What the council actually did
Southend-on-Sea City Council is the local authority for a city in Essex, and Veeam says it serves roughly 180,000 people. The council's security team made immutable backups a requirement. Senior Infrastructure Engineer Richard Roberts said that wasn't negotiable: vulnerable residents depend on council services, so delayed access to data or data loss "isn't an option."
The reported estate looks like this:
- The council started with Veeam protecting about 500 on-premises VMware virtual machines.
- Over time it moved workloads to the cloud. It now has around 100 VMs on-premises and around 100 in Microsoft Azure. These are approximate figures from the case study, not a precise inventory.
- Veeam Data Cloud Vault is now the off-site, immutable, air-gapped repository for the Azure backups.
- Before the vault, Roberts said, all backups sat at two local sites. The council now has a copy in a secure location "far from Essex."
- The case study lists three Veeam products: Veeam Data Platform, Veeam Data Cloud for Microsoft Azure and Veeam Data Cloud Vault.
The reported vault use is specifically for Azure backups. The materials don't say the vault holds the on-premises VMware backups, or that it replaced the council's whole backup architecture.
How the vault works, from Veeam's documentation
Veeam's documentation describes the Azure-side technology. Vault storage is a folder in an immutable blob container in the Cool access tier. Veeam Backup for Microsoft Azure stores image-level backups of Azure VMs, Azure SQL databases, Cosmos DB for PostgreSQL and MongoDB accounts, and virtual network configuration copies there. These are product capabilities. The council hasn't said it protects every one of those workload types.
Several points matter to administrators:
- Managed by Veeam. The Azure storage accounts behind the vaults are managed by Veeam, so you can't configure their settings through the Veeam Backup for Microsoft Azure Web UI or the Vault customer portal. This fits Roberts's comment that Veeam handles Vault maintenance and updates. It also means you give up some control.
- Separate from your tenant. Veeam's marketing and community material describes the vault as logically air-gapped offsite, away from your production environment. One Veeam community post notes it is "not manageable through the subscription for your Azure account".
- Encryption. Veeam documentation says encryption can be enabled at the vault level in Veeam Backup for Microsoft Azure. A Veeam community post for the Backup & Replication integration says encryption must be enabled for every job that targets the vault. The council hasn't disclosed its own settings.
- Immutability can't be switched off. Veeam's product page says backups in the vault are immutable by default and immutability cannot be turned off.
What "immutable" does and doesn't mean
Immutable doesn't mean forever. Veeam's Azure documentation says immutable storage prevents objects from being deleted or overwritten for a specific immutability period, and that the period is set from the retention policy in the backup policy. It adds that nobody can delete the protected objects early, including the Global Administrator in your Microsoft Entra ID, and support can't do it either.
That is the property a ransomware operator with stolen admin credentials runs into. It is also the property that causes surprises. If someone misconfigures retention, or backs up something they shouldn't, they can't remove the data until the period expires. Veeam's marketplace listing for the vault tier gives a 30-day minimum retention. The council hasn't disclosed its retention period, storage edition, region or redundancy settings, so none of those should be assumed.
Reported benefits and what's missing
Roberts credits Veeam with better reliability and easier setup and management of backup jobs than the previous product. He also said a Veeam specialist helped optimise the Azure implementation. The specialist showed the team how to find places where it was taking too many snapshots, so it could cut costs while keeping enough protection for its most important data.
There are no figures behind any of that:
- No savings amount is given.
- There is no before-and-after recovery time.
- No outage reduction is reported.
- No independent audit or test of a restore is mentioned.
The costs and results are the council's own statements in a vendor-published case study. It's reasonable to treat them as a practitioner's view, not as a benchmark.
The previous backup supplier is unknown
Neither Veeam nor the council has named the product that was replaced. Blocks & Files speculated from Roberts's LinkedIn history, which lists several older backup products, that it might have been Backup Exec or NetBackup. A list of past experience doesn't show which product the council was running. Nothing in the council's account ties this deployment to Backup Exec's sales wind-down, or to any wave of migrations. Treat that as conjecture from the original report.
Backup Exec's lifecycle is a separate matter. Blocks & Files reports that new sales ended on 31 March 2026, with support continuing to 30 April 2029. Support dates are version-specific, so anyone running Backup Exec should check their exact version before assuming that date applies.
Practical takeaways for Azure admins
- Keep a copy outside your own tenant. Roberts described moving from two local sites to a copy far from Essex, and the Azure copy sits outside the council's own control plane. Admin-level compromise of production shouldn't be able to reach it.
- Decide retention before you enable immutability. Because early deletion isn't possible, retention length is both a security setting and a cost setting.
- Understand the trade-off of a managed vault. You gain less operational work. You lose the ability to tune the underlying Azure storage accounts yourself.
- Check supported workloads and versions. Veeam's community material says the Backup & Replication integration needs Veeam Backup & Replication 12.1.2 (build 12.1.2.172) or later. That post is old, so verify current requirements against current documentation.
- Review snapshot frequency. The council says it found savings by finding places it was taking too many snapshots. That is generally a useful audit for any Azure backup estate.
The story is a modest one: a council with a hybrid estate gets an extra immutable layer for its Azure backups. The supported facts are the hybrid estate, the council's immutability requirement and the vault design. The claims about better reliability and lower cost are the customer's and vendor's, with no figures to back them up.