Moving the \u201ccrown jewels\u201d of the enterprise\u2014Oracle E-Business Suite (EBS)\u2014to the cloud isn\u2019t fundamentally a latency or cost project. It\u2019s a risk management project. It\u2019s about building a multi-layered defense against four distinct threats:<\/p>\n\n\n\n
A modern resilience strategy must address all four. In this post, we’ll walk through the deliberate architectural choices you must make across both the database and application tiers to build a truly resilient EBS deployment on Oracle Database@Azure.<\/p>\n\n\n\n
As we established in Part 1, your EBS stack on Database@Azure spans two operational planes: the application tier runs on standard Azure VMs, and the database tier runs on OCI-managed Exadata hardware colocated inside Azure datacenters.<\/p>\n\n\n\n
From a security perspective, this is a powerful design. The administrative separation between the Azure and OCI control planes creates a natural segmentation that can disrupt an attacker’s lateral movement. A compromised account in your Azure environment does not automatically grant administrative access to the underlying database infrastructure or its backup policies. This isolation is a foundational element of your cyber-resilience strategy.<\/p>\n\n\n\n
Let’s break down the specific layers of protection.<\/p>\n\n\n\n
Having Transparent Data Encryption (TDE) enabled on your EBS database is table stakes. The real architectural choice is deciding where your TDE master encryption keys (MEKs) live\u2014and understanding the operational tradeoffs you are accepting.<\/p>\n\n\n\n
In Database@Azure, there are three practical key management options:<\/p>\n\n\n\n
\nThe Critical Nuance You Cannot Ignore:<\/strong>\u00a0If you choose Azure Key Vault for TDE key management, this decision has a critical, non-obvious impact on your disaster recovery strategy.\u00a0As of this writing, cross-region Data Guard scenarios are not supported with AKV-managed keys in this service context.<\/strong>\u00a0Same-region DR patterns are still viable, but do not commit to AKV before aligning it tightly with your DR topology. This is the exact detail that separates \u201cwe encrypted the database\u201d from \u201cwe can actually recover the business under pressure.\u201d<\/p>\n<\/blockquote>\n\n\n\n
Layer 2: High Availability & Disaster Recovery (The MAA Framework)<\/h5>\n\n\n\n
Oracle Maximum Availability Architecture (MAA) isn\u2019t just a marketing label; it\u2019s a prescriptive engineering framework. For EBS on Database@Azure, this translates into two key tiers:<\/p>\n\n\n\n
MAA Silver (RAC-based HA):<\/strong> This is about resilience against component failure<\/em> and minimizing planned downtime<\/em>. Anchored by Oracle RAC on Exadata, the goal here is continuous availability. It provides transparent failover for node or instance failures and enables rolling maintenance patterns that eliminate the “no drama” maintenance windows that ERP teams covet.<\/p>\n\n\n\n
MAA Gold (Data Guard-based DR):<\/strong> This is about resilience against site failure<\/em>. This tier adds Active Data Guard to create a physically separate, synchronized copy of your production database. While commonly deployed across Availability Zones within the same region for low-latency failover, Gold is essential for true cross-region DR. For cross-region designs, transport typically runs asynchronously (or uses a Far Sync pattern) to avoid impacting production transaction commit times.<\/p>\n\n\n\n
Layer 3: Cyber-Resilient Backups (Oracle\u2019s Recovery Service)<\/h5>\n\n\n\n
The correct, full name of the database backup and recovery solution is\u00a0Oracle Database Zero Data Loss Autonomous Recovery Service<\/strong>. It is built on proven Zero Data Loss Recovery Appliance technology and delivered as a fully managed cloud service.<\/p>\n\n\n\n
This service fundamentally changes the ransomware conversation, but only if you understand two key details:<\/p>\n\n\n\n
1. Real-Time Protection is a Choice<\/h6>\n\n\n\n
The \u201c< 1 second\u201d Recovery Point Objective (RPO) claim is entirely real\u2014but it is conditional<\/strong>. It requires you to enable real-time data protection<\/em>, which continuously streams redo changes to the recovery service. Without this enabled, you are operating closer to a traditional scheduled backup model (e.g., a 15-minute RPO). The distinction matters immensely: \u201cWe bought Recovery Service\u201d and \u201cWe enabled real-time protection\u201d represent two very different security postures.<\/p>\n\n\n\n
2. Immutability and Validation<\/h6>\n\n\n\n
The service provides two game-changing anti-ransomware capabilities:<\/p>\n\n\n\n
\n
- Database-Aware Validation:<\/strong>\u00a0Backups are validated continuously and automatically\u00a0without consuming your production database CPU<\/em>. This permanently removes the classic excuse that \u201cwe don\u2019t test restores because it impacts performance.\u201d<\/li>\n\n\n\n
- Retention Lock & Immutability:<\/strong>\u00a0Policy-based protections create a virtual air gap, making it exceedingly difficult for a compromised admin account to delete or tamper with backups before a recovery can be executed.<\/li>\n<\/ul>\n\n\n\n
\nCrucial Distinction:<\/strong>\u00a0Sub-second RPO is not sub-second RTO. A near-zero Recovery Point Objective (RPO) means you won’t lose data. A fast Recovery Time Objective (RTO) means you’ll be back online quickly. Restores still take time proportional to the database size and available throughput. The advantage of the Recovery Service is that you can restore to a highly precise,\u00a0trustworthy<\/em>\u00a0point in time just moments before an attack.<\/p>\n<\/blockquote>\n\n\n\n
Layer 4: Application Tier Recovery (Azure Backup + Defender for Cloud)<\/h5>\n\n\n\n
EBS isn\u2019t just a database. If ransomware encrypts the application VMs, the business is down\u2014even if the database remains pristine. While the database enjoys Oracle-native protection, the application tier should be protected with best-in-class\u00a0Azure-native<\/em>\u00a0controls.<\/p>\n\n\n\n
For the VM layer, Azure Backup<\/strong> provides critical anti-ransomware controls:<\/p>\n\n\n\n
\n
- Enhanced Soft Delete:<\/strong> Extends the retention of deleted backups (typically 14 to 180 days).<\/li>\n\n\n\n
- Multi-User Authorization (MUA):<\/strong> Implemented via Azure Resource Guard, this gates destructive operations with strict separation-of-duties controls.<\/li>\n\n\n\n
- Immutable Vaults:<\/strong> Once locked, these drastically reduce the risk of backup deletion or tampering.<\/li>\n<\/ul>\n\n\n\n
For threat detection, Microsoft Defender for Cloud<\/strong> provides the alerting layer. Its core value isn\u2019t magical auto-restoration; it provides strong, actionable ransomware signals that you can wire directly into your incident response workflows. This allows your teams to isolate compromised VMs faster and choose clean recovery points with total confidence.<\/p>\n\n\n\n
The Bottom Line<\/h4>\n\n\n\n
A resilient EBS deployment on Database@Azure comes down to deliberate choices across both planes:<\/p>\n\n\n\n
\n
- Encryption:<\/strong>\u00a0Match your key management model (Wallet, OCI Vault, or AKV) to your DR topology, paying special attention to cross-region constraints.<\/li>\n\n\n\n
- Availability:<\/strong>\u00a0Implement MAA Silver (RAC) for component resilience and MAA Gold (Active Data Guard) for true disaster recovery.<\/li>\n\n\n\n
- Backups:<\/strong>\u00a0Use Oracle\u2019s Recovery Service and be explicit about enabling\u00a0real-time data protection<\/em>\u00a0if you are targeting near-zero data loss.<\/li>\n\n\n\n
- Application Tier:<\/strong>\u00a0Protect your EBS VMs with Azure Backup’s immutability and authorization features, and use Defender for Cloud for threat detection.<\/li>\n<\/ol>\n\n\n\n
Ultimately, your RTO is only as good as your last tested restore. The combination of these services dramatically reduces the friction of testing. Don\u2019t waste that advantage.<\/p>\n\n\n\n
Up Next in Part 4:<\/strong>\u00a0A robust HA\/DR architecture isn’t just for protection; it’s a powerful tool for migration. In\u00a0EBS Platform Move<\/em>, we’ll explore how these same technologies can be used to dramatically shrink cutover windows when migrating from legacy Unix platforms to Azure Linux.<\/p>\n\n\n\n
\nE-Business Suite on Azure with Oracle Database@Azure \u2014 Series<\/strong><\/p>\n\n\n\n
\n
- Introduction:<\/strong> The Last Datacenter Exit: Migrating Oracle E-Business Suite to Azure with Database@Azure<\/a><\/em><\/li>\n\n\n\n
- Part 1:<\/strong> The EBS Cloud Reality Check \u2014 Why “Lift and Shift to VMs” Doesn’t Work for ERP<\/a><\/li>\n\n\n\n
- Part 2:<\/strong> Oracle EBS Economics: Oracle on Azure VMs vs Oracle Database@Azure \u2014 A Real TCO Comparison<\/a><\/li>\n\n\n\n
- Part 3:<\/strong> Resilient ERP \u2014 Backup, Recovery, and Cyber-Resiliency with Database@Azure<\/a><\/li>\n\n\n\n
- Part 4:<\/strong> EBS Platform Move \u2014 Unix to Azure Linux with Smaller Cutovers<\/a><\/li>\n\n\n\n
- Part 5:<\/strong> Picking the Right Database@Azure Service for EBS \u2014 Dedicated Exadata, Exascale, Base DB, and How to License Them<\/a><\/li>\n<\/ul>\n<\/div><\/div>\n\n\n\n
<\/p>\n","protected":false},"excerpt":{"rendered":"
Moving the \u201ccrown jewels\u201d of the enterprise\u2014Oracle E-Business Suite (EBS)\u2014to the cloud isn\u2019t fundamentally a latency or cost project. It\u2019s a risk management project. It\u2019s about building a multi-layered defense against four distinct threats: A modern resilience strategy must address all four. In this post, we’ll walk through the deliberate architectural choices you must make … Read more<\/a><\/p>\n","protected":false},"author":1,"featured_media":3252,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":true,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[129,10],"tags":[130,111,153,154],"class_list":["post-3208","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-multicloud-hybrid","category-ebs","tag-database-azure","tag-multicloud","tag-oracle-ebs","tag-platform-migration"],"acf":[],"jetpack_featured_media_url":"https:\/\/i0.wp.com\/bijoos.com\/oraclenotes\/wp-content\/uploads\/2026\/03\/ERP-Resiliency-with-Azure-for-Oracle-EBS.png?fit=1408%2C768&ssl=1","jetpack-related-posts":[],"jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/bijoos.com\/oraclenotes\/wp-json\/wp\/v2\/posts\/3208","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/bijoos.com\/oraclenotes\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/bijoos.com\/oraclenotes\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/bijoos.com\/oraclenotes\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/bijoos.com\/oraclenotes\/wp-json\/wp\/v2\/comments?post=3208"}],"version-history":[{"count":3,"href":"https:\/\/bijoos.com\/oraclenotes\/wp-json\/wp\/v2\/posts\/3208\/revisions"}],"predecessor-version":[{"id":3259,"href":"https:\/\/bijoos.com\/oraclenotes\/wp-json\/wp\/v2\/posts\/3208\/revisions\/3259"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/bijoos.com\/oraclenotes\/wp-json\/wp\/v2\/media\/3252"}],"wp:attachment":[{"href":"https:\/\/bijoos.com\/oraclenotes\/wp-json\/wp\/v2\/media?parent=3208"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/bijoos.com\/oraclenotes\/wp-json\/wp\/v2\/categories?post=3208"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/bijoos.com\/oraclenotes\/wp-json\/wp\/v2\/tags?post=3208"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}