Data privacy concern of MSP deployment

[ericstar]

As reseller of VBO, my potential customer would be - 1) MSP who manage backup services for their O365 clients, 2) direct end customers who manage their own O365 backup data.

I do not seem to be able to locate any reference in Veeam's knowledge base that VBO supports a deployment model where my MSP partners can deploy VBO in their own environment which creates a backup job to protect their client's O365 data without directly accessing their client's O365 account credential (e.g. Global administrator).

Even if this model can be achieved by any means, how could MSP overcome data privacy issues, as if their O365 client may have shared the administrative credential with them to create and run the backup / restore processes?

Thanks!

[Mike Resseler]

Eric,

It is possible to do this, but it does require the MSP's to have their own portal. Our solution does not have such a portal of its own at this point in time

[orb]

Hello Eric

It exists an MSP implementation, but it is part of the Veeam Cloud Connect where the customer uses his exchange explorer in a VBR to access the MSP VBO doing the heavy lift but that’s not the only way.

You can find the minimum security requirements and you don’t need access to a global administrator to make it work.All is documented here https://helpcenter.veeam.com/docs/vbo3 ... tml?ver=50

Oli

[ericstar]

Hello Orb,

As far as I know, setting up backup organization using Modern App-only Authentication in VBO require an administrative User Account Roles (Reference: https://helpcenter.veeam.com/docs/vbo36 ... tml?ver=50)
i.e.
The account that the Azure AD application will use to log in to Microsoft Office 365 must be assigned the following roles:
---
Global Administrator or Exchange Administrator — required for data restore with Veeam Explorer for Microsoft Exchange.
Global Administrator or SharePoint Administrator — required for data restore with Veeam Explorer for Microsoft SharePoint and Veeam Explorer for Microsoft OneDrive for Business.
Global Administrator or Teams Administrator — required for data restore with Veeam Explorer for Microsoft Teams.
Global Administrator — required for establishing a connection to a service provider in the Office 365 Backup as a Service scenario.
---
If there any scenario that I may have missed from the knowledge articles that the backup process can be created without using "administrative" user account for MSP implementation?

Thanks!

[Polina]

Hi Eric,

Your understanding is absolutely correct; with modern app-only authentication, an admin account is a must.