support wants Global Admin account to send some smtp alerts, SMH

[pesos]

case 07106354

Veeam smtp alerts have sure been a real pain point of late. The code seems very buggy and tends to go into weird hangs/loops quite a bit when being configured.

Now on this case the rep is claiming we have to give the account global admin just to set up some smtp alerts, which is of course an absurd violation of least privilege even on a temporary basis. When pressed for a link to written documentation backing up his claim that this is necessary, of course he could not do so. We know this is not necessary as we have plenty of other Veeam servers configured for smtp without this, including on the same tenant.

"Hello xxxx,

This is our documentation on how to setup Notifications, but it doesn't mention the global admin account: https://helpcenter.veeam.com/docs/vbo36 ... tml?ver=70

I understand you do not wish to permanently assign global admin to the mailbox used to send the notifications. However, if you do not mind, please instead try to temporarily assign global admin to this mailbox. Then proceed with notifications configuration within the Veeam console.

Since this mailbox has global admin temporarily, it can approve the request during notification setup.

I can say based off past cases, if the notification configuration steps require another admin to approve the request, it likely will not succeed.

Please let me know in case you have any other questions.

Best Regards

Previous Communication
________________________________________
2024-02-07 13:40:55 UTC - xxxxxxxxxxx Additional Comments


Please provide links to written documentation at Veeam that backs this up, as we have modern auth running on other servers without this and have not seen this documented anywhere. Thank you.
"

[Polina]

Hi John,

Am I correct in understanding that you're running VB365 v7 and trying to set up email notifications using M365 modern auth?

[pesos]

Correct. We are not married to modern auth per se but I don't think there is currently really a solid alternative anymore for o365 relay?

[pesos]

bump - can we get someone to take a look at this case and perhaps escalate it to someone who has a proper suggestion rather than the absurdity that is giving an smtp account global admin? thanks!

[Polina]

Hi John,

For notifications, Global Admin is not required, and I'll contact your support engineer to see why they came up with such a recommendation.
The account you authenticate with can be a regular user and further notifications from VB365 will be sent on behalf of this account.

Thanks!

[pesos]

You know this and I know this but the rep does not seem to know this
Would be great if someone who knows this could help us troubleshoot the actual issue. Thank you for taking a look!

[pesos]

Took another month but "R&D" finally admitted there was a problem in the code and issued a private fix - as of yesterday we are good to go.