Upgrade to v5 problems.

[tfountain]

This morning I upgraded from v4 to v5.
Hope this helps anyone upgrading.
After the upgrade the backup failed, checking the Org settings provided the answer as it was now getting access denied for Microsoft Graph. This was working before fine before the upgrade.
Logged a P1 support case Case # 04532709, but managed to work it out anyway.
It turns out that extra permissions are required for API in Azure and the backup account now needs Teams admin rights and a Teams Licence too.

Microsoft Graph:
Directory.Read.All
Group.Read.All
TeamSettings.ReadWrite.All

Office 365 Exchange Online:
full_access_as_app

Sharepoint:
Sites.FullControl.All
User.Read.All

Backups are now working again.
Checked the release notes and cannot see any mention of these requirements.

[Polina]

Hi tfountain,

As Microsoft Teams is a separate service within O365, it requires its own set of permissions for a backup service account (and/or application). You can always find full and the most up-to-date information on the requirements in the Helpcenter documentation.

Thanks!

[eashdown@ksp.ca]

I would like to add that I agree. There's a whole list of new API permissions required by v5 that aren't documented in the update document. Thank you for posting this, confirmed I wasn't insane. Backups with v4 only required two Graph API permissions to backup. Now there's 5 Graph, 1 EXO, and 2 SharePoint API permissions required to run a backup.

[Polina]

Hi Evan,

The list of required API permissions was updated with the release of version 4c introducing the modern app-only support and it didn't change for v5. I'll give the documentation another check to see if we can make it more clear and easy to identify what's required for each specific auth method.

Thanks for your feedback!

[massimiliano.rizzi]

This morning I upgraded from v4 to v5.
Hope this helps anyone upgrading.
After the upgrade the backup failed, checking the Org settings provided the answer as it was now getting access denied for Microsoft Graph. This was working before fine before the upgrade.
Logged a P1 support case Case # 04532709, but managed to work it out anyway.
It turns out that extra permissions are required for API in Azure and the backup account now needs Teams admin rights and a Teams Licence too.

Microsoft Graph:
Directory.Read.All
Group.Read.All
TeamSettings.ReadWrite.All

Office 365 Exchange Online:
full_access_as_app

Sharepoint:
Sites.FullControl.All
User.Read.All

Backups are now working again.
Checked the release notes and cannot see any mention of these requirements.

Hello there,

I am struggling to locate the Exchange "full_access_as_app" permission from within the Microsoft 365 Admin Center.

Can you please kindly help me out with this issue ?

Thanks and Regards,

Massimiliano

[Polina]

Hi Massimiliano,

Please try the following:
On the Select API screen in the AAD portal, navigate to the 'APIs my organization uses' tab and search for the 'Office 365 Exchange Online' app. The 'full_access_as_app' permission should be under the Application permissions section.

If it doesn't work for you, you may need to check if the 'Office 365 Exchange Online' app is listed within your Enterprise applications. If it's not there, install it from the Azure AD Gallery and repeat the above steps.

Thanks!

[massimiliano.rizzi]

Hi Polina,

thank you very much for your help !

[YouGotServered]

Same issue here. Working just fine on update 4c, then ran into the same issues after upgrading to v5. Figured out myself that I needed the new SharePoint / Exchange APIs (which I believe are legacy - at least the Exchange ones anyways, so here's another post I made about that veeam-backup-for-office-365-f47/will-vb ... 71248.html). I checked and double checked the release notes and couldn't find any mention of needing the new APIs. They may have been a "requirement" in v4c, but backups worked and people should still be notified if jobs will begin to fail without those permissions in the new version. Now we are scrambling to fix at several clients

These API requirements are indeed in the User Guide, but I think since it causes disruption to presently working backups, this should have been put in the release notes. Of course, some people still don't read those, but that's another group of people with their own set of problems - at least most of us try to be good at our jobs

[Mike Resseler]

All,
We will look into this (But give us some time with the holidays and stuff ) and figure out how to do it better next time. You are all right it needs to be in the release notes, but it was indeed in a previous one, which maybe not everyone has installed. I'm not sure how to do it, but we will think about it (and obviously hints are welcome )