Tenant onboarding with Device Code Flow

[oscarm]

All,

as an MSP we have several customers we backup with Veeam for MS365. We see more and more issues when onboarding new customers based on devicelogin codes. Most customers have blocked this with conditional access and even Microsoft suggests not to allow device login codes anymore.

https://learn.microsoft.com/en-us/entra ... tion-flows

Is there another mechanism to onboard a new customer other than manually create an app registration and manually set all permissions?

[Mildur]

Hi Oscar,

No, unfortunately not today.
It is either manually pre-creating an app or letting the Veeam application create it through the device code flow.

To help with the manual steps of pre-creating the application, you could create a PowerShell script that connects to an Entra ID tenant over Graph (Connect-MgGraph) and then registers a new application with the mandatory permissions and a custom certificate for authentication.

Then provide this script to your customers.

Best,
Fabian

[LukasK]

Hello everyone,

We are currently experiencing an issue where, when onboarding Microsoft 365 tenants provisioned by Microsoft after July 1, 2026, we are unable to set up the Veeam Backup for Microsoft 365 backup directly.
When enabled, Security Defaults block the device code flow. See this https://learn.microsoft.com/en-us/entra ... y-defaults Microsoft Article.

From a product management perspective, how do you view this change? It will negatively impact the customer journey during onboarding, since the policy must be temporarily disabled if Conditional Access cannot be used.
As a service provider, we have numerous partners and end customers who do not have access to Conditional Access and who primarily use Business Basic and Business Standard licenses.

We could publish a knowledge base article on this to reduce support requests, but it’s likely that a large number of new customers will encounter this issue.

Is there an alternative to the Device Code Flow in the medium to long term?

BR
Lukas

[Mildur]

Hi Lukas,

Thanks for sharing the link.
I’ll make a note to discuss it with our PM team for VB365.

Best,
Fabian

[juerg.hirschi]

+1

thanks for looking into this. we already have customers that do not allow device code login anymore due to security concerns. definitely need an alternative in the future.

[Mildur]

Hi all,

I’ve merged the new comments into the existing discussion from July.
Our VB365 team has already plans to address this situation.

Best,
Fabian