy of your data.
Returning to the Main Region
The copy runs one way, from the main region to the second. Documents written in the second region during a failover do not flow back by themselves. When the main region is healthy again, we copy those changes back, confirm nothing is missing, and switch users back in a window agreed with you.
Recovery Tests
We rehearse a full recovery once a year: failover, work resuming, and return to the main region. We measure the recovery time and the data loss against the targets above, and share the results under NDA. Your team is welcome to take part.
Costs
The second region's resources and the failover AI accounts are created in your subscription and billed to you by Azure. AI accounts with no traffic cost nothing on the pay-per-use options. With Regional recovery that is mainly the storage copy; the application is created only during a recovery. With Warm standby it is a second, smaller running environment.