Veeam Backup & Replication - Granular Permissions

[tthomas1@ebsco.com]

Hello,
Our company has several divisions in multiple locations. We use Veeam Enterprise Manager to give admins at each division rights to restore files for their physical on-prem servers. This has worked well up until today.

I am now adding Veeam to our main headquarters where NetApp snapshots are used to back up VMs. The Veeam/NetApp integration works great, however I discovered that Veeam Enterprise Manager doesn't allow restores from snapshots. I will have to give division admins rights to use our Veeam Backup & Replication at headquarters instead.

Here is the problem: I can't figure out how to create the same granular permissions in Veeam B&R that I do in Enterprise Manager. I don't see where I can give one division rights to restore certain VMs and another division rights to other VMs. Can someone assist?

[Regnor]

Unfortunately only the Veeam Enterpise Manager offers granular permissions. The roles for VBR or the console apply globally.

[tthomas1@ebsco.com]

Thank you Renor, that's what I was afraid of :\. Man that is a HUGE pain to create an entire VM and VBR instance for each division at our HQ that we need to back up. I was hoping moving from Cloudberry to Veeam would be easy but doesn't sound like it. Thanks for the quick response!

[Andreas Neufert]

Thanks for sharing this. You feedback is noted. We did not allow this processing in EM for Self Service as it could harm the source storage system.

For example you use Thin Volumes and the additional snapshots/volume clones could lead into no storage space left and a lot of production VMs down.

We will work with the vendors to check for methods how we could address the above and other situations while enabling self-service for those restores.
One of the idea is to use a special reserved recovery volume space that could not harm the other volumes when it grows too much.

[tthomas1@ebsco.com]

Thanks Andreas. While I understand what Veeam is being cautious about, I would say this same caution is true with NetApp's own SnapCenter tool or even cloning a datastore manually. To me that's something an admin just needs to manage themselves and make sure there's enough space (and if not, temporarily disable to ability to do guest restores for certain admins).