Comprehensive data protection for all workloads
Post Reply
pantoufle
Influencer
Posts: 11
Liked: never
Joined: Feb 16, 2012 6:20 pm
Full Name: Pantoufle

Feature Request - Role for Enable/Disable Jobs

Post by pantoufle »

Hello,

I try to remove Full Admin rights to my Operation Team.

I replace their "Veeam Backup Administrator" Rôle" with 2 new role
Veeam Backup Operator
Veeam Restore Operator

Everything works fine except the Enable / disable jobs feature which is not available anymore

I usa many Powershell Scripts who enable or disable Veeam Jobs during Vmware Hosts / Cluster Reboot, Maintenance, etc...

How to give them this feature without give them Full Admin access.

Is it possible to have a new Role, "Backup Power User" ?

thank you.


Case # 02530745
foggy
Veeam Software
Posts: 21069
Liked: 2115 times
Joined: Jul 11, 2011 10:22 am
Full Name: Alexander Fogelson
Contact:

Re: Feature Request - Role for Enable/Disable Jobs

Post by foggy » 1 person likes this post

pantoufle wrote:How to give them this feature without give them Full Admin access.
I don't think this is currently possible, but thank you for the feedback, your use case is clear.
branded-cloud
Service Provider
Posts: 13
Liked: 3 times
Joined: Mar 26, 2018 7:46 am
Contact:

[MERGED] Feature request: More userroles

Post by branded-cloud » 1 person likes this post

I am running into issues with the roles available in VEEAM.

We need to make VEEAM multi tenant available and the challenge is that currently there is no role available to grant users the ability to schedule backups and to run restores (so 1 user with rights to both)

The only way I can grant a user the create jobs permission is to make that user backup Administrator which I do not want to do as that gives the user to much rights in the backup and replication console.

Current roles are:

Veeam Restore Operator - Can perform restore operations using existing backups and replicas ONLY
Veeam Backup Viewer - Has “read-only” access to Veeam Backup & Replication — can view existing and performed jobs and review the job session details.
Veeam Backup Operator - Can start and stop existing jobs, BUT cannot use Restore Option
Veeam Backup Administrator - Can perform all administrative activities in Veeam Backup & Replication.


A new role could be:

VEEAM Backup Job creator - Has permissions to create and schedule backup jobs

And then (if that is even possible) grant a user the rights:

VEEAM Backup Job creator - Has permissions to create and schedule backup jobs

and

Veeam Restore Operator - Can perform restore operations using existing backups and replicas ONLY

and

Veeam Backup Operator - Can start and stop existing jobs, BUT cannot use Restore Option



An even beter solution would be to have the ability to create custom roles and grant the access needed to that role.
Dima P.
Product Manager
Posts: 14396
Liked: 1568 times
Joined: Feb 04, 2013 2:07 pm
Full Name: Dmitry Popov
Location: Prague
Contact:

Re: Feature request: More userroles

Post by Dima P. »

Hello branded-cloud.

Can you please elaborate what permissions from existing administrator role would you like to block from a user in your scenario? Thank you in advance.
branded-cloud
Service Provider
Posts: 13
Liked: 3 times
Joined: Mar 26, 2018 7:46 am
Contact:

Re: Feature request: More userroles

Post by branded-cloud »

Hi,

We would like to hide the following (or at least the following)

- Insight in linked storage arrays, so hide the whole storage Infrastructure menu option
- hide the Backup infrastructure menu option

Basically we would like to see a user that can create backup jobs, maintain them and perform restores and without this user having any other insights in the environment.

So make it possible for person A to administer the whole Veeam setup and for Person B to only perform backup and restore operations.
Dima P.
Product Manager
Posts: 14396
Liked: 1568 times
Joined: Feb 04, 2013 2:07 pm
Full Name: Dmitry Popov
Location: Prague
Contact:

Re: Feature request: More userroles

Post by Dima P. »

Understood, thank you! As a temporary workaround you can give a simple user Backup Operator & Restore Operator permissions at the same time (but that does not provide the ability to create new backup jobs).
branded-cloud
Service Provider
Posts: 13
Liked: 3 times
Joined: Mar 26, 2018 7:46 am
Contact:

Re: Feature request: More userroles

Post by branded-cloud »

That work around does not really work for our customers, as they still cannot create jobs on their own like you stated and as a service provider that is not really friendly towards our customers.

The other reason we really are looking for this is so that we can use snapshot integrations without customers being able to see everything on the storage array as we need to provide admin credentials to the storage array (netapp in this case) and that means expasion all the SVM's on that array
edirschedl
Enthusiast
Posts: 44
Liked: 4 times
Joined: Jul 21, 2016 12:29 pm
Full Name: Emanuel Dirschedl
Contact:

Re: Feature request: More userroles

Post by edirschedl » 1 person likes this post

In comparision to add additional roles, it would be better to have the possibility to create own roles with individual settings.

In my dream imagination of a new permission control center in VEEAM I can mark / unmark every feature, define different role sets and can also restrict specific features (for example restores only from specific vms / folders) for specific users or groups.

Also here in a enterprise environment the current permission function isn't far away from a good and efficient way. For example I have 5 different Exchange admins which want to do single item restores of their Exchange Systems. Sadly I've to give them the Restore Operator role, which has permission also for all systems, which aren't Exchange. From security point of view not so nice...
ChrisGundry
Veteran
Posts: 258
Liked: 40 times
Joined: Aug 26, 2015 2:56 pm
Full Name: Chris Gundry
Contact:

Re: Feature request: More userroles

Post by ChrisGundry » 1 person likes this post

I have the same wish as edirschedl. Much more granular permissions, ideally based on VM folders or buisness views. We want to delegate restore rights for exchange items and our file servers to service desk admins, but no other restore rights. That way they can restore user files only, but not VMs and not files from our HR server etc.
Gostev
Chief Product Officer
Posts: 31460
Liked: 6648 times
Joined: Jan 01, 2006 1:01 am
Location: Baar, Switzerland
Contact:

Re: Feature request: More userroles

Post by Gostev » 2 people like this post

ChrisGundryCEGA wrote:We want to delegate restore rights for exchange items and our file servers to service desk admins, but no other restore rights. That way they can restore user files only, but not VMs and not files from our HR server etc.
This has been available for a while now > Configuring Restore Scope
Poweruser
Expert
Posts: 220
Liked: 12 times
Joined: Jul 25, 2018 4:12 pm
Full Name: Poweruser
Contact:

Re: Feature request: More userroles

Post by Poweruser »

Also it would be nice to grant on job basis only.
so someone could just start a special job like backup to tape or sth else.
edirschedl
Enthusiast
Posts: 44
Liked: 4 times
Joined: Jul 21, 2016 12:29 pm
Full Name: Emanuel Dirschedl
Contact:

Re: Feature request: More userroles

Post by edirschedl » 1 person likes this post

Gostev wrote:This has been available for a while now > Configuring Restore Scope
Yeah you're right in Enterprise Manager this feature I'm interested in is integrated and works really good. But I need this same feature also in B&R console, because the restore options for the most restore types (Full-VM, FLR, Exchange..) are much better there. That's a big problem in my opinion that we have two different feature sets in two different GUIs. And there is no GUI which have really all features included.
MichaelG7
Influencer
Posts: 16
Liked: 1 time
Joined: Jul 05, 2018 7:55 am
Full Name: Michael
Location: Germany
Contact:

Re: Feature request: More userroles

Post by MichaelG7 »

I would welcome the role of a TAPE OPERATOR.
This role should have the rights to move Tapes in different Media Pools and mark them as free.
Dima P.
Product Manager
Posts: 14396
Liked: 1568 times
Joined: Feb 04, 2013 2:07 pm
Full Name: Dmitry Popov
Location: Prague
Contact:

Re: Feature request: More userroles

Post by Dima P. »

Michael,

We plan to add 'Tape Operator' role in upcoming Update 4. Cheers!
MichaelG7
Influencer
Posts: 16
Liked: 1 time
Joined: Jul 05, 2018 7:55 am
Full Name: Michael
Location: Germany
Contact:

Re: Feature request: More userroles

Post by MichaelG7 »

Thank you! Which rights are provided with this role?
Dima P.
Product Manager
Posts: 14396
Liked: 1568 times
Joined: Feb 04, 2013 2:07 pm
Full Name: Dmitry Popov
Location: Prague
Contact:

Re: Feature request: More userroles

Post by Dima P. »

Here is the list:

Code: Select all

Tape Inventory 
Tape Export 
Tape Eject
Tape Catalog 

Inventory Library/SA Drive
Catalog Library/SA Drive
Rescan Library/SA Drive

Import Tapes
Eject from Drive

Move tape to Media Pool
Erase tape
Mark tape as free
Poweruser
Expert
Posts: 220
Liked: 12 times
Joined: Jul 25, 2018 4:12 pm
Full Name: Poweruser
Contact:

Re: Feature request: More userroles

Post by Poweruser »

Its nice to have role based access control, its more nice to assign right directly per user/group basis and build your own groups.
then you can create your own rules. that would be the best in most cases.

because noone really knows which roles the company has.
exchange is sth. like that.. too many roles who never fit :-D
branded-cloud
Service Provider
Posts: 13
Liked: 3 times
Joined: Mar 26, 2018 7:46 am
Contact:

Re: Feature Request - Role for Enable/Disable Jobs

Post by branded-cloud »

Any updates on roles that can do both backups and restores but are not full admin? It is kind of silly you cannot make an account for a user that is allowed to make a backup and do a restore.

Makes the product really difficult to use at the moment as a SP
foggy
Veeam Software
Posts: 21069
Liked: 2115 times
Joined: Jul 11, 2011 10:22 am
Full Name: Alexander Fogelson
Contact:

Re: Feature Request - Role for Enable/Disable Jobs

Post by foggy »

Vitaliy S.
VP, Product Management
Posts: 27055
Liked: 2710 times
Joined: Mar 30, 2009 9:13 am
Full Name: Vitaliy Safarov
Contact:

Re: Feature Request - Role for Enable/Disable Jobs

Post by Vitaliy S. »

Hello,

On a side note, do you want to provide these capabilities to your IT staff or to the managed client IT engineers?

Thank you!
Steve-nIP
Service Provider
Posts: 117
Liked: 49 times
Joined: Feb 06, 2018 10:08 am
Full Name: Steve
Contact:

Re: Feature Request - Role for Enable/Disable Jobs

Post by Steve-nIP »

+1

For this, this is a feature we need
arosas
Enthusiast
Posts: 63
Liked: 10 times
Joined: Jun 09, 2015 9:33 pm
Full Name: Tony Rosas
Contact:

Re: Feature Request - Role for Enable/Disable Jobs

Post by arosas »

I haven't found other posts around roles and refined permissions. Is this going to change anytime soon? Are granular custom roles coming to Veeam?
It would be very nice to be able to allow 1 user to disable\enable one job and that's it.
Dima P.
Product Manager
Posts: 14396
Liked: 1568 times
Joined: Feb 04, 2013 2:07 pm
Full Name: Dmitry Popov
Location: Prague
Contact:

Re: Feature Request - Role for Enable/Disable Jobs

Post by Dima P. »

Hello Tony,

Unfortunately is not possible to create a user with the dedicated scope of jobs to manage, but I'll add your vote to this feature request. Thanks!
Mofamike
Influencer
Posts: 17
Liked: never
Joined: Aug 29, 2019 12:23 pm
Full Name: Mofamike
Contact:

Re: Feature Request - Role for Enable/Disable Jobs

Post by Mofamike »

+1 for the option to give users beside admins the option to disable and enable jobs
Post Reply

Who is online

Users browsing this forum: Semrush [Bot] and 285 guests