---
title: "Wasabi Covert Copy With Xen Orchestra"
slug: "wasabis-covert-copy-with-xen-orchestra"
updated: 2026-09-25T15:33:44Z
published: 2026-09-25T15:33:44Z
canonical: "docs.wasabi.com/wasabis-covert-copy-with-xen-orchestra"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.wasabi.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Wasabi Covert Copy With Xen Orchestra

[Xen Orchestra](https://xen-orchestra.com/#!/xo-home) has been validated for use with Wasabi. Xen Orchestra is a management tool dashboard for the [XCP-ng](https://xcp-ng.org/) hypervisor which allows you to manage your virtual machine deployments, lifecycle, and backups. For more information, refer to [Xen Orchestra in a nutshell](https://docs.xen-orchestra.com/).

This article describes the procedure for using Wasabi Covert Copy to protect a Golden Copy of Xen Orchestra backups in the event of a disaster that affects other backup copies. Wasabi Covert Copy is an effortless way to safeguard your data by creating a locked copy of your S3 bucket. Covert Copy is easy to implement, with no configuration requirements or technical knowledge required.

> Covert Copy is a static, one-time copy and not an ongoing replication.

> The data restoration process is handled by your specific backup software application. As many variables can affect your unique environment, Wasabi strongly recommends that you seek guidance from your backup software’s technical support team if you encounter difficulties or have application-specific inquiries.

## Requirements

- Wasabi Hot Cloud Storage account
  - Wasabi Multi-User Authorization enabled—See [MUA (Multi-User Authorization)](https://docs.wasabi.com/docs/adding-security-contacts).
  - Wasabi Bucket—See [Creating a Bucket](https://docs.wasabi.com/docs/working-with-buckets-and-objects#creating-a-bucket).

> Be sure to note your bucket name, storage region URL, and Access & Secret Key, as you will need these for later steps.

- XCP-ng & Xen Orchestra environment
  - XCP-ng Installed (8.3 LTS as of this documentation)—See [Install XCP-ng](https://docs.xcp-ng.org/installation/install-xcp-ng/).
  - Xen Orchestra Installed (Version 6.0.3 as of this documentation)—See [Installing XOA](https://docs.xen-orchestra.com/installation).
  - Xen Orchestra Essential Edition License or better—See the Vates [Pricing & Support](https://vates.tech/en/pricing-and-support/).
  - Existing Backup of a Xen Orchestra VM—See our [Xen Orchestra With Wasabi](https://docs.wasabi.com/docs/xen-orchestra-with-wasabi) for setting up your initial backups before proceeding.

## High Level Steps

Follow the high-level steps (described in more detail below) to implement [Covert Copy: Setting Up and Creating a Covert Copy](https://docs.wasabi.com/docs/covert-copy-buckets) for your Xen Orchestra backups.

1. Enable Multi-User Authorization (MUA) on your account and configure Covert Copy activities that your security contacts approve. For more detail, review [MUA (Multi-User Authorization)](https://docs.wasabi.com/docs/adding-security-contacts)
2. Pause Xen Orchestra backup activities by temporarily disabling backup jobs.
3. Enable Covert Copy on your bucket containing Xen Orchestra backups.
4. Wait for your Xen Orchestra backups to be copied to the Covert Copy bucket.
5. Resume Xen Orchestra backup activities by re-enabling backup jobs.

## Pausing Xen Orchestra Backups

1. Visit your Xen Orchestra Dashboard and select the **Backups** tab.
2. Click **Enabled** next to the relevant backup job.

![](https://cdn.document360.io/bef0a1ea-7768-4d5a-b520-c4fe2f7fafad/Images/Documentation/image-O219THWC.png)

Your Backup Job is disabled.

![](https://cdn.document360.io/bef0a1ea-7768-4d5a-b520-c4fe2f7fafad/Images/Documentation/image-4OYKVLS7.png)

## Enabling Covert Copy

1. Log in to your Wasabi Console.
2. Select the **Buckets** tab and search for your Xen Orchestra Backup bucket.

![](https://cdn.document360.io/bef0a1ea-7768-4d5a-b520-c4fe2f7fafad/Images/Documentation/image-GNI95JHR.png)
3. Click the **three dots icon** under Actions.
4. Click **Covert Copy**.
5. Verify settings on the next screen. Click **Next**.

> This configuration example discusses the use of Wasabi’s us-east-1 storage region for the Covert Copy bucket. For a list of regions, see [Service URLs for Wasabi's Storage Regions](https://docs.wasabi.com/docs/service-urls-for-wasabis-storage-regions-2). The region must be on the same continent as the primary bucket.

![](https://cdn.document360.io/bef0a1ea-7768-4d5a-b520-c4fe2f7fafad/Images/Documentation/image-06701YK6.png)
6. Enter your MFA code.
7. Click **Create Bucket**.

![](https://cdn.document360.io/bef0a1ea-7768-4d5a-b520-c4fe2f7fafad/Images/Documentation/image-GWRXUNBD.png)
8. Click the toggle to **Show Covert Copy Buckets**. Your Covert Copy will show as in progress until the data is copied to the Covert Copy bucket. This process will take varying amounts of time depending on how much data is in the source bucket.

![](https://cdn.document360.io/bef0a1ea-7768-4d5a-b520-c4fe2f7fafad/Images/Documentation/image-L7114VM3.png)
9. Once the Covert Copy operation has completed, the status will show as Covert Copy Completed.

![](https://cdn.document360.io/bef0a1ea-7768-4d5a-b520-c4fe2f7fafad/Images/Documentation/image-988OURHM.png)
10. Optionally, to see the contents of the Covert Copy bucket, click the **three dots icon** under Actions.
11. Click **Request Access**.

![](https://cdn.document360.io/bef0a1ea-7768-4d5a-b520-c4fe2f7fafad/Images/Documentation/image-AK104HR6.png)
12. On the pop-up, click **Send Request**. Your MUA security contact will need to approve this request.

![](https://cdn.document360.io/bef0a1ea-7768-4d5a-b520-c4fe2f7fafad/Images/Documentation/image-L64OMNIB.png)
13. After your Multi-User Authentication security contact has approved the request, you will be able to browse the contents of the Covert Copy bucket.

![](https://cdn.document360.io/bef0a1ea-7768-4d5a-b520-c4fe2f7fafad/Images/Documentation/image-186IOQVU.png)

## Resuming Xen Orchestra Backups

1. Visit your Xen Orchestra Dashboard and select the **Backups** tab.
2. Click **Disabled** next to the relevant backup job.

![](https://cdn.document360.io/bef0a1ea-7768-4d5a-b520-c4fe2f7fafad/Images/Documentation/image-A9FCR04E.png)

Now your backup job is Enabled.

![](https://cdn.document360.io/bef0a1ea-7768-4d5a-b520-c4fe2f7fafad/Images/Documentation/image-2GSKU6P7.png)

## In Case of Disaster - Adding Your Covert Copy Bucket as a Xen Orchestra Remote

1. In the case of a disaster, the root user use this email address to submit a ticket to [Wasabi Support](mailto:support@wasabi.com): support@wasabi.com. In the email, request Restore Mode and include the name of your Covert Copy bucket. After Support enables Restore Mode, the Covert Copy bucket will be visible to Xen Orchestra and will allow a restore to be performed from backups in the bucket.

> Once your restore has completed, use this email address to contact [Wasabi Support](mailto:support@wasabi.com) (support@wasabi.com) to disable Restore Mode on your Covert Copy bucket.
2. Add your Covert Copy bucket as another Remote in the Xen Orchestra dashboard (Log in to your Xen Orchestra dashboard and navigate to **Settings**, then to **Remotes**.)
  - For Type, choose **Amazon Web Services S3** from the drop-down.
  - Enter a friendly name for your Remote (for example, Wasabi Covert Copy).
  - Ensure Use HTTPS is toggled on (default).
  - Enter the Service URL for the bucket (for example, s3.us-east-1.wasabisys.com).
  - Enter the region (for example, us-east-1).
  - Enter the name of your Covert Copy bucket.
  - Enter a / or your custom directory for the backups.
  - Enter your Access Key.
  - Enter your Secret Key.
3. Click **Save Configuration**.

![](https://cdn.document360.io/bef0a1ea-7768-4d5a-b520-c4fe2f7fafad/Images/Documentation/image-FYPEBFYP.png)
4. Your Covert Copy bucket will now show up as a new Remote.

![](https://cdn.document360.io/bef0a1ea-7768-4d5a-b520-c4fe2f7fafad/Images/Documentation/image-26YYQ96N.png)

## Restoring From Your Covert Copy Remote

1. Visit the Restore page of your Xen Orchestra dashboard (Navigate to **Backups**, then to **Restore**).
2. Click **Restore** next to the relevant VM.

![](https://cdn.document360.io/bef0a1ea-7768-4d5a-b520-c4fe2f7fafad/Images/Documentation/image-N392QPG8.png)
3. Xen Orchestra will automatically index the backups in your Covert Copy bucket. You can choose the replicated Remote in the Restore options.

![](https://cdn.document360.io/bef0a1ea-7768-4d5a-b520-c4fe2f7fafad/Images/Documentation/image-HW5O0V9P.png)
4. Once you have selected your Covert Copy backup from the drop-down, verify optional settings. Click **OK**.

![](https://cdn.document360.io/bef0a1ea-7768-4d5a-b520-c4fe2f7fafad/Images/Documentation/image-M7LB4GD7.png)
5. Your Restore progress will then be shown on the Tasks tab of your Xen Orchestra Dashboard.

![](https://cdn.document360.io/bef0a1ea-7768-4d5a-b520-c4fe2f7fafad/Images/Documentation/image-FUN8ILF7.png)
6. Once the restore completes. You will see the newly restored VM on the Home Tab of your Xen Orchestra dashboard.

![](https://cdn.document360.io/bef0a1ea-7768-4d5a-b520-c4fe2f7fafad/Images/Documentation/image-5MMUNX69.png)
7. After a successful restore, use this email address to contact [Wasabi Support](mailto:support@wasabi.com) (support@wasabi.com) to request that Restore Mode be disabled for your Covert Copy bucket.