v8.5 new permissions instead of EWS access

[sumeet]

Hello,

Did v8.5 upgrade. Upgrade successful - thanks.
Post upgrade, to apply the new permissions https://www.veeam.com/kb4820 for EWS retirement, I did the steps in post upgrade section - https://helpcenter.veeam.com/docs/vbo36 ... pplication
Checked the Entra App in azure and I do not see the new permissions.

Ok, maybe the new permissions do not apply with edit organization.
I did the steps to create a new Entra App amd still do not see the new permissions for MailboxItems - https://www.veeam.com/kb4820

Except for the User.Read.All - which already existed, prior to v8.5 upgrade, none of the new permissions from the KB for Miailbox has been applied?

Is this expected? I don't think so. I was hoping Veeam to create the new permissions.

Without the new permissions, the backups for mailbox continue to work - does this mean that post v8.5 upgrade, even if the new permissions are not applied the backup will continue to use EWS permissions, until they expire?
I was hoping the backups to fail. How do we know post upgrade that new permissions are being used and not the old EWS.

Also the documentation does not say that after applying new permisisons, what permissions to remove, which were for EWS and no longer required.

[Polina]

Hi Sumeet,

Forceful assignment of the new pemissions has been postponed indeed by our RND due to the change in Microsoft deadlines, and the behavior you see is expected. We plan to change it with the next product update/patch.

Thanks!

[sumeet]

Hi Polina,

Is this listed anywhere in the documentation?

Ok, so this answers some of my other questions - why the backups continue to work without the new permissions. Because they are still using EWS.

Please help with more details for the other questions in my above msg.
If I manually apply the new permissions, how do I know that new permissions are being used and not the old EWS.
Also, can I remove the EWS related permissions - if yes, please let me know which ones.

The only reason I was keen on this is because of this KB - https://www.veeam.com/kb4796
There are failures for many mailboxes, so instead of doing that for each mailbox, I was hoping to upgrade to v8.5 and then apply the new permissions.

[tm67]

Hi Polina
We have a lot of customers, I just want to confirm the current situation and action plan:
This KB is final, there are no more permissions required for the EWS deprecation: https://www.veeam.com/kb4820
So my plan is to update all app registrations of all customers with the new permissions. This can be done today

8.5 got released, but realistically it does not change anything regarding the EWS deprecation.
So, with the current date of 1. October, Veeam will release an update (8.6) which has to be installed before 1. October. I will advise the customers they can upgrade to 8.5 but they still need to upgrade to 8.6 in a few weeks.

Is this correct?
Timo

[Polina]

@sumeet

1) If you manually apply permissions, they won't be used until a further change (product update) from Veeam, which will essentially activate the use of Graph APIs. Technically, with those permissions already in place today, you are prepared for any unexpected scenarios — if for whatever reason Microsoft blocks EWS earlier, Veeam will address it quickly with a patch that will activate the use of Graph APIs, and your backup applications would already be fully prepared for that.

2) No, you cannot remove any permissions required for EWS until further notice from Veeam. Work on the complete switch to Graph APIs for Exchange Online backup will continue in Q3 — there are still many technical gaps that must first be addressed by Microsoft and then correspondingly by Veeam. If you remove EWS permissions today, your mailbox backup and restore will stop working.

@t@tm67

KB4820 reflects the current state and will be updated should anything change (i.e. Microsoft changes their plans once again).
The list of permissions is final, I don't foresee any changes to it.
v8.5 brings very important thing - engine readiness; even if it doesn't use Graph already today, it's ready to do so at any moment. Installing a next product update will be needed indeed, but I can't say yet if it's going to be v8.6 or a patch for 8.5.

[voilaVoila]

Hello,

We have recently upgraded Veeam Backup for Microsoft 365 to version 8.5. According to the upgrade documentation, the application now requires additional permissions:

https://helpcenter.veeam.com/docs/vbo36 ... html?ver=8

I attempted to update our organization to add the new App Registration permissions. I tried both methods:

Using Veeam Explorer
Using the REST API

However, in both cases, the required permissions were not added to the App Registration.

Could you please advise on how to proceed or if there are any additional steps required to apply these new permissions?

Thank you.

[Mildur]

Hi Lama,

Please see the earlier comments from Polina from last week.
It's not yet automated through our Wizards/APIs. You can assign the permissions manually in Entra ID or wait until we enable it in the product in one of the next patches/upgrades.

Best,
Fabian

[sumeet]

Hi Fabian, Polina,

This is confusing - from the upgrade wizard to your documentation, gives a feeling that the new permissions are to be used for backup and without this the backups will fail.
Whereas the new permissions are not required for this patch.

It almost seems like the install/upgrade team along with documentation were not aware of the last minute change from RnD team to not switch to the new API.

[Polina]

Hi Sumeet,

The decision to postpone the switch was made at the last minute due to the quite late notice from Microsoft. At the same time, we deliberately kept all informational messages about the new permission requirements as originally planned — to ensure our customers are prepared for the upcoming change well in advance, and so that we can switch at any moment before the official deadline.

[DanielJ]

I was just going to upgrade from 8.4 to 8.5 and was presented with a long list of supposedly "new" required permissions in Graph. As far as I could understand these have to do with the retirement of EWS. I don't see any problems with backing up Exchange in the current version (8.4), does that mean that all organizations must already have these permissions, and that they are not really new additions in 8.5? I cannot check this myself, I have to reach out to our technical contacts at every customer, which is a great hassle every time.

User.Read.All - Application
User.Read.All - Delegated
MailboxItem.ImportExport.All - Application
MailboxItem.ImportExport - Delegated
MailboxItem.Read.All - Application
MailboxItem.Read - Delegated
MailboxFolder.ReadWrite.All - Application
MailboxFolder.ReadWrite - Delegated

[Mildur]

Hi Daniel

I moved your topic to the existing discussion. Please see the earlier comments of Polina.

Best,
Fabian

[DanielJ]

All right, thanks. This must generate thousands of unnecessary tickets for your support. If these permissions are not really needed for 8.5, then remove the notice about them being required which is shown when installing 8.5.

[Mildur]

Hi Daniel,

We decided to notify customers because there will be a point where these permissions become mandatory.

Service Providers in particular need time to organize new permissions for dozens of customers. For some, it may take weeks to contact all customers and ask them to add the new permissions to their Entra ID applications.

By providing the notification and list now, you have time to reach out to your customers and request the new permissions before they become mandatory in one of the upcoming patches.

Best,
Fabian

[juerg.hirschi]

Hi Fabian

you have time to reach out to your customers and request the new permissions before they become mandatory in one of the upcoming patches.

i rather hope you will add the possibility as in previous cases like this, that we can re-run the organization wizard and all the needed permissions are set automatically.
not really a real-world scenario to contact each customer and ask them to add permissions manually.

thanks
Jürg

[Mildur]

Hi Jürg

Yes, my understanding is that we will add this capability for the new permissions in one of the patches before the deadline of Microsoft.

Best,
Fabian