Considerations and Limitations

When you plan to deploy and configure Veeam Backup for Microsoft Entra ID, keep in mind the following limitations and considerations.

Backup Proxies

When managing general-purpose backup proxies, consider the following:

During Veeam Backup & Replication installation, a default general-purpose backup proxy is automatically added to the backup infrastructure. Do not remove or disable this proxy — otherwise, you will not be able to protect Microsoft Entra ID tenants and their logs.

Backup Repositories

When connecting a remote Microsoft Entra ID backup repository to the backup infrastructure, consider the following:

The repository must run PostgreSQL version 14 or later.
Veeam Backup for Microsoft Entra ID supports connecting one remote Microsoft Entra ID backup repository only.
Veeam Backup for Microsoft Entra ID supports PostgreSQL password authentication only.

Tenant Backup and Restore

When protecting tenant data, consider the following:

Veeam Backup for Microsoft Entra ID does not support backup of Microsoft Entra ID tenants located in China, Azure Government tenants, external tenants or Azure Active Directory B2C tenants.
You cannot protect multiple tenants by one backup job. Also, you cannot protect the same tenant by multiple backup jobs.
Veeam Backup for Microsoft Entra ID does not support restore of Microsoft Entra built-in roles, distribution security groups or mail-enabled security groups.
By default, Veeam Backup for Microsoft Entra ID does not back up relationships between items of protected Microsoft Entra ID tenants and Azure management groups. To back up these relationships, you must perform additional configuration steps described in this Veeam KB article.
You cannot restore more than 1000 tenant items during one restore session. Also, you cannot restore multiple item types simultaneously.
It is recommended that you restore service principals and the applications they represent together, during the same restore session. Otherwise, the applications will be restored with new IDs — as a result, the service principals will fail to be restored.

Log Backup and Restore

When protecting sign-in and audit logs, consider the following:

Protection of sign-in logs is excluded from all free licenses — with a free license, you can back up audit logs only.
Veeam Backup for Microsoft Entra ID does not support storing backed-up logs in multi-bucket repositories. For more information, see section Object Storage Repository.
Veeam Backup for Microsoft Entra ID supports producing backups for only those logs that belong to tenants whose data the product already protects. Moreover, the most recent restore points must be created no earlier 30 days prior to the log backup.