Before You Begin
Before you add a Microsoft Azure compute account to Veeam Backup & Replication, check the following prerequisites:
- At the Subscription step of the Microsoft Azure Compute Account wizard, you specify how Veeam Backup & Replication will access Microsoft Azure. If you plan to use an Azure Active Directory (AD) application, mind the following:
- Make sure that you already have a user account in Microsoft Azure AD. This user account must have privileges to register applications. This can be the Global Administrator privileges assigned to the user or the Users can register applications option enabled for the user in Azure portal. For details, see Microsoft Azure Docs.
- You must install Microsoft Azure PowerShell version 6.13.2 on the machine running the Veeam Backup & Replication console version 11a (build 22.214.171.1241) or later. For the machine running the Veeam Backup & Replication console version prior 11a (build 126.96.36.1991), install Microsoft Azure PowerShell version 5.1.1. If the installed Microsoft Azure PowerShell version differs, you will not be able to add a Microsoft Azure compute account.
If you do not have Microsoft Azure PowerShell on the machine, Veeam Backup & Replication will prompt you to install it at the Subscription step of the Microsoft Azure Compute Account wizard.
- At the Subscription step of the Microsoft Azure Compute Account wizard, you specify how Veeam Backup & Replication will access Microsoft Azure. If you plan to use an existing Azure AD user account, mind the following:
- The Azure account must have the Contributor role privileges for the selected subscription.
[Restore to Microsoft Azure] If the Contributor role cannot be used, you can create a custom role with minimal permissions. To learn how to create a custom role, see Creating Custom Role for Azure Account.
- If you have more than one Azure Active Directory tenant associated with your account, you will need to specify which tenant to use. For information on how to do it, see this Veeam KB article.
- Only subscriptions that belong to the selected tenant will be added.
- In this scenario, you cannot add an account with enabled Multi-Factor Authentication (MFA). You must disable MFA for the required account. App passwords are not supported.
- [For Microsoft Server OS] The Protected Mode must be switched off in the Internet Explorer settings. Otherwise, you will not be able to log on to Microsoft Azure when passing through the Microsoft Azure Compute Account wizard.
If you do not want to switch off the Protected Mode for security reasons, you can add the following sites to the list of trusted hosts in Internet Options > Secure settings in Internet Explorer or in Control Panel > Network and Internet:
You may need to additionally disable the Internet Explorer Enhanced Security Configuration in Server Manager.
- On the backup server, you must set the correct time according to the timezone where the backup server is located. Otherwise, you may not be able to add a Microsoft Azure user account to Veeam Backup & Replication.
- When the Internet access is possible only through HTTP/HTTPS proxy, you must configure the proxy settings for the Local System account or account under which the Veeam Backup Service is running. For more information, see this Microsoft article.