Account: Entra ID or Shared Key?

[jorgene]

Hi, i've been playing around with Veeam Vault for a couple of weeks or so to test the immutability function.
We purchased through a distributor and got access to a subscription.
I've used shared key when setting up the account to access the VDCV from the respository from the VBR server.
But after i upgraded to 12.3.1.1139 now below managed servers it lists the server as Out Of date. And upgrade pushes me to Switch to Entra ID authentication.
So what is the best thing to do here? I can authenticate to the Entra ID with my veeam account.(tested on LAB VM). But what does it really do when Authorizing backup server?

Can i stay on using shared key or should i switch to Entra ID Authentication?

[KirillChuxlancev]

Hello!

It is better to switch the authentication method to Entra ID from the security prospective. This authentication model is generally recommended by Microsoft, substituting the old Shared Key model. What happens under the hood - VBR registers a special Entra ID application on the cloud side, setting the configuration automatically. This application can be considered a "service account" that is used in communication between VBR and VDCV.

[gtelnet]

Is it currently or are there plans to mandate Entra ID with Veeam Vault or is there a way to continue using shared keys so that we can continue VBR side car testing without having to register the second VBR during each recovery test? As a VCSP, we stand up a new sidecar VBR for each customer's recovery test as we cannot retain it between tests. Thanks!

[KirillChuxlancev]

Currently, there are plans to transition authentication to Entra ID as the primary method for integration with Veeam Vault, gradually phasing out the Shared Key model. This change aims to improve security and streamline access management. However, I don’t have an exact timeline for when this transition will be fully implemented.

[gtelnet]

Do you have any suggestions on how to add a vault bucket configured with Entra ID to a sidecar VBR via automation with powershell or REST API without human intervention? Or perhaps Veeam can leave access keys as a backup option for those who require it? Thank you!

[albertwt]

Currently, there are plans to transition authentication to Entra ID as the primary method for integration with Veeam Vault, gradually phasing out the Shared Key model. This change aims to improve security and streamline access management. However, I don’t have an exact timeline for when this transition will be fully implemented.

Yes, that is greatly appreciated.
THank you and keep us posted where possible, @KirillChuxlancev.

[KirillChuxlancev]

You can add a Veeam Vault repository using PowerShell cmdlets such as Add-VBRDataCloudVaultRepository and Get-VBRVeeamDataCloudAssignedVault. (https://helpcenter.veeam.com/docs/backu ... ml?ver=120, https://helpcenter.veeam.com/docs/backu ... ml?ver=120)

Currently, there is no native, fully automated method for authenticating to Veeam Vault via Entra ID without human intervention (the authentication flow typically requires interactive consent for Entra ID, which is a security best practice).

If you are seeking a non-interactive automation scenario, you may need to explore third-party automation frameworks or custom scripting workarounds, but please note these are not officially supported and may not align with Veeam's security recommendations.