How to back up Azure Database for PostgreSQL to Windows

Azure Database for PostgreSQL – Flexible Server backs itself up automatically and can restore to a point in time within your retention period. The catch is that a restore always creates a new Azure server, and the backups can't be downloaded. If you want a copy outside Azure, to load into a local database, keep for longer than Azure's retention, or protect against a deleted resource group, use pg_dump.

Step 1: Allow your PC through the firewall

Flexible Server blocks everything by default. In the Azure portal open your server, go to Networking, and either:

• under Firewall rules, click Add current client IP address and save, or
• if the server uses private access (VNet integration), connect from a machine inside that network (a VPN or a VM). Public firewall rules don't apply to private servers.

Your home or office IP may change; if backups start timing out, check the rule first.

Step 2: User name and SSL

• On Flexible Server the user name is plain, for example pgadmin. The pgadmin@myserver form belongs to the retired Single Server.
• SSL is required. Set PGSSLMODE=require before running pg_dump, or you'll see FATAL: SSL connection is required.

Step 3: Back it up

$env:PGSSLMODE = 'require'
& 'C:\Program Files\PostgreSQL\18\bin\pg_dump.exe' `
    -h myserver.postgres.database.azure.com -p 5432 -U pgadmin `
    -F c -f "D:\Backups\appdb-$(Get-Date -Format yyyyMMdd-HHmm).dump" appdb

Make sure your client tools are at least the server's PostgreSQL version (the Overview page shows it). The admin user on Flexible Server isn't a true superuser, but it can dump everything in databases it owns or has been granted. If you get permission denied for table …, the table belongs to a role your user can't read. Grant access, or run the backup as that table's owner.

Step 4: Schedule it

Use the script from the main Windows guide with:

$Database  = 'appdb'
$PgHost    = 'myserver.postgres.database.azure.com'
$Port      = 5432
$User      = 'pgadmin'
$env:PGSSLMODE = 'require'

and in pgpass.conf:

myserver.postgres.database.azure.com:5432:appdb:pgadmin:YOUR_PASSWORD

The script generator writes all three pieces with your values.

Microsoft Entra ID logins

If your server only allows Microsoft Entra ID (formerly Azure AD) authentication, the "password" is a short-lived access token from az account get-access-token --resource-type oss-rdbms. Tokens expire after about an hour, so a scheduled backup has to fetch a fresh one each run and put it in PGPASSWORD. For unattended backups, it's simpler to also enable PostgreSQL authentication and use a dedicated backup login.

Restoring

& "$bin\createdb.exe" -h localhost -U postgres appdb_copy
& "$bin\pg_restore.exe" -h localhost -U postgres -d appdb_copy --no-owner --no-privileges D:\Backups\appdb-20261014-0200.dump

The same command restores into another Azure server: point -h at it and set PGSSLMODE=require. Azure may refuse some extensions that aren't allow-listed on the target (the azure.extensions server parameter). Enable them first. See restoring a .dump file on Windows.

How PostgresBackup handles Azure

Add the server to PostgresBackup with SslMode=Require (or paste the connection string from the portal's Connect page), test it, and create a nightly job. The app's background service runs it from boot, keeps the daily, weekly and monthly copies you choose, and restores or clones any of them in a few clicks.