[v13] VBR and VeeamOne / MFA

[STV-VRI]

Hello,

I don´t know if this belongs to VBR or VOne, so please move this thread if needed.
I currently have an open case (Case #07946159) and it looks like we are hitting some kind of wall:
VeeamOne doesn´t connect to VBR unless I disable MFA for the account used to connect to VBR.
The documentation for VeeamOne says:

When you install Veeam Analytics service on a Veeam Backup & Replication server you must disable MFA for the account under which Veeam Analytics service connects to Veeam Backup & Replication. For details, see section Disabling MFA for Service Accounts of the Veeam Backup & Replication User Guide.

https://helpcenter.veeam.com/docs/one/u ... mfa&ver=13

This wasn´t needed for V12 (even the archived article says something else, I never noticed that part https://helpcenter.veeam.com/archive/on ... hlight=mfa), since I got connection issues after the upgrade to V13.
Now my question is:
What is even the point of using MFA if I want to use VeeamOne but I need to disable MFA for 1 on the highest privileged accounts? I only have to accounts on the VBR VM (which both hold the role "Veeam Backup Administrator") -> Administrator and a service-account for VeeamOne.
Am I missing something?

Best regards,
Stefan

[david.domask]

Hi Stefan, welcome to the forums.

Looks like Support provided the answer in the case, MFA must be disabled for service accounts.

An unattended service account won't be able to perform MFA, hence why there are connection issues when its enabled.

To the best of my knowledge this was always a requirement for the reason above.

Your point is understood, and naturally we want to limit permissions when possible and will discuss internally the possibility of a dedicated role for a more limited account without full Backup Administrator permissions, but for now the requirements are as Support shared.

[jorgedlcruz]

Hello,
This has been resolved when using Veeam Software Appliance within Veeam ONE offline bundle, as in VSA we do not need an user/password, all the communication happens using TLS/SSL certificates.

Are you planning to move to Veeam Software Appliance at any point?

Let us know

[STV-VRI]

Hello Jorge,

thanks for that information.
The only thing I couldn´t find out about VSA: We are using rotated USB-drives connected to a vsphere host and attatched them via vcenter to the current VBR VM.
If that still works with VSA, I see no reason not to switch.


Best regards,
Stefan