Permissions

This section describes permissions required for solution operation.

Backup

1. By default, Veeam Backup for Microsoft Office 365 (Veeam Backup for Microsoft Office 365 Service) runs under Local System account, thus having administrative rights on the local machine. If you want to change this account, ensure that the new account has administrative rights on the local machine, too.
2. The account used to connect to the Exchange Online Organization for mailbox data backup should belong to that organization; having a mailbox in that organization is optional.
3. Make sure this account has the following Exchange roles:

• Role Management role - to manage role assignments
• View-Only Configuration role - to obtain the necessary organization configuration parameters
• View-Only Recipients role - to view the list of mailbox recipients (required for job creation)

4. This account should also have the Application Impersonation role. This role can be assigned using any of the following methods:

• Automatically (recommended), by selecting the corresponding option when adding Microsoft Exchange Online Organization to the solution scope.
• Manually, by using Exchange Management PowerShell cmdlets.
• By role assignment in Exchange Control Panel.

5. If you plan to use e-mail notifications on backup job results, mailbox address that will be used as notification sender should be delegated the rights to connect to SMTP server. See the E-mail Settings for Notifications  for details.

Restore

1. To be able to connect to Veeam Backup for Microsoft Office 365 from Veeam Explorer for Exchange, user account (either under which Veeam Explorer runs, or different account) should have local administrative rights on the machine where Veeam Backup for Office 365 works. See also Adding Databases to the Scope Manually.
2. To restore folder(s)/item(s) to the Microsoft Exchange Online Organization, the account you specify in the restore wizard will need sufficient access rights to the target:

• If you want to connect to Exchange server using the account of the target mailbox user, enter the corresponding account (no additional rights are required).
• If you want to use another account, make sure it has the ApplicationImpersonation role for the corresponding mailbox. Refer to this article for details on impersonation.

3. To restore to the on-premises Microsoft Exchange organization, the account you specify in the restore wizard will need corresponding access rights:

• If you plan to use the account that owns a mailbox on target, make sure it has Full Access for that mailbox.
  Full Access can be granted, for example, through impersonation, or through rights assignment with the following cmdlet:

• If you plan to use the account that does not own a mailbox on target (for example, a service account), then access rights for target mailbox should be granted through Exchange impersonation.
  For example, you can run the following cmdlet:

Example

The following cmdlet shows how you can narrow the group of users who will be assigned the appropriate role to access the target mailbox at restore. For that, it uses the CustomRecipientScope parameter, with sample Organizational Unit specified as the scope:

Recalling Privileges Granted Through Impersonation

When finished working with Veeam Backup for Microsoft Office 365, you may want to recall the privileges assigned to the user through impersonation. For that, you can run the following cmdlet: