1. **Region pairs.** Deploy prod across a paired region pair (e.g. East US / West US). Pairs get platform-prioritized recovery and some services (like geo-redundant storage) only replicate within the pair.
2. **Backups per service:**
- Azure SQL: PITR is automatic; long-term retention needs a policy.
- VMs: Azure Backup vault + policy, off by default. Enable at VM creation.
- Storage: soft delete + versioning + GRS/RA-GRS for the accounts that matter.
- Key Vault: soft delete is on; purge protection for prod.
- AKS: Velero or Azure Backup for AKS for cluster state; node pools are cattle.
3. **Failover mechanics:** Traffic Manager / Front Door for DNS-level failover; Cosmos DB automatic failover with grace period; SQL auto-failover groups.
4. **Runbook.** One page: who declares, the exact commands/portal clicks in order, how to verify, how to fail back. Include the "is it really down" check (status page + alternate region probe) before declaring.
5. **Rehearse.** Game day twice a year: actually fail over staging, actually restore a backup to a new resource. Every rehearsal finds something the runbook got wrong.
Traps:
- Assuming geo-redundant storage = application DR. Data survives; the app still needs to run somewhere.
- Failover tested = "we read the docs". The first real failover always surfaces DNS TTL, hardcoded region endpoints, and sticky sessions.
- Backups succeeding but unrestorable: test restores, not just backup jobs.
Verify: last game-day date and findings doc exist; backup policies show successful recent jobs; failover runbook opens with current resource names.