Service account with the least amount privilege for Office 365 backup best practice?

[albertwt]

I'd like to know what is the best practice in creating the service account used by Veeam Agent for Office 365 v4 to backup Exchange Online, OneDrive, SharePoint and Teams?

Can I use Global Reader role: https://docs.microsoft.com/en-us/azure/ ... ermissions

Because assigning Global Admin role is too much of security exposure according to the IT security team.

Case #03905877

[Mike Resseler]

Hey Albertwt,

Those rights are not going to be enough. To be able to download data, restore data, and many other tasks (query CBT for example) you need more than reader permissions. In fact, even with the global reader role, you can't read any SharePoint site unless you are part of that site or site collection. So the term global might be a bit confusing

[DusanM]

I am interested to know more about this too.
What privilege we need to assign to this service account and can we use MFA for this account?

[Mike Resseler]

@DusanM
Yes, MFA is supported. It is explained in our guidelines and there is a blog and white paper also that works step-by-step in explaining it

[DusanM]

Thank you Mike.

By any chance, do you have link to the blog or white paper?

[jmmarton]

Here you go.

https://www.veeam.com/blog/setup-multi- ... e-365.html

https://www.veeam.com/wp-modern-authent ... ce-v3.html

Joe