# Synology NAS Offsite Backup with Hyper Backup to Cloud Storage

> Set up an offsite copy of your Synology NAS with Hyper Backup and Azure Blob Storage: prepare the storage account, protect the key, and plan versions and restores.

Source: https://www.epifive.com/blog/synology-nas-offsite-backup-hyper-backup · Published 2026-10-25 · EpiFive

## Key takeaways

- Hyper Backup supports Microsoft Azure as a destination for folder and package backups, alongside S3-compatible storage, Synology C2 Storage and others.
- Folder and package backups use file-level deduplication, are incremental, and can be encrypted client-side with AES-256 before upload.
- A task keeps up to 65,535 versions, and rotation or Smart Recycle policies stop old versions from filling the storage account.
- Azure access keys give full access to the storage account, so limit who sees them and rotate them using the secondary key.
- Run a scheduled integrity check and perform a real test restore, because a backup you have never restored is not proven.

Hyper Backup can send a Synology NAS's shared folders and packages to Microsoft Azure Blob Storage on a schedule, encrypting the data on the NAS first and keeping a rotating set of versions. That gives a small office an offsite copy that survives theft, fire, ransomware on the NAS or a failed volume. The setup has three parts: prepare the Azure storage account, create the Hyper Backup task on the NAS, and test a restore.

This guide is for small business owners and part-time administrators who run a Synology NAS as a file server and have no offsite backup yet. By the end you will have a storage account configured sensibly, a backup task with encryption and version rotation, and a restore test routine.

## What Hyper Backup can and cannot back up

According to Synology's DSM 7.4 Hyper Backup specification:

| Backup type | Possible destinations |
| --- | --- |
| Entire system | Remote Synology NAS, Synology C2 Storage |
| Folders and packages | Local shared folders, external devices, remote Synology NAS, rsync servers, Synology C2 Storage, and cloud services including Microsoft Azure, S3 storage and other S3-compatible destinations, Google Drive and Dropbox |
| LUNs | Remote Synology NAS, local shared folders, or USB external devices |

Two consequences follow. A whole-system image cannot go to Azure, so plan on backing up folders and packages. And the cloud destination is for backup data in Hyper Backup's own format, not a browsable mirror of your files. You restore through Hyper Backup, not by opening the container in a browser.

Other behaviours from the same specification worth knowing:

- Folder and package backups use file-level deduplication, and all backups are incremental.
- Client-side compression reduces storage use.
- Interrupted tasks resume without retransferring data already backed up.
- Encrypted shared folders can be backed up only while they are unlocked.
- WriteOnce (WORM) protection is lost for folder and file backups.
- The destination needs at least 8 GB of available space, and only one task per backup source runs at a time.

## Prerequisites

- A Synology NAS running a DSM version with Hyper Backup installed.
- An Azure subscription and permission to create a storage account.
- A decision on what to back up. Start with business shares and the packages that hold configuration, and leave out data you can recreate.
- Enough upload bandwidth. The first backup copies everything, so it can take days on a slow line. Later runs are incremental.

## Step 1: Create the Azure storage account

Create a standard general-purpose v2 account. In the Azure portal the name must be unique across Azure, between 3 and 24 characters, with only numbers and lowercase letters. With the Azure CLI:

```bash
az storage account create \
  --name contosonasbackup01 \
  --resource-group nas-backup-rg \
  --location eastus \
  --sku Standard_LRS \
  --kind StorageV2 \
  --min-tls-version TLS1_2 \
  --allow-blob-public-access false
```

Choose the redundancy to match the value of the data. The Azure documentation lists locally redundant (LRS) and geo-redundant options, among others; geo-redundant storage costs more. For an offsite copy of an office share, LRS in a different region from the office is a common minimum, but pick what your recovery needs justify.

### Keep the default access tier online

New general-purpose v2 accounts default to the hot tier. Azure documents cool and cold tiers with minimum retention periods of 30 and 90 days, and an archive tier that is offline: a blob in the archive tier cannot be read until it is rehydrated, which can take up to 15 hours. Early deletion charges apply if you delete or move blobs before the minimum period. Hyper Backup deletes old versions as it rotates them, so a cooler tier may generate early deletion charges. Synology's Hyper Backup specification does not state that archived blobs are supported for a destination, so do not use lifecycle rules that move this data to the archive tier. Start with hot, check the bill after a month, and only then consider cool.

### Turn on soft delete

Blob soft delete keeps deleted or overwritten data for a retention period you choose, between 1 and 365 days. It protects an individual blob from accidental deletes, and Microsoft recommends enabling container soft delete as well. Soft-deleted data is billed at the same rate as active data until it expires, and Microsoft suggests starting with a short retention period and a minimum recommended period of seven days. This is a second line of defence if a mistake or an attacker deletes backup data from the account.

## Step 2: Get access details and protect them

Hyper Backup needs credentials to write to the storage account. Azure generates two access keys per storage account. To view them in the portal, open the storage account, then under **Security + networking** select **Access keys** and **Show keys**.

Treat these keys like a master password:

- They provide full access to the storage account data.
- Microsoft recommends Microsoft Entra ID with managed identities where possible, and Azure Key Vault for storing keys if you must use them. A NAS cannot use a managed identity, so the account key is the practical option here; keep it out of email and shared notes.
- Use only one of the two keys in the NAS, and reserve the other for rotation. To rotate, switch the NAS to the secondary key, regenerate the primary, and so on. Regenerating a key breaks anything still using it, so update the NAS first.
- Use a dedicated storage account for the NAS backup so a leaked key exposes only backup data.

## Step 3: Create the Hyper Backup task

In DSM, open Hyper Backup and create a new data backup task. The wizard walks through these decisions in order: destination type, destination credentials, what to back up, and the task settings. Choose **Microsoft Azure** as the destination and enter the details Hyper Backup requests for your storage account and container. The exact field labels depend on your DSM and Hyper Backup version, so follow the prompts and refer to Synology's Hyper Backup help for your version.

Make these choices deliberately:

| Setting | Recommendation |
| --- | --- |
| Folders | Business shares and necessary packages only |
| Client-side encryption | Enable it. Store the key or password in your password manager and on paper in a safe place away from the NAS |
| Schedule | Daily, outside business hours |
| Compression | Enable, unless the data is already compressed such as video and ZIP files |
| Version rotation | Enable. Smart Recycle keeps the earliest version from each hour, day and week; custom policies can hold up to seven rules |
| Integrity check | Schedule a periodic check of data and index integrity |

Synology states that the encryption uses AES-256 and ECC Curve25519. Without the key or password you cannot restore from an encrypted backup, so losing it is the same as losing the backup. Write it down before the first run.

## Step 4: Run the first backup and watch it

The first backup copies the full selection. Leave it running and check the task status in Hyper Backup. Interrupted tasks resume without re-sending data already uploaded, so a dropped connection is not a reason to start over.

After it finishes, look at the storage account in the Azure portal and confirm that the container holds data. Then check the cost view for the resource group after a few days. The charges are capacity, transactions, and any data egress when you restore; Azure bills outbound data transfer out of a region per gigabyte.

## Step 5: Test a restore

A backup is only proven when you have restored from it.

1. In Hyper Backup, use the restore option on the task and select a single folder or file.
2. Restore it to a different location on the NAS, not over the original.
3. Open the restored files and confirm they are complete.
4. Repeat quarterly, and after any change to encryption keys, destinations or DSM upgrades.
5. Run a full disaster scenario at least once: assume the NAS is gone, and write down what you would need (the Azure access key, the encryption password, a replacement NAS) and where each item is stored.

Entire-system restores are not available from a folder-and-package Azure backup, so your disaster plan is: buy or borrow a Synology, install DSM, install Hyper Backup, and restore folders from the cloud task. Keep a record of the shared folder names, permissions and installed packages, because a restore returns data but you will rebuild users and settings.

## Troubleshooting

| Symptom | Likely cause | What to do |
| --- | --- | --- |
| Task fails to connect to Azure | Wrong or regenerated access key, or the account blocks the NAS network | Check the key in the portal under **Access keys**, and any storage firewall settings |
| Backup is very slow | Upload bandwidth, or first full run | Schedule overnight and allow days for the first run |
| Task cannot start because another is running | Only one task per source runs at a time | Reschedule so tasks do not overlap |
| Storage cost grows unexpectedly | Too many versions, long soft delete retention, overwritten data retained | Tighten version rotation and shorten soft delete retention |
| Backup of encrypted shared folder is empty or skipped | The folder was locked | Unlock encrypted shared folders at backup time |
| Cannot restore after rebuilding NAS | Encryption key or password is lost | There is no workaround; keep the key outside the NAS |

## Closing checklist

- Create a dedicated Standard general-purpose v2 storage account in a different region.
- Enable blob soft delete and container soft delete.
- Store the Azure access key safely; plan its rotation.
- Create the Hyper Backup task with client-side encryption, a daily schedule and version rotation.
- Store the encryption key separately from the NAS.
- Schedule an integrity check and run a test restore every quarter.

For another view of the same problem, see [NAS vs cloud storage for a small business](https://www.epifive.com/blog/nas-vs-cloud-storage-small-business) and [Azure VM backup with Recovery Services vaults](https://www.epifive.com/blog/azure-backup-vm-recovery-services-vault).

## References

- Hyper Backup specification, DSM 7.4: https://www.synology.com/en-global/dsm/7.4/software_spec/hyper_backup
- Hyper Backup feature overview: https://www.synology.com/en-global/dsm/feature/hyper_backup
- Access tiers for blob data: https://learn.microsoft.com/en-us/azure/storage/blobs/access-tiers-overview
- Soft delete for blobs: https://learn.microsoft.com/en-us/azure/storage/blobs/soft-delete-blob-overview
- Manage account access keys: https://learn.microsoft.com/en-us/azure/storage/common/storage-account-keys-manage
- Create an Azure storage account: https://learn.microsoft.com/en-us/azure/storage/common/storage-account-create

## Frequently asked questions

### Can Hyper Backup back up a Synology NAS to Azure?

Yes. Synology's DSM 7.4 Hyper Backup specification lists Microsoft Azure among the cloud services supported for folder and package backups, along with S3 storage and other S3-compatible destinations, Google Drive, Dropbox and Synology C2 Storage. Whole-system backups are limited to a remote Synology NAS or C2 Storage.

### Does Hyper Backup encrypt data before it leaves the NAS?

Hyper Backup supports client-side data encryption and transfer encryption, both using AES-256 and ECC Curve25519 according to Synology's specification. If you enable client-side encryption, store the encryption key or password safely outside the NAS, because you need it to restore.

### How many versions does Hyper Backup keep?

A task can retain up to 65,535 versions. Version rotation deletes the earliest versions first when the limit is exceeded, and Smart Recycle keeps the earliest version from each hour, day and week. Custom retention policies can contain up to seven rules.

### Is a Hyper Backup copy in the cloud enough on its own?

It is the offsite copy, but you also need a tested restore. Hyper Backup can check integrity of earlier versions, but only a real restore proves you can get files back. Keep the NAS itself as the working copy and the cloud task as the separate offsite copy.