VEEAM Backup Replication Roles (feature request)

[mattk0]

I'd like to request some additional roles be added to the VEEAM Backup and Replication Console. Currently the only roles available are (per https://helpcenter.veeam.com/docs/backu ... tml?ver=95)
- Restore Operator (can perform restores)
- Backup Viewer (Read-only access to view jobs)
- Backup Operator (Can start/stop existing jobs)
- Administrator (full access)

I'd like to propose having another role for a Backup Creator/Editor of someone who can create and edit backup jobs but yet doesn't have rights to do deletions from the 'files' or change configuration backup, or other administrative VEEAM settings.

Does anyone know if this is possible or agree with some more granularity needed for these roles? Thanks,

[veremin]

I'd like to propose having another role for a Backup Creator/Editor of someone who can create and edit backup jobs but yet doesn't have rights to do deletions from the 'files' or change configuration backup, or other administrative VEEAM settings.

Someone having rights to edit job settings would be automatically able to "delete" backups by shortening retention and executing new backup cycle, wouldn't he?

[Vitaliy S.]

Hi Matt,

That's not possible today, but can you please elaborate a bit more on your use case? Do you provide backup as a service internally or you're an MSP?

Thanks!

[mattk0]

Someone having rights to edit job settings would be automatically able to "delete" backups by shortening retention and executing new backup cycle, wouldn't he?

Interesting - I hadn't thought of that.

Our use case is just trying to prevent a rogue/accidental admin from going into the files from a backup copy or standard job and deleting data but still being allowed to do standard administrative details such as creating jobs and adding VM's to existing jobs. I'm guessing it's too detailed to ask that an admin be able to modify just retention of existing jobs or create new ones....

[Vitaliy S.]

If you're worried about backup being deleted, then why not to offload it to archival media or any device not connected to Veeam B&R? This would protect you not only from the rogue admin, but also from different malware (cryptolockers etc.)

[mattk0]

We're using Exagrid for our primary and backup/DR site - I was told this wasn't possible to offload it to ExaGrid seperate from VEEAM B&R

[Vitaliy S.]

Well, you can definitely access ExaGrid device manually, right? Here is a similar topic that might be useful > New ransomware that targets backups. Are we susceptible?

[mattk0]

Bumping this as we have a similar issue again where we'd like our helpdesk to be able to restore files, but the Backup Restore role in the Thick client is allowed full access to backup the VM as well. We'd like the same granularity of only restoring files that you have in the webconsole in the thick client as well