How to do air gap in cloud?

@xiwen you could consider leveraging the immutability features of the specific cloud provider who are supported by Commvault. this will protect against data deletion and it also prevents someone from deleting a storage account. 

Azure storage account provide “Data Protection” feature, like enable soft delete for container and blob， etc, what is best pracrice?

There were/are public cloud architecture guide for both Azure and AWS giving some guidance how to build well architectured Commvault infrastructures on AWS and Azure see for the latter:

https://documentation.commvault.com/2022e/assets/pdf/public-cloud-architecture-guide-for-microsoft-azure11-25.pdf

could you guide which page list well architecture for Azure air gap on your link? couldn’t find it

Page 30 of the doc covers WORM (i.e immutable storage) that will prevent anyone from deleting data for the defined period.

Network based airgap solutions can be find on this page. Also consider that Commvault can write data directly to azure without a Media Agent in the cloud - which is also way more cost effective.

Thanks for your guide on the link. For the first option, we use Azure VWAN to connect two regions, how to connect server A to server B in two different region by Azure backbone?

Air gapping can be achieved by using one of the following methods:

• Use VM power management to automatically shut down a MediaAgent virtual machine when not in use.

• Create blackout windows on storage targets or network devices using scripts and workflows.

You connect server A to server B by routing the traffic through the Azure VWAN connection. As for your definition of air gapping.; well you can use power management to further reduce the chance of someone taking over the MA. Not sure what you are thinking to accomplish with a blackout window on a storage target or network device, but just take some time to read through the documentation and the information provided and otherwise please talk to your account team or get some assistance. 

Here is a white paper that may offer some insight, 

Immutable Backups To The Cloud With Commvault - Commvault