The following table lists required permissions for data restore and data compare.
Required Roles and Permissions
Restore to Microsoft 365 and on-premises Microsoft Exchange
To restore data to Microsoft 365 and on-premises Microsoft Exchange organizations, you must grant the following roles and permissions to user accounts:
Restore to Public Folder Using Basic Authentication Method
Restore to Mailbox Using Basic Authentication Method
Restore Using Modern Authentication Method
The account used to log in to Microsoft 365 must be assigned the following roles:
Also make sure that the required settings are specified for the Azure AD application used for restore. For more information, see the Configuring Azure AD Application Settings section of the Veeam Backup for Microsoft 365 User Guide.
Compare Data with Production Environment
The Veeam Backup account must have a valid Exchange Online license and an active mailbox within the Microsoft 365 organization.
Adding User Account to Organization Management Role Group
To add user account to the Organization Management role group, use the following cmdlet:
Add-RoleGroupMember "Organization Management" –Member "<user_account>"
For more information about the Add-RoleGroupMember cmdlet, see this Microsoft article.
To grant Full Access to the account that owns a mailbox, use the following cmdlet:
Add-MailboxPermission –Identity "<target_mailbox>" -User "<user_account>" -AccessRights FullAccess –InheritanceType All
For more information about the Add-MailboxPermission cmdlet, see this Microsoft article.
To grant Full Access to the account that does not own a mailbox (in particular, through impersonation), use the following cmdlet:
New-ManagementRoleAssignment -Name "<role_name>" -Role ApplicationImpersonation -User "<user_account>"
For more information about the New-ManagementRoleAssignment cmdlet, see this Microsoft article.
Recalling Given Permissions
To recall given access level, run one of the following cmdlets:
Remove-ManagementRoleAssignment -Identity "<role_name>"