Question about VHD Merge Process in Azure MARS Agent Incremental Backups

Tai Nguyen hi and thx for join us here at Q&A platform )))

short answer merge does not happen on compressed/encrypted blobs, what actually happens under the hood, MARS doesnt treat those VHDs like real disk files u can just merge bit by bit those “VHDs” are more like logical containers for changed blocks, flow is roughly

agent takes snapshot (VSS)

figures out changed blocks

packages them into chunks

compress + encrypt

send to vault

so what lands in Azure is already encrypted block data, not something u can directly merge like a VHD on disk

then on Azure side it does

decrypt

decompress

reconstruct block map

and updates the recovery point chain, so “merge” = not file merge, its block-level consolidation in the backup store. Think more like incremental blocks get applied to previous state to build new recovery point, so to ur questions.

Is it decompressed/decrypted before merge yes, logically inside the service pipeline, merge in encrypted/compressed form

no, not in raw form. Azure has to process it to understand blocks data integrity part.

handled by

checksums per chunk

encryption integrity checks

VSS consistency on capture

if any chunk fails validation backup fails, not partially merged

rgds,

Alex

Hello @Tai Nguyen Thank you for raising this question.

According to Microsoft Learn, during incremental backups with the Azure Backup MARS agent:

• Changed files are identified
• A new VHD is created
• This VHD is compressed and encrypted
• The encrypted data is sent to the Recovery Services vault
• After the backup completes, the new VHD is merged with the VHD created after the initial replication
• The merged state is used to determine changes for future backups

Reference cbout the MARS Agent – Azure Backup https://dotnet.territoriali.olinfo.it/azure/backup/backup-azure-about-mars

Microsoft does not provide any public documentation that describes:

• Decryption or decompression of the VHD during the merge
• Disk‑level or file‑system‑level VHD merge operations
• Internal implementation details of the merge process

Because of this, the “merge” mentioned in the documentation should not be interpreted as a traditional VHD disk merge (for example, like Hyper‑V differencing disks).

• Data is compressed and encrypted before upload
• Block‑level checksums are stored to track changes and ensure integrity
• The merged backup state is used only as a reference for incremental comparisons
• Data consistency is ensured using:
  • VSS snapshots
    • Block‑level checksum validation
      • Encrypted storage in the Recovery Services vault

No additional technical behavior beyond this is documented by Microsoft.

So, There is no Microsoft documentation stating that encrypted backup data is decrypted or decompressed for merging. The merge represents a logical consolidation of encrypted backup data and metadata, fully managed by the Azure Backup service.

I hope this clarifies the behavior described in the MARS agent documentation. If you have any further questions or need additional clarification beyond what is currently documented on Microsoft Learn, please let us know and we’ll be happy to assist.

Thanks,

Suchitra.