Feature Request: Enhanced RBAC for Backup Operators

[magcware]

We would like to request an enhancement to the Role-Based Access Control (RBAC) model in Veeam Backup & Replication to support a true Backup Operator role.

CASE : #08157631

The current Manage backups permission allows a user to create and manage backup jobs. However, this permission only provides visibility and management capabilities for jobs that were created by that same user.

As a result, users assigned to this role cannot view or manage backup jobs created by other users, even when those jobs belong to the same infrastructure or administrative scope.

In many enterprise environments, backup operations are performed by multiple operators working in shifts or by different members of the same operations team.

A common operational model includes:

• A backup administrator who initially creates backup jobs.
  • Multiple backup operators responsible for the daily operation of the environment.
  • Operators who need to monitor, start, stop, retry, edit (when authorized), and perform restores using existing backup jobs.

Because backup jobs are owned by the creator, operators cannot perform these tasks unless they are granted higher administrative privileges than desired.

This limitation prevents organizations from implementing the principle of least privilege while still allowing delegated backup operations.

Requested Enhancement

We would like Veeam Backup & Replication to provide an RBAC option that allows a custom role to manage backup jobs based on the assigned scope rather than on the job owner.

For example, introduce a permission such as:

• Manage all backup jobs within assigned scope

• or extend the existing Manage backups permission with an optional behavior:

• • Manage only own backup jobs (current behavior)
  • Manage all backup jobs within assigned scope (new behavior)
  Expected Capabilities
  
  A user assigned to this permission should be able to:
  • View all backup jobs within the assigned scope.
  • Create new backup jobs.
  • Edit existing backup jobs within the assigned scope.
  • Start and stop backup jobs.
  • Retry failed backup jobs.
  • Clone backup jobs.
  • Perform restore operations according to the assigned restore permissions.
  • Review job history, sessions, and statistics.
  The role should not require full Veeam Administrator privileges.

[Mildur]

Hi Miguel,

Did you have tried the RBAC Custom Role feature?

Review job history, sessions, and statistics.

History is currently showing "all job sessions", regardless if you have a scoped role.
But we plan to fix it in one of the upcoming updates.

Best,
Fabian

[magcware]

Thank you for your response.

Our request is actually different. The issue is not related to Job History.

What we need is the ability for a user with a Custom RBAC Role to view and manage all backup jobs within the assigned scope, regardless of which user originally created the job.

Currently, the Manage backups permission only allows users to see and manage the jobs they created themselves, which does not fit environments where backup operations are delegated to multiple operators.

Is there any plan to support this capability in a future release?