-
- Expert
- Posts: 224
- Liked: 22 times
- Joined: Nov 12, 2014 9:40 am
- Full Name: John Johnson
- Contact:
support wants Global Admin account to send some smtp alerts, SMH
case 07106354
Veeam smtp alerts have sure been a real pain point of late. The code seems very buggy and tends to go into weird hangs/loops quite a bit when being configured.
Now on this case the rep is claiming we have to give the account global admin just to set up some smtp alerts, which is of course an absurd violation of least privilege even on a temporary basis. When pressed for a link to written documentation backing up his claim that this is necessary, of course he could not do so. We know this is not necessary as we have plenty of other Veeam servers configured for smtp without this, including on the same tenant.
"Hello xxxx,
This is our documentation on how to setup Notifications, but it doesn't mention the global admin account: https://helpcenter.veeam.com/docs/vbo36 ... tml?ver=70
I understand you do not wish to permanently assign global admin to the mailbox used to send the notifications. However, if you do not mind, please instead try to temporarily assign global admin to this mailbox. Then proceed with notifications configuration within the Veeam console.
Since this mailbox has global admin temporarily, it can approve the request during notification setup.
I can say based off past cases, if the notification configuration steps require another admin to approve the request, it likely will not succeed.
Please let me know in case you have any other questions.
Best Regards
Previous Communication
________________________________________
2024-02-07 13:40:55 UTC - xxxxxxxxxxx Additional Comments
Please provide links to written documentation at Veeam that backs this up, as we have modern auth running on other servers without this and have not seen this documented anywhere. Thank you.
"
Veeam smtp alerts have sure been a real pain point of late. The code seems very buggy and tends to go into weird hangs/loops quite a bit when being configured.
Now on this case the rep is claiming we have to give the account global admin just to set up some smtp alerts, which is of course an absurd violation of least privilege even on a temporary basis. When pressed for a link to written documentation backing up his claim that this is necessary, of course he could not do so. We know this is not necessary as we have plenty of other Veeam servers configured for smtp without this, including on the same tenant.
"Hello xxxx,
This is our documentation on how to setup Notifications, but it doesn't mention the global admin account: https://helpcenter.veeam.com/docs/vbo36 ... tml?ver=70
I understand you do not wish to permanently assign global admin to the mailbox used to send the notifications. However, if you do not mind, please instead try to temporarily assign global admin to this mailbox. Then proceed with notifications configuration within the Veeam console.
Since this mailbox has global admin temporarily, it can approve the request during notification setup.
I can say based off past cases, if the notification configuration steps require another admin to approve the request, it likely will not succeed.
Please let me know in case you have any other questions.
Best Regards
Previous Communication
________________________________________
2024-02-07 13:40:55 UTC - xxxxxxxxxxx Additional Comments
Please provide links to written documentation at Veeam that backs this up, as we have modern auth running on other servers without this and have not seen this documented anywhere. Thank you.
"
-
- Veeam Software
- Posts: 3288
- Liked: 794 times
- Joined: Oct 21, 2011 11:22 am
- Full Name: Polina Vasileva
- Contact:
Re: support wants Global Admin account to send some smtp alerts, SMH
Hi John,
Am I correct in understanding that you're running VB365 v7 and trying to set up email notifications using M365 modern auth?
Am I correct in understanding that you're running VB365 v7 and trying to set up email notifications using M365 modern auth?
-
- Expert
- Posts: 224
- Liked: 22 times
- Joined: Nov 12, 2014 9:40 am
- Full Name: John Johnson
- Contact:
Re: support wants Global Admin account to send some smtp alerts, SMH
Correct. We are not married to modern auth per se but I don't think there is currently really a solid alternative anymore for o365 relay?
-
- Expert
- Posts: 224
- Liked: 22 times
- Joined: Nov 12, 2014 9:40 am
- Full Name: John Johnson
- Contact:
Re: support wants Global Admin account to send some smtp alerts, SMH
bump - can we get someone to take a look at this case and perhaps escalate it to someone who has a proper suggestion rather than the absurdity that is giving an smtp account global admin? thanks!
-
- Veeam Software
- Posts: 3288
- Liked: 794 times
- Joined: Oct 21, 2011 11:22 am
- Full Name: Polina Vasileva
- Contact:
Re: support wants Global Admin account to send some smtp alerts, SMH
Hi John,
For notifications, Global Admin is not required, and I'll contact your support engineer to see why they came up with such a recommendation.
The account you authenticate with can be a regular user and further notifications from VB365 will be sent on behalf of this account.
Thanks!
For notifications, Global Admin is not required, and I'll contact your support engineer to see why they came up with such a recommendation.
The account you authenticate with can be a regular user and further notifications from VB365 will be sent on behalf of this account.
Thanks!
-
- Expert
- Posts: 224
- Liked: 22 times
- Joined: Nov 12, 2014 9:40 am
- Full Name: John Johnson
- Contact:
Re: support wants Global Admin account to send some smtp alerts, SMH
You know this and I know this but the rep does not seem to know this
Would be great if someone who knows this could help us troubleshoot the actual issue. Thank you for taking a look!
Would be great if someone who knows this could help us troubleshoot the actual issue. Thank you for taking a look!
-
- Expert
- Posts: 224
- Liked: 22 times
- Joined: Nov 12, 2014 9:40 am
- Full Name: John Johnson
- Contact:
Re: support wants Global Admin account to send some smtp alerts, SMH
Took another month but "R&D" finally admitted there was a problem in the code and issued a private fix - as of yesterday we are good to go.
-
- Lurker
- Posts: 1
- Liked: never
- Joined: Jun 25, 2024 8:37 pm
- Contact:
Re: support wants Global Admin account to send some smtp alerts, SMH
Just ran into this as a new customer with a brand new install. Seems that Microsoft modern auth for email notifications doesnt work without a global admin signing in from Veeam to "authorize" which is crazy. What did the private fix do? Strange if it didnt make it into new releases since this post.
-
- Product Manager
- Posts: 10086
- Liked: 2688 times
- Joined: May 13, 2017 4:51 pm
- Full Name: Fabian K.
- Location: Switzerland
- Contact:
Re: support wants Global Admin account to send some smtp alerts, SMH
Hi Unimatrix0
Have you opened a support case to confirm that you are affected by the exact same issue?
The fix provided to Pesos should be included in the latest versions of Veeam Backup for Microsoft 365 v7a (7.1.0.1502 and later).
Best,
Fabian
Have you opened a support case to confirm that you are affected by the exact same issue?
The fix provided to Pesos should be included in the latest versions of Veeam Backup for Microsoft 365 v7a (7.1.0.1502 and later).
Best,
Fabian
Product Management Analyst @ Veeam Software
Who is online
Users browsing this forum: Bing [Bot] and 14 guests