Entra-ID ARM Role Assignments backup question

[oscarm]

In https://www.veeam.com/kb4683 it is explained how you can enable the ARM role Assignments backup.

Why is this not enabled by default? Is there a specific reason this is not enabled by default?

Is there any disadvantage in enabling this?

[oscarm]

I have created Case # 07584284.

[veremin]

For a successful backup of ARM Role Assignments, the application needs the Reader Role in the Azure Root management group. This cannot be done automatically unless the Global Administrator has been granted elevated access (the "Admin can manage access to all subscriptions and management group" toggle). In most cases, such access is not granted for security reasons.

Therefore, in the first release, we decided not to enable this functionality by default, as in majority of cases we cannot automatically configure the application properly. Instead, we decided to hide it under a registry key and require some manual operations from user.

Perhaps in one of the future releases, we will come up with a more elegant solution.

Thanks!

[oscarm]

Hi Vladimir,

Thanks for clearing this, now you mention it, this actually makes sense.

regards,
Oscar