Veeam Backup for M365 Viewer Role

[phiaramos]

Hello,

May I ask if on the latest version of Veeam Backup for M365, you can be able to set a user that has a Viewer Role only?
Because I'm not seeing it on the help center guide
https://helpcenter.veeam.com/docs/vbo36 ... tml?ver=80

Thank you.

Regards,
Phia

[Mildur]

Hello Phia

If it's not there, so its not available. We are planning to introduce additional roles in future updates, but there's no estimated timeline for their release yet.

Can you clarify the purpose of having a Viewer Role only? If your goal is to have a team that can monitor backups without the ability to make changes or access data in restore points, I would recommend looking into our Veeam ONE integration with Veeam Backup for Microsoft 365. Veeam ONE allows you to monitor your VB365 environment, and it's free for Veeam Backup for Microsoft 365 users.

And if you are a Service Provider, our Service Provider Console can also give you monitoring capabilities into VB365.

Best,
Fabian

[phiaramos]

Hello Fabian,

We are having POC with client, they sent us an inquiry (below)
Q1 = "is there an option to get a copy of the back up mail file (pst), download it outside Veeam and provide it to the auditor? or copy the back up, put it within a Veeam folder, and grant the auditor access to the Veeam system with a read only?"

I believe when using the export to pst file and providing this to their auditor this is on read and write mode right? that's why I'm thinking of just giving the auditor the role of Viewer on the VB365 console.


If I may also add, there's another question from the customer
Q2= "the audit log will be a concern. that is usually a primary item looked for. if i have two assigned personnel with two different accounts to access the system, how can we verify who performed or accessed what?"
From what I know, Veeam doesn't have audit logs right? Does Veeam one covers this?

Thank you!

[Mildur]

Hi Phia

Q1: As I understand it, the auditor wants to verify that you can recover a mailbox. Exporting a PST file is a feature available in Veeam Backup for Microsoft 365. With a PST file, the auditor can view the data without being able to write back to the production tenant or alter anything on the backup server.

Q2: Veeam One has a Restore Operator Report. It will allow you to export a Report for various Restore types (Restore, View, Save, Export, Send).
That will allow you to proof who of the employees accessed protected M365 data. Besides the report, you can leverage the alarm "Restore activity (Veeam Backup for Microsoft 365)" to alert in realtime if a backup administrator access specific mailboxes, Sharepoint or teams conversations.

Best,
Fabian

[Polina]

In addition to that, you can configure audit email notifications using our REST APIs.

[phiaramos]

Hi Fabian and Polina,

Thank you for your response!
Will check this and also advise the customer

Regards,
Phia

[xariskk24]

Hello I have also a request from a big organization. It has only one tenant with thousands of users. It provides smaller organizations with an amount of 365 licenses. On of the smaller organization wants to use backup 365. The problem and what we want to accomplish is to use backup 365 with an account that having access only to this specific amount of mails and not using global admin that having access to view all the tenant (thousands of users). Is that possible some how?

[Polina]

Hi Harris,

Limiting the permissions required for backup to a specific scope of users is not possible - it's either everything or nothing.

Thanks!

[xariskk24]

So if I create a service account and an app with Microsoft graph and administrative unit with only the specific accounts you said that we will still having view all the tenant tree ?