Configuring Users

To control which operations users can perform in Veeam Backup & Replication, add users and user groups and assign predefined or custom roles to them. For more information on predefined roles, see Configuring Roles.

You can assign multiple roles to the same user. For example, if you want a user to start jobs and perform restore operations, you can assign both the Backup Operator and Restore Operator roles to this user.

You can configure users and groups in one of the following ways:

• Configuring users using console
• Configuring users using web UI

Requirements and Limitations

When you configure users for Veeam Backup & Replication on Linux, consider the following requirements and limitations:

• During installation, the veeamadmin account is automatically added to the Veeam Backup & Replication console with the Backup Administrator role.

• If multi-factor authentication (MFA) is enabled, all users, including Host Administrator accounts, must pass additional verification. Also, if you do not add a local user with Host Administrator permissions or a domain member of the Administrators group to the Users & Roles settings, this user will not have access to the Veeam Backup & Replication console.

When you configure users for Veeam Backup & Replication on Windows, consider the following requirements and limitations:

• For security reasons, it is recommended that you run Veeam services under the LocalSystem account. If a Veeam service runs under a user account other than LocalSystem, this user will have full access to the Veeam Backup & Replication console even if they are not specified in the Users & Roles settings.
• The user account under which the Veeam Backup Service runs must have the Backup Administrator role. If you change the account under which the Veeam Backup Service runs, make sure that you assign this role to the necessary account. It is recommended that you assign the role to the user account explicitly rather than to the group to which the user belongs.
• The Backup Administrator role is assigned to all members of the Administrators group on the machine where Veeam Backup & Replication is installed.
• To change the password for the service account, log in to the machine under this account, press [Ctrl+Alt+Del] and click Change a password. Do not reset the password through administrative tools, scripts, or the Active Directory Users and Computers (ADUC) console.

• If MFA is disabled, consider the following:

• Built-in administrator accounts (Domain\Administrator and Machine\Administrator) will have full access to the Veeam Backup & Replication console.
• If you remove the built-in Windows Administrators group from the Users & Roles settings, local and domain members of this group will immediately lose access to Veeam Backup & Replication.

To protect administrator accounts from being compromised, it is strongly recommended that you enable MFA. In that case, even users with administrator privileges must pass the additional verification. For more information on MFA, see Multi-Factor Authentication.

• If MFA is enabled, consider the following:

• All users, including built-in administrator accounts (Domain\Administrator and Machine\Administrator), must pass the additional verification.
• If you do not add a local or domain member of the Administrators group in the Users & Roles settings, this user will not have access to the Veeam Backup & Replication console.
• If you add a local or domain member of the Administrators group in the Users & Roles settings, this user will have full access to the Veeam Backup & Replication console regardless of the assigned role.