Is SAML more secure than domain joined ?

[matteu]

Hello,

Can someone explain me what is the difference in term of security between domain join backup and SAML integration ?

I mean, the first idea to not be domain joined is to avoid an attacker to access backup if domain account with some privilege is stolen or if backup server is compromise to get access to AD domain right ?

So, If SAML account is compromised, the user has automatically access to backup server right ? And then he can probably retrieve credentials stored in the VSA / VBR server.

I never join backup server into the domain and I would like to understand why SAML integration is better ... (For sure Entra ID account have more security than AD account with conditionnal access / PIM / MFA but I would like to know the Veeam position on it )

[vnikiforov]

Hello,

Domain join and SAML operate at different layers: SAML is what lets you keep the backup server out of the domain while still using centralized identities.

Domain join is machine-level. On a Windows-based backup server, AD can control the OS itself through GPO, domain admins access the machine directly, for example - dump the configuration database and decrypt stored credentials. (theoretically). The Veeam appliance already reduces this by design, since domain join there is Kerberos SSO basically, and host management console stays on local accounts anyway.

SAML is application-level. The backup server accepts one thing from the identity provider: a signed authentication assertion. Nothing in identity provider can manage the server. Worth noting that a compromised SAML account still gets exactly the role you assigned it in Users & Roles BUT that is an application session, not OS access.

So yes, a stolen SAML account with the Backup Administrator role can still do damage inside the product, exactly like any other account holding that role.
With SAML, authentication happens entirely at the identity provider, so the second factor for such an account is whatever your IdP enforces (MFA, conditional access, PIM). You could further limit the blast radius by using four-eyes authorization.

[matteu]

Thanks for your answer.
Is it a best practice to use saml instead of create local account for each people that need to manage the backup ?

[vnikiforov]

Hello,

It is an individual decision based on internal security regulations, possible infrastructure limitations, and so on. Each and every case is different.
We can't advise how to configure your systems; we can only clarify what a certain feature does to help you make a decision.