Tenant Account Types

To work with the cloud resources provided by the SP, the tenant uses a tenant account. Veeam Backup & Replication offers the following types of tenant accounts:

Standalone tenant account — a regular tenant account for Veeam Cloud Connect Backup and Veeam Cloud Connect Replication scenarios. When the SP creates an account of this type, the SP specifies a name and password for the account, assigns a quota on the cloud repository to the tenant and subscribes the tenant to a hardware plan. To learn more, see Veeam Cloud Connect Backup and Veeam Cloud Connect Replication.
Active Directory tenant account — a tenant account for Microsoft Active Directory (AD) users. Tenants with accounts of this type can connect to the SP using their AD credentials and use Veeam Agent operating in the standalone mode to back up data to a cloud repository. To learn more, see Active Directory Tenant Account.
VMware Cloud Director tenant account — a tenant account used to provide Veeam Cloud Connect backup and replication resources to VMware Cloud Director organizations. When the SP creates an account of this type, the SP specifies an organization, assigns a quota on the cloud repository to the tenant and specifies an organization VDC that will be used as a cloud host for tenant VM replicas. To learn more, see VMware Cloud Director Tenant Account.

Active Directory Tenant Account

Veeam Backup & Replication lets the SP provide Active Directory users with access to a cloud repository. This functionality can be useful for large organizations that have Microsoft Active Directory and Veeam Cloud Connect infrastructure deployed and want to allow their users to create off-site backups with Veeam Agent.

Using the Active Directory tenant account functionality, a backup administrator of the organization can allocate quotas on a cloud repository directly for AD users without the need to configure subtenant accounts. For Veeam Agent users, the functionality helps to avoid maintaining additional set of tenant account credentials. Instead, users can connect to the SP using credentials of their user account in AD.

Active Directory tenant accounts utilize the secondary password functionality. To learn more, see Secondary Password for Tenant Account.

How Active Directory Tenant Account Works

Data backup to a cloud repository using an Active Directory tenant account works in the following way:

The SP creates an Active Directory tenant account. In the properties of the tenant account, the SP specifies settings to connect to the AD domain controller, selects an AD user account and assigns backup resources to the tenant account. To learn more, see Configuring Active Directory Tenant Account.
A Veeam Agent user creates a backup job targeted to a cloud repository. In the properties of the Veeam Agent backup job, the user specifies credentials of their user account in Active Directory.
Veeam Agent connects to the SP backup server. Veeam Backup & Replication on the SP backup server authenticates the user in Active Directory.
Veeam Backup & Replication creates a secondary password for the tenant account and passes this password to Veeam Agent. Veeam Agent saves the secondary password to its database.
During subsequent backup job sessions, Veeam Agent uses the secondary password to connect to the SP.

Considerations and Limitations

Consider the following:

You can create an Active Directory tenant account for a user account registered in any domain to which you have access.
You cannot assign replication resources to an Active Directory tenant account.
You cannot configure subtenant accounts for an Active Directory tenant account.
To connect to the SP using an Active Directory tenant account, you must use Veeam Agent for Microsoft Windows version 5.0 or later.
The Active Directory tenant account functionality is intended for Veeam Agent backup only. You cannot use an Active Directory tenant account to connect to the SP in the Veeam backup console. You cannot work with accounts of this type in Veeam Service Provider Console as well.