Granular restore operator options needed (RBAC)

[Vejete]

Our goal is to give the helpdesk only the permission required to browse, select, and restore an individual Exchange item.

The problem we are encountering is:

• If we use the Restore Operator role in the VBR console, the helpdesk user can restore anything.

• If we use EM's self-service restore for Exchange, the helpdesk user cannot browse and select a specific Exchange item. Their only option is to restore ALL missing Exchange items with or without a timeframe.

How can we achieve our stated goal of giving the helpdesk only the permission required to browse, select, and restore an individual Exchange item with no other restore permissions included (SQL, file, VM, etc.).

[Dima P.]

Hello Jim,

Are you saying that with Microsoft Exchange Items role checked restore operator cannot restore specific items?

[Gostev]

@Dima P. yes, this is exactly what he is saying, and it is totally expected because it's how this functionality works in EM. There's no web version of Veeam Explorer for Exchange.

@Vejete this is not possible to achieve at the moment.

[Vejete]

@Gostev, thank you for your reply. May I know please what is the best way to officially submit "more granular restore control in EM self-service" as an enhancement request?

My customer wants their helpdesk to restore guest files and Exchange items without full-blown access to the VBR console.

Thank you!

[veremin]

May I know please what is the best way to officially submit "more granular restore control in EM self-service" as an enhancement request?

You've already done that by posting on these forums. Thanks!

[mberrey]

I'll add,

A large enterprise customer mentioned how the restore operator role needs additional permissions concerning Instant Recovery. They still see an issue with this as they recently had a restore operator that started an IR and left it running for weeks before anyone noticed. Can an IR run indefinitely? What happens to the VM in the backup job if that same VM is continuously running in the IR? There's also concerns of resource usage from IR's left running without warning. It would be great if this could be prevented entirely for the restore operator role as they still want the user to have file-level restore but not full VM or IR.