Configure Custom Storage Location for Your Backup Data

To view the information about the storage location where your backup data resides, navigate to Settings > General > Storage location.

If you are currently using the Default storage location and you want to use your own storage afterward, you can contact AvePoint support to update your subscription, and then follow the steps below to change the storage location to your own storage.

*Note: The changes from the default storage to a custom storage cannot be reverted, and the custom storage cannot be changed to another custom storage once saved.

In your own storage location, for security concerns, the storage firewall may have been set up to only allow trusted clients. To ensure the Cloud Backup for Google Workspace service can access your storage, you must complete the corresponding settings in Allow AvePoint Agent Servers to Access Your Storage Account.
Navigate to Settings > General > Storage location and click Change to my own storage.
In the Change to my own storage pop-up window, to decide how to handle the existing backup data on the default storage, choose an option from the following:
- Retain all backup data currently stored in AvePoint’s storage until the retention time expires – The backup data in the default storage location will be retained until the retention time expires. The next backup job for each of the services in the protected scope will store the backup data in the configured custom storage location.
- Remove all backupdata from AvePoint’s storage – The backup data will be removed from the default storage location, and you cannot use the previous backup data to restore. After the storage location is changed, the backup jobs for services in the protected scope will start in a few seconds. The backup data will be stored in the configured custom storage location.
*Note: After you have changed the storage location, the backup data on the previous storage location will follow the current Retention policy.
Click OK to save the settings.

Refer to the instructions in the following sections to configure the custom storage location.

*Note: For the best network performance, we strongly recommend you use the Azure storage that is in the same data center as one of your tenants in AvePoint Online Services. Using other storages may cause higher network costs for restore.

Allow AvePoint Agent Servers to Access Your Storage Account

Complete the following settings based on your scenario:

*Note: If you are using a trial subscription and the storage account you want to use in the trial has a firewall enabled, read the conditions below and contact AvePoint Support for the corresponding reserved IP addresses or ARM VNet IDs.

- For custom storage locations of the **Microsoft Azure Blob Storage** type, configure the settings required by the conditions below:

	- If your storage account is in the same data center as the one you use to sign up for AvePoint Online Services or your storage account is in its , add the Azure Resource Manager (ARM) VNet subnets where the AvePoint agents are running on to your storage networking. You can find additional details in the Microsoft article . To get the ARM VNet subnet IDs for your data center, navigate to AvePoint Online Services > **Administration** > **Security**. For detailed instructions, refer to the following **Add ARM** **Virtual Networks** section.

	- For conditions other than the above, you need to add all the reserved IP addresses to the Azure storage firewall. For details, refer to the following **Add Reserved IP Addresses** section.

- For custom storage locations for other types, follow the steps in the following **Add Reserved IP Addresses** section to add the reserved IP addresses to your storage firewall.

Add Reserved IP Addresses

Follow the steps below:

Navigate to AvePoint Online Services interface > Administration > Security to download the list of reserved IP addresses of AvePoint Online Services. For details, refer to the section in the AvePoint Online Services user guide.
Navigate to the storage account that you want to secure.
Select Networking on the menu.
Check that you’ve selected to allow access from Selected networks.
Enter the IP address or address range under Firewall > Address Range.
Select Save to apply your changes.

Add ARM Virtual Networks

You can refer to the section in the AvePoint Online Services user guide to get the VNet IDs for your data center. There are two ways to add ARM virtual networks:

- Use the Azure CLI tool ()

	## Use the Azure CLI tool

	# Step 1 (Optional): If you have multiple Azure subscriptions, please switch to the correct subscription

	# This command sets the active subscription to the specified subscription ID.

	az account set --subscription xxxxxxxx-xxxx-xxxx-xxxx-yyyyyyyyyyyy

	# Step 2 (Optional): Confirm whether the subscription switch is correct

	# This command displays the current subscription information in a table format.

	az account show --output table

	# Step 3: Get the AvePoint Online Services network subnet resource ID

	# This variable stores the resource ID of the subnet in the virtual network.

	# Replace with the Azure Resource Manager (ARM) VNet ID downloaded from your AvePoint Online Services tenant.

	$SUBNETID="/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-yyyyyyyyyyyy/resourceGroups/ResourceGroupName/providers/Microsoft.Network/virtualNetworks/VirtualNetworkName/subnets/SubnetName"

	# Step 4: Set your resource group name

	# This variable stores the name of the resource group where your storage account is located.

	$DESTRG="customer_resource_group_name"

	# Step 5: Set your storage account name

	# This variable stores the name of the storage account to which you want to add the network rule.

	$DESTSTA="customer_storage_account_name"

	# Step 6: Add the firewall virtual network rule to grant access to AvePoint Online Services

	# This command adds a network rule to the specified storage account, allowing access from the specified subnet.

	az storage account network-rule add --resource-group $DESTRG --account-name $DESTSTA --subnet $SUBNETID

	# Step 7: List the current network rules for the storage account to verify the addition

	# This command lists the virtual network rules for the specified storage account.

	az storage account network-rule list --resource-group $DESTRG --account-name $DESTSTA --query virtualNetworkRules

	# Step 8 (Optional): Disable the public access to storage account

	# This command updates the storage account to deny public network access.

	az storage account update --resource-group $DESTRG --name $DESTSTA --default-action Deny

	# Step 9 (Optional): Verify that the default action for network rules is set to Deny

	# This command shows the network rule set for the specified storage account, including the default action.

az storage account show --resource-group $DESTRG --name $DESTSTA --query networkRuleSet.defaultAction

- Use the Azure Az PowerShell ()

	## Use Azure PowerShell (Az Module)

	# Step 1: Sign in to Azure with your Azure Admin account

	Connect-AzAccount

	# Step 2 (Optional): If you have multiple Azure subscriptions, please switch to the correct subscription

	# This command sets the active subscription to the specified subscription ID.

	Set-AzContext -SubscriptionId "xxxxxxxx-xxxx-xxxx-xxxx-yyyyyyyyyyyy"

	# Step 3: Get the AvePoint Online Services network subnet resource ID

	# This variable stores the resource ID of the subnet in the virtual network.

	# Replace with the Azure Resource Manager (ARM) VNet ID downloaded from your AvePoint Online Services tenant.

	$SUBNETID="/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-yyyyyyyyyyyy/resourceGroups/ResourceGroupName/providers/Microsoft.Network/virtualNetworks/VirtualNetworkName/subnets/SubnetName"

	# Step 4: Set resource group name

	# This variable stores the name of the resource group where your storage account is located.

	$DESTRG="customer_resource_group_name"

	# Step 5: Set storage account name

	# This variable stores the name of the storage account to which you want to add the network rule.

	$DESTSTA="customer_storage_account_name"

	# Step 6: Add the firewall virtual network rule to grant access to AvePoint Online Services

	# This cmdlet adds a network rule to the specified storage account, allowing access from the specified subnet.

	Add-AzStorageAccountNetworkRule -ResourceGroupName $DESTRG -Name $DESTSTA -VirtualNetworkResourceId $SUBNETID

	# Step 7: Verify the newly added network rule

	# This cmdlet retrieves the network rule set for the specified storage account.

	Get-AzStorageAccountNetworkRuleSet -ResourceGroupName $DESTRG -AccountName $DESTSTA

You will see the virtual network rules in Azure Portal, as the screenshot below shows. You may also notice that a warning message “Insufficient Permission…” is displayed. It is because the subnet is not in your subscription. You can ignore it.

The vNet rules.