Feature Request - Role for Enable/Disable Jobs

[pantoufle]

Hello,

I try to remove Full Admin rights to my Operation Team.

I replace their "Veeam Backup Administrator" Rôle" with 2 new role
Veeam Backup Operator
Veeam Restore Operator

Everything works fine except the Enable / disable jobs feature which is not available anymore

I usa many Powershell Scripts who enable or disable Veeam Jobs during Vmware Hosts / Cluster Reboot, Maintenance, etc...

How to give them this feature without give them Full Admin access.

Is it possible to have a new Role, "Backup Power User" ?

thank you.


Case # 02530745

[foggy]

How to give them this feature without give them Full Admin access.

I don't think this is currently possible, but thank you for the feedback, your use case is clear.

[branded-cloud]

I am running into issues with the roles available in VEEAM.

We need to make VEEAM multi tenant available and the challenge is that currently there is no role available to grant users the ability to schedule backups and to run restores (so 1 user with rights to both)

The only way I can grant a user the create jobs permission is to make that user backup Administrator which I do not want to do as that gives the user to much rights in the backup and replication console.

Current roles are:

Veeam Restore Operator - Can perform restore operations using existing backups and replicas ONLY
Veeam Backup Viewer - Has “read-only” access to Veeam Backup & Replication — can view existing and performed jobs and review the job session details.
Veeam Backup Operator - Can start and stop existing jobs, BUT cannot use Restore Option
Veeam Backup Administrator - Can perform all administrative activities in Veeam Backup & Replication.

A new role could be:

VEEAM Backup Job creator - Has permissions to create and schedule backup jobs

And then (if that is even possible) grant a user the rights:

VEEAM Backup Job creator - Has permissions to create and schedule backup jobs

and

Veeam Restore Operator - Can perform restore operations using existing backups and replicas ONLY

and

Veeam Backup Operator - Can start and stop existing jobs, BUT cannot use Restore Option


An even beter solution would be to have the ability to create custom roles and grant the access needed to that role.

[Dima P.]

Hello branded-cloud.

Can you please elaborate what permissions from existing administrator role would you like to block from a user in your scenario? Thank you in advance.

[branded-cloud]

Hi,

We would like to hide the following (or at least the following)

- Insight in linked storage arrays, so hide the whole storage Infrastructure menu option
- hide the Backup infrastructure menu option

Basically we would like to see a user that can create backup jobs, maintain them and perform restores and without this user having any other insights in the environment.

So make it possible for person A to administer the whole Veeam setup and for Person B to only perform backup and restore operations.

[Dima P.]

Understood, thank you! As a temporary workaround you can give a simple user Backup Operator & Restore Operator permissions at the same time (but that does not provide the ability to create new backup jobs).

[branded-cloud]

That work around does not really work for our customers, as they still cannot create jobs on their own like you stated and as a service provider that is not really friendly towards our customers.

The other reason we really are looking for this is so that we can use snapshot integrations without customers being able to see everything on the storage array as we need to provide admin credentials to the storage array (netapp in this case) and that means expasion all the SVM's on that array

[edirschedl]

In comparision to add additional roles, it would be better to have the possibility to create own roles with individual settings.

In my dream imagination of a new permission control center in VEEAM I can mark / unmark every feature, define different role sets and can also restrict specific features (for example restores only from specific vms / folders) for specific users or groups.

Also here in a enterprise environment the current permission function isn't far away from a good and efficient way. For example I have 5 different Exchange admins which want to do single item restores of their Exchange Systems. Sadly I've to give them the Restore Operator role, which has permission also for all systems, which aren't Exchange. From security point of view not so nice...

[ChrisGundry]

I have the same wish as edirschedl. Much more granular permissions, ideally based on VM folders or buisness views. We want to delegate restore rights for exchange items and our file servers to service desk admins, but no other restore rights. That way they can restore user files only, but not VMs and not files from our HR server etc.

[Gostev]

We want to delegate restore rights for exchange items and our file servers to service desk admins, but no other restore rights. That way they can restore user files only, but not VMs and not files from our HR server etc.

This has been available for a while now > Configuring Restore Scope

[Poweruser]

Also it would be nice to grant on job basis only.
so someone could just start a special job like backup to tape or sth else.

[edirschedl]

This has been available for a while now > Configuring Restore Scope

Yeah you're right in Enterprise Manager this feature I'm interested in is integrated and works really good. But I need this same feature also in B&R console, because the restore options for the most restore types (Full-VM, FLR, Exchange..) are much better there. That's a big problem in my opinion that we have two different feature sets in two different GUIs. And there is no GUI which have really all features included.

[MichaelG7]

I would welcome the role of a TAPE OPERATOR.
This role should have the rights to move Tapes in different Media Pools and mark them as free.

[Dima P.]

Michael,

We plan to add 'Tape Operator' role in upcoming Update 4. Cheers!

[MichaelG7]

Thank you! Which rights are provided with this role?

[Dima P.]

Here is the list:

Code: Select all

Tape Inventory 
Tape Export 
Tape Eject
Tape Catalog 

Inventory Library/SA Drive
Catalog Library/SA Drive
Rescan Library/SA Drive

Import Tapes
Eject from Drive

Move tape to Media Pool
Erase tape
Mark tape as free

[Poweruser]

Its nice to have role based access control, its more nice to assign right directly per user/group basis and build your own groups.
then you can create your own rules. that would be the best in most cases.

because noone really knows which roles the company has.
exchange is sth. like that.. too many roles who never fit :-D

[branded-cloud]

Any updates on roles that can do both backups and restores but are not full admin? It is kind of silly you cannot make an account for a user that is allowed to make a backup and do a restore.

Makes the product really difficult to use at the moment as a SP

[foggy]

There will be something around it in U4.

[Vitaliy S.]

Hello,

On a side note, do you want to provide these capabilities to your IT staff or to the managed client IT engineers?

Thank you!

[Steve-nIP]

+1

For this, this is a feature we need

[arosas]

I haven't found other posts around roles and refined permissions. Is this going to change anytime soon? Are granular custom roles coming to Veeam?
It would be very nice to be able to allow 1 user to disable\enable one job and that's it.

[Dima P.]

Hello Tony,

Unfortunately is not possible to create a user with the dedicated scope of jobs to manage, but I'll add your vote to this feature request. Thanks!

[Mofamike]

+1 for the option to give users beside admins the option to disable and enable jobs