Quick summary
- Azure Government is a physically isolated instance of Azure for US government workloads, with three Gov regions and two DoD regions.
- Microsoft carries FedRAMP and DoD SRG provisional authorizations at IL2, IL4 and IL5. Those belong to Microsoft, and no software you run inside them inherits the authorization itself.
- Azure Backup and Azure Site Recovery are both available in the Gov and DoD regions.
- Third-party options with Azure Government support include N2W, Veeam, Commvault and HYCU. Coverage there is usually narrower than in commercial Azure, so ask for the region-specific matrix.
- The question that decides most shortlists is whether the tool holds your data, because a vendor-operated control plane adds a boundary your ISSO has to assess.
Azure Government is a physically separate instance of Azure, operated by screened US persons, for federal, DoD and SLED workloads that cannot run in commercial regions. Backup works much as it does in commercial Azure, with two differences that matter: fewer services are available, and fewer vendors are present.
Azure Government and DoD regions
| Region | Type | Typical use |
|---|---|---|
| US Gov Virginia | Azure Government | Federal civilian, SLED, contractors |
| US Gov Texas | Azure Government | Federal civilian, SLED, contractors |
| US Gov Arizona | Azure Government | Federal civilian, SLED, contractors |
| US DoD Central | DoD | Department of Defense workloads |
| US DoD East | DoD | Department of Defense workloads |
Five regions across two tiers. The practical consequence for backup design is that cross-region DR inside the boundary is possible, and you do not have to reach into commercial Azure to get a second copy.
What Azure Government carries, and what it does not give you
Azure Government holds FedRAMP authorization and DoD SRG provisional authorizations at Impact Levels 2, 4 and 5. Microsoft also makes a set of security tooling available in the Gov regions, including Microsoft Defender for Cloud, Azure Policy, Sentinel, Monitor and Log Analytics.
All of that belongs to Microsoft. It is the reason the region is worth using, and it is not something a backup vendor can claim.
No backup product is FedRAMP authorized or IL5 authorized because it runs in Azure Government. FedRAMP and the DoD SRG authorize cloud service offerings, meaning systems a vendor operates and the government consumes. Software an agency deploys inside an environment the agency has already authorized is a component inside that boundary, assessed by the agency’s own ISSO or ISSM under an existing ATO. That is how agencies run commercial software in Gov and DoD regions without every vendor holding its own authorization.
Which makes the custody question the one that actually decides procurement. A vendor holding agency data in vendor-operated storage needs its own authorization. A tool that never takes custody adds no new boundary.
Backup options for Azure Government and the DoD regions
| Tool | Type | Gov and DoD regions | Runs inside your subscription | Takes custody of your data |
|---|---|---|---|---|
| Azure Backup | Microsoft native | Yes, available in US DoD and Azure Government regions | Yes, Recovery Services vault in your subscription | No |
| Azure Site Recovery | Microsoft native | Yes | Yes | No |
| N2W | Third-party software | Yes, all USGov and DOD regions | Yes, VM in your subscription | No |
| Veeam | Third-party software | Yes | Yes, self-deployed | No |
| Commvault | Third-party platform | Only USGov Virginia supported | Depends on deployment model | Depends on deployment model |
| HYCU | Third-party SaaS | Yes, dedicated Azure Gov offering | No, SaaS control plane | Control plane only |
One pattern worth naming: several vendors treat Azure Government as a checkbox on a marketing page without publishing a region-specific support matrix. Ask for one. “We support Azure Government” and “we support Azure SQL Managed Instance in US DoD East” are very different statements.
What backing up in Azure Government actually involves
Service availability is the first constraint, not the vendor
Azure Government does not carry every Azure service, and the ones it does carry sometimes arrive late. Before choosing a backup tool, list the workloads you actually run and check each one against the Gov region availability list. A tool that supports a service Azure Government does not offer in your region is not a tool that helps you.
Your identity boundary does not cross over
Azure Government uses a separate Entra ID tenant from commercial Azure. Tooling, service principals and role assignments do not follow you in. A backup deployment in Azure Government is a fresh deployment with its own identities, not an extension of the commercial one.
Backups are part of your authorization package
Auditors reviewing a Gov or DoD environment ask where every copy of the data goes. Backups included. Whatever tool you choose, you should be able to trace production through to the last retained copy without leaving the boundary, and produce evidence that the path is enforced rather than intended.
DoD regions are stricter than Gov regions
IL5 workloads carry requirements that IL4 and IL2 do not, including stricter separation. If your estate spans both tiers, do not assume one backup design covers both. Confirm per tier.
What N2W does in Azure Government
N2W runs as a VM inside your own Azure Government subscription, calling standard Azure APIs through credentials you control. It never takes custody of your data or your keys, so it introduces no compliance gap at the backup and DR layer. There is no N2W-operated vault anywhere in the design, which means there is no second boundary for an assessor to work through.
Supported Azure workloads are Azure VM, Azure Managed Disk and Azure SQL. Archiving targets Azure Blob in Hot, Cool or Cold tiers, in storage you own, with the option to delete the source disk after a successful archive so you stop paying to keep both copies.
Worth stating plainly, because it gets misread: N2W archives to Azure Blob. It does not back up Blob as a workload.
What that setup gets you inside the boundary:
- Cross-region and cross-subscription recovery within Azure Government, so DR stays inside the authorization boundary.
- Immutability through Azure’s own native locks rather than a vendor layer wrapped around them.
- Dry-run DR tests that cost nothing to run, using read-only API calls. Nothing launches. Useful when DR evidence is due on a schedule rather than when you feel like producing it.
- One console across AWS and Azure, including a live protection widget showing protected and unprotected resources by type across both clouds with immutability and compliance-lock status. Reports run per cloud, so expect an AWS report and an Azure report rather than one combined view.
Note: Cross-cloud recovery runs AWS to Azure, one way, and it is Ubuntu only at v5.0. Also, N2W is agentless for crash-consistent VM and disk backups; application-consistent Windows backups use VSS through the N2W Thin Backup Agent or Azure’s equivalent management agent.
On customer proof
Many public sector environments rely on N2W to run within their isolated cloud partitions. Typically public sector environments have recovery pressure and evidence obligations that can be mitigated greatly using N2W. City of Oakland, for example runs GIS systems for its police and fire departments on cloud infrastructure with N2W and recovers the full environment in about 30 seconds, per Julian Ware, their spatial data analyst. St. John’s University restored 5 critical instances within 3 minutes across an estate of roughly 300 servers.
Choosing the right backup and disaster recovery solution
When evaluating backup solutions for Azure Government, prioritize security, simplicity, and centralized management. Every additional platform or vendor-operated control plane can introduce new access paths, integration points, and security considerations. For organizations managing both commercial and government cloud environments, fragmented consoles can also make it harder to maintain consistent protection policies, monitor backup health, and demonstrate compliance.
Azure Backup is worth considering if your workloads are limited to the Azure services it supports and its native capabilities meet your recovery requirements. However, organizations with more complex environments may benefit from a purpose-built backup solution that runs within their own cloud infrastructure and consolidates backup and disaster recovery management into a single console.
N2W is designed for this approach. It runs within your own cloud environment, keeps backup data and encryption keys under your control, and provides centralized visibility across AWS and Azure, including commercial and government environments. Rather than adding another vendor-operated SaaS control plane, N2W helps you simplify backup operations, reduce management fragmentation, and maintain control over your backup infrastructure while meeting the distinct security and compliance requirements of each environment..
Frequently asked questions
Which backup solutions support Azure Government and the DoD regions?
Azure Backup and Azure Site Recovery are available natively in both the Azure Government and US DoD regions. Among third parties, Veeam and HYCU publish Azure Government support, N2W supports it from v5.0, and Commvault has a federal practice. Coverage in the Gov and DoD regions is usually narrower than in commercial Azure, so ask any vendor for the region-specific support matrix rather than the general one.
How many Azure Government regions are there?
Five in total across two tiers: US Gov Virginia, US Gov Texas and US Gov Arizona for Azure Government, plus US DoD Central and US DoD East for Department of Defense workloads.
Is N2W FedRAMP or IL5 authorized?
No, and neither is any backup product on the strength of running in Azure Government. Azure Government holds FedRAMP authorization and DoD SRG provisional authorizations at IL2, IL4 and IL5. Those belong to Microsoft. N2W is software you deploy inside an environment your agency has already authorized, so it is assessed as a component inside your existing boundary by your own ISSO or ISSM. Because N2W never takes custody of your data or your keys, it adds no new custody to account for at the backup layer.
Can I back up Azure Government workloads to commercial Azure?
You should not plan on it. Azure Government is physically isolated with a separate Entra ID tenant, and moving protected data out of the boundary undoes the reason for being there. Design cross-region and cross-subscription copies inside Azure Government, which the five regions make practical.
Can I achive cATO using Azure Government?
Yes, Azure Government provides pre-validated security capabilities, compliance certifications, and continuous monitoring tools that can help accelerate your organization’s cATO journey. However, Azure Government itself does not automatically grant your organization cATO; government agencies and contractors must meet the applicable requirements for their DevSecOps processes and applications, either independently or by leveraging a cATO-certified entity. By building on Azure Government’s compliant infrastructure and security tools, organizations can streamline compliance efforts, strengthen continuous risk management, and reduce the time needed to achieve authorization.