Comprehensive data protection for all workloads
Post Reply
121x
Influencer
Posts: 10
Liked: never
Joined: Jun 22, 2018 10:46 am
Contact:

Delegating Backup Operator Access

Post by 121x » Aug 22, 2018 1:16 pm

Hi All,

Situation is this - we need to provide access to individuals of different environments that are encompassed under a single backup environment. The desire is for these administrators to have the ability to perform one-off backups and perform restores at both the VM and file level. However we do not want them to have the ability to manipulate the backup jobs or backup server settings.

When assigning access for the web portal, it appears restore options are limited. IE. the option to restore appears to only overwrite the existing VM with no option to perform a side by side restore with the existing live VM untouched for testing purposes. Likewise, without assigning local admin permissions, they do not seem to be able to perform a one-off backup from the portal.

So my question is, what is the best and most efficient way to grant backup and recover permissions without the providing the ability to make changes to the backup server, or backup jobs? This is important because we want a single backup environment for visibility and auditing, but we want to provide delegated access to the administrators responsible for the different environments, without creating a number of separate backup management servers.

Thank you

bdufour
Expert
Posts: 200
Liked: 30 times
Joined: Nov 01, 2017 8:52 pm
Full Name: blake dufour
Contact:

Re: Delegating Backup Operator Access

Post by bdufour » Aug 22, 2018 3:05 pm

121x wrote: we need to provide access to individuals of different environments that are encompassed under a single backup environment.
what do you mean, exactly, by environments? are these different companies all together (knid of sounds that way)? can you explain these environments in a bit more detail? IE - different domains, same domain, ect

121x
Influencer
Posts: 10
Liked: never
Joined: Jun 22, 2018 10:46 am
Contact:

Re: Delegating Backup Operator Access

Post by 121x » Aug 22, 2018 3:11 pm

The 'environments' are just various business units who have their own application specific environments ranging from between 12 and 50 servers - with administrators who are directly responsible for managing these environments. They are all under a single domain. As a requirement and part of an ongoing compliance effort, there are SLA's associated with recovery of these environments. As a result a decision was made to put the onus of recovery and recovery verification on that of the dedicated unit administrators. Hence the requirement to provide a certain level of functionality with providing access to more of the backup infrastructure then necessary.

bdufour
Expert
Posts: 200
Liked: 30 times
Joined: Nov 01, 2017 8:52 pm
Full Name: blake dufour
Contact:

Re: Delegating Backup Operator Access

Post by bdufour » Aug 22, 2018 3:22 pm

have you looked into this? Distributed Deployment

https://helpcenter.veeam.com/docs/backu ... tml?ver=95

121x
Influencer
Posts: 10
Liked: never
Joined: Jun 22, 2018 10:46 am
Contact:

Re: Delegating Backup Operator Access

Post by 121x » Aug 24, 2018 11:16 am

Hi,

Yes I did, thank you. In reading through that page again I did notice it specifically state that you can delegate recovery permissions, which we already have in place and working. The article does not say anything about delegating the ability to perform on-demand backups however. So I can only assume that there is no way to make that work unfortunately. Hopefully this is something that Veeam considers in the future. I know from experience that in most companies and organizations ALL backups are handled by a select number of administrators. However I also know from experience that our use case is not unique.

121x
Influencer
Posts: 10
Liked: never
Joined: Jun 22, 2018 10:46 am
Contact:

Re: Delegating Backup Operator Access

Post by 121x » Aug 24, 2018 2:16 pm

It looks like I was a bit premature on this. For whatever reason I failed to realize that you can assign roles via the main menu | Users and Roles of the management console.

Post Reply

Who is online

Users browsing this forum: arosas, Google [Bot], nmdange, Patric and 52 guests