Add AFS Cross Region Restore support for RSV PowerShell cmdlets

[bharatpurwar]

Description

Adds Cross Region Restore (CRR) support for Azure File Share (AFS) workload in Recovery Services Vault PowerShell cmdlets.

Changes

1. Fix Get-AzRecoveryServicesBackupRecoveryPoint -UseSecondaryRegion for AFS

File: RecoveryServices.Backup.Providers/AzureWorkloadProviderHelper.cs

• AzureFileShareRecoveryPoint was silently dropped in secondary region filter (return false)
• Added AzureFileShareRecoveryPoint case returning true (AFS has no archive tier)

2. Add CRR path in Restore-AzRecoveryServicesBackupItem -RestoreToSecondaryRegion for AFS

File: RecoveryServices.Backup.Providers/Providers/AzureFilesPsBackupProvider.cs

• Added useSecondaryRegion branch in TriggerRestore()
• Calls GetCRRAccessToken() + RestoreDiskSecondryRegion() for CRR path
• Added ALR-only validation for AFS CRR

3. Fix GetAADProperties() for AzureStorage workload

File: RecoveryServices.Backup.ServiceClientAdapter/BMSAPIs/VaultAPIs.cs

• Added AzureStorage filter case in GetAADProperties()
• Without this fix, wrong servicePrincipalObjectId was returned causing CRR jobs to hang and fail

4. Add RecoveryPointTier mapping for AFS recovery points

File: RecoveryServices.Backup.Helpers/Conversions/RecoveryPointConversions.cs

• Parse RecoveryPointTierDetails (HardenedRP, InstantRP) to set RecoveryPointTier on AzureFileShareRecoveryPoint

Testing

• Verified Get-AzRecoveryServicesBackupRecoveryPoint -UseSecondaryRegion returns 30 RPs for AFS
• Verified Restore-AzRecoveryServicesBackupItem -RestoreToSecondaryRegion triggers CRR job (Completed ~3.5 min)
• Verified Get-AzRecoveryServicesBackupJob -UseSecondaryRegion returns CRR jobs correctly
• Test setup: bhar11-crr-ccy-vault (centraluseuap) to bhar11ccytgt (eastus2euap), KeyBased SA

[azure-client-tools-bot-prd]

Thanks for your contribution! The pull request validation has started. Please revisit this comment for updated status.

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

Pull request overview

Adds Cross Region Restore (CRR) support for Azure File Share (AFS) scenarios in Recovery Services Vault backup cmdlets, aligning AFS behavior with existing CRR flows for other workloads and ensuring correct AAD properties are used for AzureStorage restores.

Changes:

• Fix secondary-region recovery point filtering to include AzureFileShareRecoveryPoint results.
• Add an AFS CRR restore execution path that acquires a CRR access token and triggers restore in the secondary region.
• Populate AFS RecoveryPointTier from RecoveryPointTierDetails, and ensure GetAADProperties() supports AzureStorage filtering.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File	Description
src/RecoveryServices/RecoveryServices.Backup.ServiceClientAdapter/BMSAPIs/VaultAPIs.cs	Adds AzureStorage query filtering in GetAADProperties() to return the correct AAD properties for CRR.
src/RecoveryServices/RecoveryServices.Backup.Providers/Providers/AzureFilesPsBackupProvider.cs	Implements CRR restore branch for AFS restores, including ALR-only validation and CRR request construction.
src/RecoveryServices/RecoveryServices.Backup.Providers/AzureWorkloadProviderHelper.cs	Ensures AFS recovery points aren’t incorrectly dropped by the secondary-region archive-tier filter.
src/RecoveryServices/RecoveryServices.Backup.Helpers/Conversions/RecoveryPointConversions.cs	Maps AFS recovery points’ tier details into RecoveryPointTier (Snapshot/VaultStandard/Both).

[Sebby37]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 3 pipeline(s).

[Copilot]

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 6 comments.

[Sebby37]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 3 pipeline(s).

[Sebby37]

Looks good! Could you take a look at the Copilot reviews and resolve them?

[bharatpurwar]

/azp run

[azure-pipelines]

Commenter does not have sufficient privileges for PR 29836 in repo Azure/azure-powershell

[bharatpurwar]

Hi, have updated and resolve the comments. please review.

[Copilot]

Pull request overview

Copilot reviewed 11 out of 12 changed files in this pull request and generated 6 comments.

Files not reviewed (1)

• src/RecoveryServices/RecoveryServices.Backup.Models/Properties/Resources.Designer.cs: Generated file

[Copilot]

Pull request overview

Copilot reviewed 11 out of 12 changed files in this pull request and generated 3 comments.

Files not reviewed (1)

• src/RecoveryServices/RecoveryServices.Backup.Models/Properties/Resources.Designer.cs: Generated file

[Copilot]

Pull request overview

Copilot reviewed 11 out of 12 changed files in this pull request and generated 1 comment.

Files not reviewed (1)

• src/RecoveryServices/RecoveryServices.Backup.Models/Properties/Resources.Designer.cs: Generated file

Comments suppressed due to low confidence (2)

src/RecoveryServices/RecoveryServices/help/Restore-AzRecoveryServicesBackupItem.md:375

• In the example title, "Azure File share" has inconsistent capitalization compared to the rest of the document ("Azure File Share").

### Example 15: Cross Region Restore of an Azure File share to an alternate location

src/RecoveryServices/RecoveryServices/help/Restore-AzRecoveryServicesBackupItem.md:390

• In the example description, "Azure File share" has inconsistent capitalization compared to the rest of the document ("Azure File Share").

This example triggers a Cross Region Restore for an Azure File share. The first command gets the vault. The second command gets the backup item from the secondary region using `-UseSecondaryRegion`. The third command gets the secondary region recovery points. The last command restores the entire file share to an alternate location in the secondary region using `-RestoreToSecondaryRegion`. Cross Region Restore for Azure File shares supports only full-share restore to an alternate location; item-level restore and original-location restore are not supported.

[Copilot]

Pull request overview

Copilot reviewed 14 out of 15 changed files in this pull request and generated 1 comment.

Files not reviewed (1)

• src/RecoveryServices/RecoveryServices.Backup.Models/Properties/Resources.Designer.cs: Generated file

Comments suppressed due to low confidence (2)

src/RecoveryServices/RecoveryServices/help/Restore-AzRecoveryServicesBackupItem.md:375

• Help text capitalization is inconsistent in the new CRR example heading: “Azure File share” should be “Azure File Share” to match the rest of the help and product naming.

### Example 15: Cross Region Restore of an Azure File share to an alternate location

src/RecoveryServices/RecoveryServices/help/Restore-AzRecoveryServicesBackupItem.md:390

• Help text capitalization is inconsistent in the new CRR example description: “Azure File share” should be “Azure File Share” for consistent product naming.

This example triggers a Cross Region Restore for an Azure File share. The first command gets the vault. The second command gets the backup item from the secondary region using `-UseSecondaryRegion`. The third command gets the secondary region recovery points. The last command restores the entire file share to an alternate location in the secondary region using `-RestoreToSecondaryRegion`. Cross Region Restore for Azure File shares supports only full-share restore to an alternate location; item-level restore and original-location restore are not supported.

[github-actions]

‼️ DO NOT MERGE THIS PR ‼️
This PR was labeled "Do Not Merge" because it contains code change that cannot be merged. Please contact the reviewer for more information.

[Copilot]

Pull request overview

Copilot reviewed 13 out of 15 changed files in this pull request and generated 2 comments.

Files not reviewed (1)

• src/RecoveryServices/RecoveryServices.Backup.Models/Properties/Resources.Designer.cs: Generated file

Comments suppressed due to low confidence (3)

src/RecoveryServices/RecoveryServices/help/Restore-AzRecoveryServicesBackupItem.md:375

• The new example heading uses inconsistent product capitalization (“Azure File share”). Elsewhere in this help and in the module, “Azure File Share” is used; please keep this consistent for searchability and professionalism.

### Example 15: Cross Region Restore of an Azure File share to an alternate location

src/RecoveryServices/RecoveryServices/help/Restore-AzRecoveryServicesBackupItem.md:390

• This paragraph repeats the inconsistent capitalization (“Azure File share” / “Azure File shares”). Please use “Azure File Share(s)” consistently (matching the rest of the help text and cmdlet naming).

This example triggers a Cross Region Restore for an Azure File share. The first command gets the vault. The second command gets the backup item from the secondary region using `-UseSecondaryRegion`. The third command gets the secondary region recovery points. The last command restores the entire file share to an alternate location in the secondary region using `-RestoreToSecondaryRegion`. Cross Region Restore for Azure File shares supports only full-share restore to an alternate location; item-level restore and original-location restore are not supported.

src/RecoveryServices/RecoveryServices.Backup.Providers/Providers/AzureFilesPsBackupProvider.cs:1036

• In the -UseSecondaryRegion path, this code calls AzureWorkloadProviderHelper.ListProtectedItemsByItemNameCrr(...), which fetches each item’s ExtendedInfo via ServiceClientAdapter.GetProtectedItem(...) (primary-region ProtectedItems API) rather than a secondary-region/CRR endpoint (the helper even notes this as a bug: “below API calls should be made to secondary region”). This can cause Get-AzRecoveryServicesBackupItem -UseSecondaryRegion to return primary-region ExtendedInfo or fail if the item isn’t available/consistent in the primary region. Consider either (1) using a CRR/secondary-region GET that supports expand=extendedinfo, or (2) avoiding the extra GET and returning secondary-region items without ExtendedInfo if CRR doesn’t support it.

                // 2. Filter by item name from secondary region
                itemModels = AzureWorkloadProviderHelper.ListProtectedItemsByItemNameCrr(
                    protectedItemsCrr,
                    itemName,
                    vaultName,
                    resourceGroupName,
                    (itemModel, protectedItemGetResponse) =>
                    {
                        AzureFileShareItemExtendedInfo extendedInfo = new AzureFileShareItemExtendedInfo();
                        var serviceClientExtendedInfo = ((AzureFileshareProtectedItem)protectedItemGetResponse.Properties).ExtendedInfo;
                        if (serviceClientExtendedInfo.OldestRecoveryPoint.HasValue)
                        {
                            extendedInfo.OldestRecoveryPoint = serviceClientExtendedInfo.OldestRecoveryPoint;
                        }
                        extendedInfo.PolicyState = serviceClientExtendedInfo.PolicyState.ToString();
                        extendedInfo.RecoveryPointCount =
                            (int)(serviceClientExtendedInfo.RecoveryPointCount.HasValue ?
                                serviceClientExtendedInfo.RecoveryPointCount : 0);
                        ((AzureFileShareItem)itemModel).ExtendedInfo = extendedInfo;
                    }, friendlyName);

[Copilot]

Pull request overview

Copilot reviewed 13 out of 15 changed files in this pull request and generated no new comments.

Files not reviewed (1)

• src/RecoveryServices/RecoveryServices.Backup.Models/Properties/Resources.Designer.cs: Generated file

Comments suppressed due to low confidence (1)

src/RecoveryServices/RecoveryServices.Backup.Providers/AzureWorkloadProviderHelper.cs:1050

• The new secondary-region recovery point filter now allows AzureFileShareRecoveryPoint through unconditionally, but AzureFileShareRecoveryPoint.RecoveryPointTier is never populated in the conversion layer (both GetPSAzureFileRecoveryPoint and GetPSAzureFileRecoveryPointForSecondaryRegion only set FileShareSnapshotUri). This means Get-AzRecoveryServicesBackupRecoveryPoint -Tier ... will not work for Azure File Share (tier stays default), and it also contradicts the PR description that says tier mapping was added even though recoveryPointTierDetails is present in the recorded responses.

Please map recoveryPoint.RecoveryPointTierDetails (InstantRP/HardenedRP) to RecoveryPointTier for Azure File Share recovery points in RecoveryPointConversions.cs (primary + secondary-region conversions), similar to the existing mapping logic used for Azure Workload recovery points.

                        if (recoveryPoint.GetType() == typeof(CmdletModel.AzureFileShareRecoveryPoint))
                        {
                            //no archive tier currently for AFS, so return true for all RPs
                            return true;
                        }

[Sebby37]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 3 pipeline(s).

[hiaga]

Approach is sound — the  GetAADProperties  AzureStorage fix is the right root cause, and the ALR-only / no-item-level guards are good. See inline comments for the substantive items. Three quick notes:

• Description lists a  RecoveryPointConversions.cs  RP-tier change that isn't in the diff — please update the description or restore it.
• The  // code should never reach here...  comment in  ListProtectedItemsByItemNameCrr  is now false, and its  as -cast can NRE — worth cleaning up.
• The ExtendedInfo lambda is duplicated across the CRR/non-CRR branches; consider extracting it

[hiaga]

Soft-delete parity: primary ctor sets DateOfPurge/SoftDeleteRetentionPeriodInDays, but the CRR ctor leaves them null. Please compute DateOfPurge here so secondary-region items match.

[hiaga]

ListProtectedItemsByItemNameCrr reads ExtendedInfo from the primary region (helper's own // bug). This PR first activates that path for AFS, so -UseSecondaryRegion will show primary data or fail in a real DR outage — please fix or track explicitly.

[hiaga]

This JSON serialize/deserialize bridge silently drops fields if the two models diverge. Please null-check the result and validate key fields (TargetDetails, SourceResourceId) survived.

[hiaga]

Two gaps: (1) target-SA region is not validated (the adapter skips the check for AzureStorage), and (2) the MUA auxiliaryAccessToken is dropped here. Please add a region check and either forward the token or fail explicitly.

[hiaga]

Assert-NotNull passes for an empty array — use Assert-True { @($crrJob).Count -gt 0 } to actually guard the job.