Overview

Continuous Data for PaaS supports sharing masked, validated datasets across different cloud accounts within the same region. This enables organizations to provision non-production databases in a separate, isolated cloud account from a masked Bookmark created in the production account — without physically copying the dataset.

Cross-account sharing is only supported within the same cloud region. Cross-region sharing is not supported in this release.

How sharing works

When a snapshot is shared from a PaaS Database or PaaS Instance time, the snapshot (and its Bookmarks) are made available to other Cloud Accounts within the same region. When a PaaS Instance or Database is provisioned or refreshed from that Bookmark, DCT orchestrates access to the shared backup using both the source and the target account's cloud credentials.

Two sharing mechanisms are used depending on the cloud provider and organizational configuration:

  • Logical sharing: The backup is made accessible to the target account without being physically copied. The non-production account provisions its database by pulling from the shared backup in the source account's storage. Lower storage cost; requires cross-account access to the backup.

  • Physical replication: The backup is copied from the source account's storage to the target account's storage during provisioning or refresh. The target account holds its own local copy of the backup during the operation which is removed upon completion. Slower and potentially higher cost than logical sharing.

The choice between logical sharing and physical replication is made automatically by DCT at provisioning time, based on the following criteria:

  • Azure SQL Managed: Uses logical sharing via Shared Access Signature (SAS) tokens for storage containers.

  • AWS RDS: Uses logical sharing when provisioning/refreshing from unencrypted manual snapshots, but uses physical replication otherwise.

Prerequisites

  • A source Cloud Account (production) and a target Cloud Account (non-production) must both be configured in DCT in the same region.

  • The source Cloud Account's IAM user (AWS) or Entra ID application (Azure) must have permissions to share backup storage with the target account.

  • For Azure SQL MI: the Azure Blob Storage Account used by the source Cloud Account must be accessible from the target account.

  • A masked, validated Bookmark must exist on the source PaaS DB or Instance with Visibility set to Public.

Steps

Create the masked Bookmark in the source account

  1. Complete the masking workflow on the golden copy in the production Cloud Account.

  2. Navigate to the golden copy PaaS DB details page.

  3. Select Actions > Create Bookmark.

  4. Configure retention and tags as needed. Submit.

  5. Once the operation has completed, navigate to the PaaS DB timeline and share the Bookmark's underlying snapshot.

The Bookmark and snapshot are now available for provision and refresh across Cloud Accounts.

Provision in the target (non-production) account

  1. Navigate to the details page of the golden copy PaaS DB in the production Cloud Account in DCT.

  2. Select Actions > Provision Instance or Provision DB.

  3. In the first step of the wizard, select to Provision to Another Cloud Account.

  4. In the point-in-time step, select Specific snapshot.

  5. The snapshot created in the previous procedure will appear in the snapshot list. Select it.

  6. Complete the remaining wizard steps and submit.

The snapshot must have been shared and both accounts must be in the same region. If the snapshot does not appear in the wizard, verify that the snapshot is shared and that both Cloud Accounts are configured in the same region.

Refreshing from a shared snapshot or Bookmark

An existing non-production database can also be refreshed to a shared Bookmark:

  1. Navigate to the non-production PaaS DB or Instance details page.

  2. Select Actions > Refresh.

  3. In the Refresh wizard, select a shared snapshot or Bookmark.

  4. Review and submit.

Last updated
Oct 8, 2026