Expose gaps in backup coverage and restore-test evidence
Get the source data and prepare the review

Documentation-checked Azure Backup VM route; other products require separate acquisition verification

WHAT WAS CHECKED
Official documentation checked; all routes are proposed and have not been run in a product account. No client data, account access, installs or account writes used. Native column names are distinguished from editorial kit contracts. Missing source evidence blocks completeness claims.

BEFORE YOU START
- Bounded implementation: Azure VMs already protected by Azure Backup in identified Recovery Services vaults, with existing Backup Reader or equivalent read access.
- Independent IT inventory of data locations, approved recovery objectives/freshness thresholds and actual restore-drill evidence. Other backup products need their own verified collection route.
- Firm-approved Excel; optional Copilot entitlement and tenant approval for the exact minimized data. Native Excel analysis can be done manually if Copilot is absent.
- Keep raw exports and identifying source pointers in a separate restricted location. The AI workbook contains only approved alias-based tables and visible policy/scope text, never raw client records on another tab.

DATA ACQUISITION LIMITS
- This route covers selected Azure Backup VM evidence only, not Microsoft 365/SaaS or every firm data location. Unacquired systems stay unknown.
- A completed job or available restore point does not prove recoverability. An actual authorized restore test with validated result is required for restore evidence; this recipe does not run one.
- The cited guide does not support exporting jobs with a filter applied. An unfiltered export is used only if available and its actual time/status coverage is checked; otherwise staff manually capture the bounded filtered view. Missing history remains unknown.

DECLARED INPUT CONTRACT
data-locations.csv: system_id, owner_alias, data_class, location_alias, approved_recovery_objective, approved_job_freshness_hours, approved_restore_review_date
backup-status.csv: system_id, job_id, coverage_status, last_success_utc, job_status, exclusions, evidence_timestamp, source_ref
restore-drills.csv: system_id, drill_date, result, evidence_ref
scope.txt

STEP 1: Inspect protected VM coverage
Tool: Azure portal / Azure Backup
Open: All services > Recovery Services vaults > selected vault > Backup Items > Azure Virtual Machine
Access needed: See prerequisites; actual subscription, tenant configuration and permissions are untested.

Open each in-scope vault and inspect the protected VM list, last backup status and latest restore point time. Record the actual VM/resource identity, policy scope and visible protection/exclusion facts. Compare with the independently maintained IT resource list; do not infer all data locations are covered by a VM backup.

Expected output: Manually captured protected-resource observations with vault/time/source reference.
Use it next: Prepare the data-location-to-protection mapping, keeping missing or unverified systems visible.
Check: Do not change policies, trigger backup/restore, stop protection or delete data.
Documentation limit: Official sources support named product features. Workflow-specific prompts, alias fields, mappings and reviewer rules are editorial adaptations, not native export promises.
Source documentation:
https://learn.microsoft.com/en-us/azure/backup/backup-azure-manage-vms
https://learn.microsoft.com/en-us/azure/backup/security-overview

STEP 2: Collect job history with an explicit coverage check
Tool: Azure portal / Azure Backup
Open: Selected Recovery Services vault > Backup Jobs > Export jobs (unfiltered, if available); bounded manual fallback: Backup Jobs > Filter > Done
Access needed: See prerequisites; actual subscription, tenant configuration and permissions are untested.

Open Backup Jobs without applying a custom filter. If Export jobs is available and succeeds, preserve its native spreadsheet with summary and per-job sheets; inspect the actual date/status coverage rather than assuming the requested period was exported. The official guide warns that filtered export is unsupported. For missing or unavailable exported scope, use Filter to choose the approved item type, operations, all required statuses and start/end period, then Done, and manually transcribe the resulting rows/details with visible job/resource identities, status, timestamps and source references. Record the exact filter, captured row count, capture time and any pagination, unreadable details or omitted periods. The default view covers 24 hours, which may be insufficient. Separately read the existing restore-drill records and actual validation outcomes. Do not configure Log Analytics or another integration to obtain data.

Expected output: Actual unfiltered native jobs spreadsheet where available, plus a bounded manual job log for verified additional scope and independent restore-drill records; a coverage note lists every unacquired period/status.
Use it next: Keep raw reports restricted and map only verified metadata.
Check: Do not promise a filtered export or full historical coverage. A restore operation marked Completed alone is not a validated recovery test. Missing or unobserved job periods are unknown, not proof of no jobs.
Documentation limit: Official sources support named product features. Workflow-specific prompts, alias fields, mappings and reviewer rules are editorial adaptations, not native export promises.
Source documentation:
https://learn.microsoft.com/en-us/azure/backup/backup-azure-manage-windows-server

STEP 3: Map the observed records to the starter input
Tool: Excel and authorized staff
Open: Separate analysis workbook > Home > Format as Table
Access needed: See prerequisites; actual subscription, tenant configuration and permissions are untested.

Populate data-locations.csv from the independent IT inventory and approved objectives. Map backup-status.csv to actual system_id/job_id,coverage_status,last_success_utc,job_status,exclusions,evidence_timestamp,source_ref. If job completion time/ID is not observable, keep it unknown and retain a source-row reference; do not substitute restore-point time for job completion. Populate restore-drills.csv only from actual test records with system_id,drill_date,result,evidence_ref. Paste scope.txt, cutoff, mapping and unsupported products into Scope. Create named tables for DataLocations, BackupStatus and RestoreDrills. Put the policy and review scope in visible worksheets or paste them into the next prompt. Record whether each observation came from the actual unfiltered export or manual filtered-view capture, and paste the coverage note into Scope. Do not fill gaps with presumed successful jobs.

Expected output: DataLocations, BackupStatus and RestoreDrills with explicit unacquired systems.
Use it next: Check the mapping against each original source before using AI.
Check: Aliases and missing policy fields are staff-created; do not relabel a native export as the kit schema. Unknown stays blank/unknown, not false or zero.
Documentation limit: Official sources support named product features. Workflow-specific prompts, alias fields, mappings and reviewer rules are editorial adaptations, not native export promises.
Source documentation:
https://support.microsoft.com/en-us/excel/tutorial-import-data-into-excel-and-create-a-data-model

STEP 4: Review the bounded evidence with Copilot
Tool: Excel Copilot, optional
Open: Approved analysis workbook > Copilot icon at lower right > Chat only
Access needed: See prerequisites; actual subscription, tenant configuration and permissions are untested.

Use Chat only and submit the prompt. Without Copilot: join the inventory to observed coverage/jobs, then check actual restore-test records against approved review dates.

PASTE THIS PROMPT
Compare DataLocations, BackupStatus and RestoreDrills by verified system_id under Scope. List observed covered, explicitly excluded, unacquired/unknown systems, failed/stale jobs under approved thresholds and missing/failed/outdated restore-test evidence. Cite timestamps and source refs. A green job or restore point does not prove recoverability or meet an RTO/RPO by itself. Do not change settings, run restores, recommend deletions or promise protection.

Expected output: IT backup-evidence gap list.
Use it next: Copy the draft exception list to the reviewer; retain row references.
Check: Check every flagged row and the scope. A fluent answer is not evidence of completeness; no automatic workbook or source-system edits.
Documentation limit: Official sources support named product features. Workflow-specific prompts, alias fields, mappings and reviewer rules are editorial adaptations, not native export promises.
Source documentation:
https://support.microsoft.com/en-us/excel/copilot/get-started-with-copilot-in-excel
https://support.microsoft.com/en-us/excel/copilot/frequently-asked-questions-about-copilot-in-excel

STEP 5: Approve the review result
Tool: Responsible staff reviewer
Open: Reviewed local worksheet
Access needed: See prerequisites; actual subscription, tenant configuration and permissions are untested.

IT validates the scope and every gap, especially data locations outside the selected Azure VMs. Any new backup setup or recovery drill is planned and authorized separately.

Expected output: Reviewed coverage and restore-evidence questions.
Use it next: Any external message, source change, payment or deletion requires its own authorized process.
Check: No all-clear is possible while required systems, job history or validated restore evidence are missing.
Documentation limit: Editorial human-review gate; linked Excel documentation supports the worksheet used, not legal or accounting conclusions.
Source documentation:
https://support.microsoft.com/en-us/excel/tutorial-import-data-into-excel-and-create-a-data-model

ACCOUNT AND SOURCE CHECKS STILL NEEDED
- Actual account access, plan and source-data completeness have not been tested.

USING THE FILES IN THIS KIT
Use the exact files or source text named in the steps above. Native exports keep their own headers. The kit tables are editorial review worksheets; they are not a claim that a product exports those fields. Some routes use reviewed text directly or require additional original files. Never rename an unreviewed raw export to make it appear mapped. Keep expected-result files separate from inputs.

The source account, actual data, prompts and end-to-end workflow were not tested. Any final communication, filing, permission change, payment or publication needs its own authorized human action. This guide performs none.
