Feature request: VB365 Console without elevated rights

[nscblauensteiner]

Hy team,

It would be great, and very necessary for tiering networks and systems, if you could open the Veeam O365 console without local administrator privileges, as you can with Veeam B&R - see Case ID #05893599 for details.

Best regards,
Lukas

[Mildur]

Hi Lukas

Welcome to the forum.
Thanks your your request. Currently it's not possible to start the console without local admin permissions. But your request is been noted.
Since version 6 we have our web based restore portal. Maybe you can check it out for your daily restore operations. It doesn't require local admin permissions. We will keep working on such features for future releases which bring better RBAC control and no local admin permissions.

Best,
Fabian

[nscblauensteiner]

Hy Fabian,

thanks for including it as a feature request.

KR,
Lukas

[KeithBGCPS]

From what we can see and what Veeam has told us, in order to access the Veeam for M365 Console we have to use an account that is part of the Local Administrators group on that server. Where as Veeam B&R does not work this way. Would like to see Veeam for M365 act the same way as Veeam B&R when it comes to granting access.

[Mildur]

Hi Keith

Welcome to the forum. I moved your request to this topic.
Please see my previous answer.

Best,
Fabian

[nscblauensteiner]

Hy,

thanks so far.

BR, Lukas

[Dagr]

Currently it's not possible to start the console without local admin permissions.

Any Plans/Work on this?
As a Servcie Provider we would very much like this feature to segment access rigths between our support staff and Operations.

[Mildur]

No updates for now.
We are researching what can be done, but there is no ETA or targeted version when the backup console can work without local admin permissions.

May I ask, how you want to segment the access rights? One group should only be able to manage VB365, the other group only the local operating system?
Does the VB365 restore portal combined with the VSPC work as a workaround for your daily business?

Best,
Fabian

[MaartenA]

This is not a workaround for us for the daily business. The time needed to add the restore functionality for all customers already added does not outweigh the amount of restores that need to be done. When performing a restore via the VBO console, VBO asks for the tenant admin details for authentication and that's it. If a similar option can be made in the portal then the portal would be a good alternative for us. Or if you can automatically configure the restore functionalities when adding a customer it would also help a lot. So for example add a checkbox that will register the Azure App for restore and be able to select a user or group and even better be able to create a group that will be assigned as restore operator. See also post496944.html?hilit=restore%20portal#p496944

[JustBackupSomething]

Adding to this conversation a little. We also ran into this issue and had to create a dedicated machine for access. Not a great solution from a SP point of view in terms of security.
In our case, PST export of a mailbox are the biggest request we get from a support point of view and the restore portal only seems to support Cloud-to-Cloud restores.

[Polina]

Hi Luke,

You're right, the Portal capabilities are limited to cloud restores, but this is going to change in the future. The plan is to add export functionality to the Portal and make it at some point as feature-rich as Veeam Explorers.

[rura_at_tivoli]

We would also like to be able to run the VB365 console without elevated rights.
As part of the hardening of the VB365 server we strive to only access it through the console from a jumphost. But our accounts on the jumphost are not allowed to be local admins.
Since this is mostly for administrative tasks then the portal would not help us.