Entra-ID VBR server crash recovery steps

[oscarm]

To get to know how Entra-ID works I have setup a test vbr with a test tenant in order to get an understanding on how it works, and what you can and can't do. I am looking into having everything in place for the occurance the veeam server itsself crashes beyond repair.

So far I have setup a scheduled task that will dump the entra-id database into a sql dump file with pgdump. I also have setup the configuration backup with encryption, so I have the config backup go to a different place than the Veeam server only, and so are the dump files.

I also have created another vm with a fresh install of Veeam. I restored the configuration backup and had a look on how it looked, and the Entra-ID backups were shown. Great I thought, it seems the database is backed up in the config backup, just as it does for regular vm backups. I looked in pgadmin, but there was no Entra-ID database. No problem I thought, I'll recreate the database and restore the dump file.

Dump file restore went without a hitch, and the restored database looked similar to what it does on the original server. I had turned off all Veeam services when the database was recreated and restored, and after the restore I started all services and had a look.

I started a restore, but then it showed an error message "The underlaying provider failed to open".

So my question is, what am I missing here in order to have a loss of the Veeam server covered?

[Mildur]

Hi Oscar,

Please try the following steps:

0.) Create a dump of the original EntraID PostgreSQL database.
1.) Import your database dump into a new PostgreSQL database.
2.) Configure the new backup server to use that database as a repository: Veeam Entra ID Connect Remote Repository Documentation.
3.) Rescan the backups: Veeam Entra ID Rescan Repository Documentation.

After completing these steps, all EntraID restore points should be available for restore.

If you'd like to use the configuration backup restore, you may need to "remove EntraID backups from configuration" before reconnecting with the new PostgreSQL database and performing the rescan.

Best regards,
Fabian

[oscarm]

Hi Fabian, I will test your steps and report back with the result.

Thanks so far for the suggestions!

[oscarm]

Hi Fabian,

I did the steps as you described. Only thing is that in the inventory I do not see the tenant present. I was able to rescan the backups, but it stated the found repository was not in the inventory. So I tried a configuration backup restore. I did not see the option "remove EntraID backups from configuration". After the config backup I did a rescan again of the entra-id backups but could not restore anything.

Because I was not sure I reverted the snapshot of the vm, stopped all veeam services. created database and restored it with pg_restore. then use the databaseconfig to set it to localhost. Started all veeam services, but again once I click the Microsoft Entra ID in Inventory there is no Entra ID tenant present.

So at this point it did not make any sense to me to rescan the repository. I did restore a configuration backup. Only options I see is Backup and Replicatia catalog with a tick box, Session history with a tick box, Enable required PowerShell execution policy for SCVMM with a tickbox, and Backup existing database before restore (recommended).

So I did the steps you suggested, but prior to rescan the entra-id repository I restored the configuration in order to get tenant restored into the inventory.

So my steps to get it working:

1. backup original entra-id postgres database
2. stop all veeam services and recreate empty database
3. pg_restore entra-id repository database
4. configure database server with dbconfig (not sure if this is actually necessary as source vbr server had local entra-id db)
5. restore configuration backup (in order to get tenant back in inventory)
6. rescan entra-id repository
7. enable all necessary jobs again

If there's an other way to get the tenant put back in the inventory without a configuration restore I would like to know how.

The question I have is why do the entra-id tenants get backed up in the configuration backup, but the entra-id repository does not get backed up in configuration backup ?

[Mildur]

Hi Oscar

Thank you for testing and providing your steps.
Give me some time to play through the steps in my labs. We may have to document the steps a bit better. In the help center or in the upcoming FAQ update here in the forum.

If there's an other way to get the tenant put back in the inventory without a configuration restore I would like to know how.

I'm just guessing at the moment, but If it's a single tenant and no other backups, then I would just re-add the tenant with the wizard. Especially for testing.

The question I have is why do the entra-id tenants get backed up in the configuration backup, but the entra-id repository does not get backed up in configuration backup ?

Whenever you rescan backups, we will store metadata of the discovered backups in the configuration database. That happens for all sorts of workloads/backups. Machines, Tapes, File Backup and also Entra ID backups.
What you see with the configuration restore is the metadata of your backup. It tells the backup application that there are restore points in your backup file, in case of EntraID in that database.

Best,
Fabian