Help Center
Choose product document...
Veeam Backup & Replication 9.5
Enterprise Manager User Guide

Managing Accounts and Roles

Veeam Backup Enterprise Manager implements security by limiting access to web management website features and data, based on user roles. This empowers administrators to delegate permissions in a very granular way, on an as-needed basis, to the individuals who will complete the restore process. It is possible, for example, to delegate permissions to recover files without actually being able to see the contents of the files.  

Managing Accounts and Roles Note:

For setting up self-service recovery delegation scope, consider that reverse DNS lookup on Veeam Backup Enterprise Manager server must be functional.

To be able to log in to the Veeam Backup Enterprise Manager website, a user must have the Portal Administrator, Restore Operator or Portal User role assigned.

Enterprise Manager Role

How is Assigned

Access to Configuration

Allowed Operations

Portal Administrator

Initially by default - to the users listed in the local Administrators group and the user who installed Veeam Backup Enterprise Manager.

By an existing Portal Administrator in the Enterprise Manager > Configuration > Roles

Yes

Full access to all available operations on all tabs of the web UI.

Portal User

By Portal Administrator in the Enterprise Manager > Configuration > Roles

No

  • Access VMs from the restore scope on the VMs and/or Files tab
  • Access reports for these VMs
  • Run Quick Backup for VMs from the restore scope on the VMs tab
  • Perform restore operations as permitted by the delegation settings

Restore Operator

By Portal Administrator in the Enterprise Manager > Configuration > Roles

No

  • Access VMs from the restore scope on the VMs and/or Files tab
  • Perform restore operations as permitted by the delegation settings

Users with the Portal User or Restore Operator role can access their restore scope — a list of VMs that can be recovered by appropriate personnel. For example, database administrators can restore database servers (SQL, Oracle, or other) — this is their restore scope; Exchange administrators’ restore scope will include Exchange server VM, and so on. Depending on their role configuration, non-administrative users can access the VMs and/or Files tab of Enterprise Manager web site.

Managing Accounts and Roles Important!

Restore scope (list of VMs a user can recover) can be customized if you have Enterprise Plus edition of Veeam Backup & Replication; in other editions, this list includes all VMs and cannot be customized. However, you can delegate recovery of entire VMs, guest files, or selected file types. Possible delegation options are described later in the Restrictions for Delegated Restore section.

Managing Accounts and Roles Note:

Consider the following:

  • If you clear the Allow restore of: Entire virtual machines check box, then corresponding Portal User will be able to view all VMs processed by managed backup server(s) - on the VMs tab.
  • If you clear the Allow restore of: Guest files check box, then corresponding Portal User will be able to browse guest OS files for all VMs processed by managed backup server(s) - on the Files tab.

This refers to all editions of the product.

Assigning a Role

To specify security settings for a user or a group of users:

  1. Open the Configuration tab.
  2. Open the Roles section on the left of the Configuration view.
  3. Click Add on the toolbar.
  4. In the Account type field, select the type of account you want to add: User or Group.
  5. In the Account field, specify the user account in the DOMAIN\Username format.
  6. From the Role list, select the necessary portal role to be assigned: Portal User, Portal Administrator or Restore Operator.

Managing Accounts and Roles 

Managing Accounts and Roles Note:

To be able to assign any of these roles to Active Directory domain users and/or groups, make sure that Veeam Backup Enterprise Manager service account has sufficient rights to enumerate Active Directory domains. (By default, Active Directory users have enough rights to enumerate Active Directory domains.)

You can allow a new user to restore entire virtual machines and/or guest files only; you can also specify the Restore scope for this account, as described in the section below. As an administrative user, you can refresh all scopes of all accounts manually — for that, click Rebuild roles. Consider that this operation will affect all configured roles.

Managing Accounts and Roles 

To edit settings of an added user or group, select it in the list of roles and click Edit on the toolbar. Then edit user or group settings as required.

To delete an added user or group, select it in the list and click Remove on the toolbar.

Veeam Large Logo

User Guide for VMware vSphere

User Guide for Microsoft Hyper-V

Enterprise Manager User Guide

Veeam Cloud Connect Guide

Veeam Backup Explorers User Guide

PowerShell Reference

RESTful API Reference

Veeam Backup FREE Edition User Guide

Veeam Backup for Microsoft Office 365

Veeam ONE Documentation

Veeam Endpoint Backup Documentation

Veeam Management Pack Documentation