Veeam M365 Restore Portal - Certificates

[mhschultz]

Hey everyone!

I'm in the middle of deploying the Restore Portal for Veeam M365, and there are a lot of certificates involved and I'm having trouble identifying what one is used for.

The one that I'm having trouble with is located under "Options" > "Authentication" > "Enable tenants authentication with organization credentials".
1. What does this certificate protect?
2. What servers/services does this need to be installed on.
3. What is the replacement procedure when this certificate expires.


And for completion sake, below are the other certificates involved. I don't have any questions on these, but if you feel like I'm missing information please feel free to add!

"Options" > "Authentication" > "Enable restore operator authentication with Microsoft credentials"
This certificate is used to encrypt network traffic between Veeam M365 and Veeam M365 REST API service. So if you have the REST API service installed on a separate box, this certificate will need to be installed there as well.
Reference: https://helpcenter.veeam.com/docs/vbo36 ... 70#tenants

"Options" > "REST API"
SSL Certificate presented to end users when visiting the restore portal.

"Options" > "Restore Portal"
This is the Certificate that is used between Veeam M365 and the Enterprise Application in AzureAD/EntraID

[Mike Resseler]

Enable tenant authentication with organization credentials is ment for service providers that want to offer the restore portal in a SaaS/ BaaS way. The service provider will have many different tenants (organizations) into one single console, and he or she needs to make sure that tenant A can log in to the restore portal through "user@tenantA.com" (or something like that). So if you are not in that situation, you don't need this.

I hope it makes sense, if not, feel free to ask more questions
Cheers
Mike

[mhschultz]

Hello!

So the only place this certificate needs to be installed is on the Veeam M365 server?

Also, what are the repercussions of having to replace this certificate when it expires? When we replace the certificate, we won't need to update the certificate anywhere else, like we would need to do with the Restore Portal or Rest API certificate?

[Mike Resseler]

As far as I know, this is indeed not needed.