Veam backup account becomes co-owner of content on Onedrive.

[Jeffrey1979]

One of our clients are using "Veam Backup for Microsoft Office 365" and they have noticed that the backup account we used (VBOACCOUNT) becomes the co-owner of some Onenote files on Onedrive or at least if you go to "share - shared with" option from the main menu we see the current owner and next to that our "VBOaccount" (Veeam backup account) as (co-)owner.
I would like to know if this is normal behaviour which we can ignore or is there a setting we might have put wrong, I'm not sure if the file was recovered once but besides that it shouldn't matter as it would put the data back as it was and not add a new owner.

[Polina]

Hi Jeffrey and welcome to the Community!

The service account you use gets/has the Site Collection administrator permissions and hence becomes listed as a co-owner for OneDrive and OneNote documents - that's expected behavior.

[Jeffrey1979]

Thank you for your reply!

Our client is asking if we can hide this vboaccount somehow? Apparantly there are several Veeam backup service accounts and the other ones are not showing as well.
So in short is it possible to hide this co-owernship from within the Veam backup for Microsoft Office 365 settings or within OneNote - share with' option somehow?

[Polina]

Jeffrey,

That's not possible by means of VBO, because this is the way Microsoft sets ownership for Site Collection Administrators.

[JaySt]

sorry to bring back an old thread, but refering to this thread below and the mentioned powershell script. Would it be a possible workarround to schedule a powershell script to remove the VBO service account after the backup finshes? As mentioned in the thread, it will be added on the next run anyway. So removing it from all sites after the backup could be an option to prevent questions from users etc.
are there downsides perhaps?

veeam-backup-for-office-365-f47/backup- ... 53811.html

Code: Select all

Connect-SPOService -Url https://companyname-admin.sharepoint.com -Credential (Get-Credential)
$Sites=Get-SPOSite -Limit all
foreach($Site in $sites){
    Set-SPOUser -Site $Site.URL -LoginName "name@myoraganization.onmicrosoft.com" -IsSiteCollectionAdmin $False
}

[Mike Resseler]

Hi Jay,

The backup would take a very long time, both when it starts and finishes would be one of the downsides.

I understand that some customers might start asking questions, but when the service account has the right name (e.g. backupadmin or something similar) I don't think it is such a problem?

[JaySt]

Ok yes, the amount of time needed for the processing of the owner permissions is a big disadvantage.
Indeed, i dont think it would be a big problem. Just like you mentioned, it's something to think about when creating the service account in that case.
However, when thinking this over a bit longer, how would this list look like when having a large tenant with multiple service/auxiliary accounts (could easily be 8+ ? would those all be listed as owner ?
When those auxiliary accounts would be members of a group and that group is used, is only the group listed or are all group members placed on the owners list?
I have not had the chance to test this yet.

[Mike Resseler]

We put the group there, not the different group members.