Editing Access Permissions

If you want to store in the backup repository backups of virtual and physical machines created by Veeam Backup & Replication additional solutions, for example, Veeam Agent for Microsoft Windows, Veeam Agent for Linux, Veeam Plug-ins for Enterprise Applications and so on, you must set up access permissions to backup repositories.

Access permissions are granted to security principals such as users and AD groups by the backup administrator who works with Veeam Backup & Replication. Users with granted access permissions can target backup jobs created by additional solutions at this backup repository and perform restore from backups located in this backup repository.

Right after installation, access permissions on the default backup repository are set to Allow to everyone for testing and evaluation purposes. If necessary, you can change these settings.

After you create a new backup repository, access permissions on this repository are set to Deny to everyone. To allow users to store backups in the backup repository, you must grant users with access permissions to this repository.

Managing Permissions of Backup Repositories

To grant access permissions to a security principal:

1. Open the Backup Infrastructure view.
2. In the inventory pane, click one of the following nodes:

• The Backup Repositories node — if you want to grant access permissions on a regular backup repository.
• The Scale-out Repositories node — if you want to grant access permissions on a scale-out backup repository.

3. In the working area, select the necessary backup repository and click Set Access Permissions on the ribbon or right-click the backup repository and select Access permissions. If you do not see the Set Access Permissions button on the ribbon or the Access permissions command is not available in the shortcut menu, press and hold the [Ctrl] key, right-click the backup repository and select Access permissions.

4. In the Standalone applications window, specify to whom you want to grant access permissions on this backup repository:

• Allow to everyone — select this option if you want all users to be able to store backups in this backup repository. Setting access permissions to Everyone is equal to granting access rights to the Everyone Microsoft Windows group (Anonymous users are excluded). Note, however, this scenario is recommended for demo environments only.
• Allow to the following accounts or groups only — select this option if you want only specific users to be able to store backups in this backup repository. Click Add to add the necessary users and groups to the list.

Managing Permissions for S3 Compatible Object Storage

If you plan to use S3 compatible object storage as an object storage repository, you must set up access permissions to the object storage. These permissions are used if you keep in object storage repositories backups created by Veeam Agent or by Veeam Cloud Connect tenant. For more information, see Backup to Object Storage in the Veeam Agent Management Guide and Backup to Object Storage in the Veeam Cloud Connect Guide.

To manage permissions for S3 compatible object storage, perform the following:

1. In Veeam Backup & Replication, open the Backup Infrastructure view.

2. In the inventory pane, click the Backup Repositories node.

3. In the working area, select the necessary S3 compatible object storage and click Set Access Permissions on the ribbon or right-click the backup repository and select Access permissions. If you do not see the Set Access Permissions button on the ribbon or the Access permissions command is not available in the shortcut menu, press and hold the [Ctrl] key, right-click the backup repository and select Access permissions.
4. On the Security tab, specify how Veeam Agent or a tenat will access an S3 compatible object storage repository:

• Agents share credentials to object storage repository — select this option if you use the direct connection mode to access the S3 compatible object storage repository. In this case, Veeam Agent will use credentials that you specified when added the S3 compatible object storage repository to the backup infrastructure.

• Provided by the backup server — select this option if you want to access the S3 compatible object storage repository through a gateway server. By default, Veeam Backup & Replication uses this option.

• Provided by IAM/STS object storage capabilities — select this option if you use the direct connection mode to access the S3 compatible object storage repository. In this case, Veeam Backup & Replication will create service tokens that Veeam Agent or a tenant will use to access the S3 compatible object storage repository.

To specify credentials, do the following:

1. In the Identity and access management (IAM) endpoint field, specify the endpoint of your S3 compatible object storage repository.

2. In the Security token service (STS) endpoint field, specify the security token.