An administrator initiates an unplanned failover due to a primary AZ outage.

An " Unplanned Failover " is triggered when the primary site is completely offline or unreachable due to a disaster. Because the primary site cannot be contacted to perform one last synchronization of data, the recovery must rely on the recovery points that were successfully replicated to the destination cluster before the outage occurred.

In this scenario, the worst-case data loss is equivalent to the Recovery Point Objective (RPO) defined in the Protection Policy. For example, if the RPO is set to 1 hour, and the disaster occurs 59 minutes after the last successful replication, the business will lose 59 minutes of data. By default, the Nutanix orchestration engine will automatically select and use the most recent recovery point available at the recovery site to restore the virtual machines. While an administrator can manually choose an older recovery point if needed (e.g., in the case of a ransomware attack), the default behavior is to minimize data loss by using the newest available point. This highlights why setting an appropriate RPO is the most important design decision for managing potential data loss in an unplanned failure event.