Help Center
Choose product document...
Veeam Backup & Replication 9.5
User Guide for VMware vSphere

Required Permissions

The accounts used for installing and using Veeam Backup & Replication must have the following permissions:


Required Permission

Setup Account

The account used for product installation must have the Local Administrator permissions on the target machine.

Veeam Backup & Replication console permissions

The account used to start the Veeam Backup & Replication console must have the Local Administrator permissions on the machine where the console is installed.

To perform file-level restore for Microsoft Windows VMs, the account must have the following permissions and privileges:

  • Local Administrator permissions to start the Veeam Backup & Replication console
  • SeBackupPrivilege and SeRestorePrivilege to connect to the Veeam backup server and start the restore process

In most environments, SeBackupPrivilege and SeRestorePrivilege are assigned to user accounts in the Local Administrators group. For more information, see

Veeam Backup Service Account

The account used to run the Veeam Backup Service must be a Local System account or must have the Local Administrator permissions on the backup server.

Target/Source Host Permissions

Root permissions on the source ESX(i) host.

Root or equivalent permissions on the Linux backup repository.

Write permission on the target folder and share.

If VMware vCenter Server is added to the backup infrastructure, an account that has administrator permissions is required.
In case you don't want to grant administrator permissions to the account, you can configure granular vCenter Server permissions for certain Veeam Backup & Replication operations in the VMware vSphere environment. For more information, see the Required Permissions document.

Microsoft SQL Server

You require different sets of Microsoft SQL permissions in the following cases:

  • Installation (remote or local): current account needs CREATE ANY DATABASE permission on the SQL server level. After database creation this account automatically gets a db_owner role and can perform all operations with the database. If the current account does not have this permission, a Database Administrator may create an empty database in advance and grant the db_owner role to the account that will be used for installing Veeam Backup & Replication.
  • Upgrade: current account should have sufficient permissions for that database. To grant these permissions through role assignment, it is recommended that you use the account with db_owner role.
  • Operation: the account used to run Veeam Backup Service requires db_datareader and db_datawriter roles as well as permissions to execute stored procedures for the configuration database on the Microsoft SQL Server. Alternatively, you can assign db_owner role for this database to the service account.

For permissions for Veeam Backup Enterprise Manager, see Veeam Backup Enterprise Manager.

Veeam Backup Enterprise Manager

Local Administrator permissions on the Veeam Backup Enterprise Manager server to install Veeam Backup Enterprise Manager.

To be able to work with Veeam Backup Enterprise Manager, users must be assigned the Portal Administrator, Restore Operator or Portal User role.

Veeam Explorer for Microsoft Active Directory

See the Required Permissions section for Veeam Explorer for Microsoft Active Directory.

Veeam Explorer for Microsoft Exchange

Full access to Microsoft Exchange database and its log files for item recovery. The account that you plan to use for recovery must have both read and write permissions to all files in the folder with the database.

Access rights can be provided through impersonation, as described in the Configuring Exchange Impersonation article.

Veeam Explorer for Oracle

See the Required Permissions section for Veeam Explorer for Oracle.

Veeam Explorer for Microsoft SharePoint

The account used for work with Veeam Explorer for SharePoint requires membership in the sysadmin fixed server role on the staging Microsoft SQL Server.

The account used for connection with target SharePoint server where document item(s)/list will be restored needs the following:

  • If permissions of the restored item are inherited from the parent item (list) — Full Control for that list is required.
  • If permissions are not inherited, and restored item will replace an existing item — Contribute for the item and Full Control for its parent list are required.

Transaction logs backup (Microsoft SQL Server)

The user account that you specify for guest processing of the Microsoft SQL Server VM in the backup job must have the sysadmin fixed role assigned on this Microsoft SQL Server. This is the recommended setting; however, if you need to provide minimal permissions to the account performing the backup operation, you can assign the following roles and permissions:

  • SQL Server instance-level roles: dbcreator and public
  • Database-level roles: db_backupoperatordb_denydatareader, public; for system databases (master, model, msdb) — db_backupoperatordb_datareaderpublic
  • Securables: view any definition, view server state

Veeam Large Logo

User Guide for VMware vSphere

User Guide for Microsoft Hyper-V

Enterprise Manager User Guide

Veeam Cloud Connect Guide

Veeam Agent Management Guide

Veeam Backup Explorers User Guide

PowerShell Reference

RESTful API Reference

Veeam Backup FREE Edition User Guide

Veeam Backup for Microsoft Office 365 Documentation

Veeam ONE Documentation

Veeam Agent for Windows Documentation

Veeam Agent for Linux Documentation

Veeam Management Pack Documentation