---
title: "Step 2. Check Requirements to User Account"
description: "You can provide access to Veeam ONE for single users and user groups. The following table describes types of accounts for which you can configure restricted permissions."
canonical: "https://helpcenter.veeam.com/docs/one/userguide/check_account_requirements.html"
breadcrumb: "User Guide > Multi-Tenant Monitoring and Reporting > Configuring Access for Users with Restricted Permissions > Step 2. Check Requirements to User Account"
dateModified: "2026-10-23"
---

# Step 2. Check Requirements to User Account

You can provide access to Veeam ONE for single users and user groups.

The following table describes types of accounts for which you can configure restricted permissions.

<table style="width:100%;" class="Blue_Table">
  <tr style="vertical-align:top">
    <th style="width:25%;">
      <p>Platform</p>
    </th>
    <th style="width:25%;">
      <p>Account Type</p>
    </th>
    <th>
      <p>Description and Notes</p>
    </th>
  </tr>
  <tr style="vertical-align:middle">
    <td rowspan="3">
      <p><span style="font-weight:bold;">vCenter Server</span></p>
    </td>
    <td>
      <p>Domain users and groups</p>
    </td>
    <td>
      <p>Members of the Active Directory domain.</p>
      <p>vCenter Server must be configured to use Active Directory for authentication. For details on user authentication in VMware vSphere, see <a href="https://docs.vmware.com/en/VMware-vSphere/6.7/com.vmware.psc.doc/GUID-4D24C6E8-63F5-4E35-862E-B59A03703254.html" target="_blank">Active Directory Identity Source Settings</a>.</p>
      <p>To log in to Veeam ONE, you must provide user name in the following format: <span class="T_Filenames">domain\username</span>.</p>
    </td>
  </tr>
  <tr style="vertical-align:middle">
    <td>
      <p>Local users and groups</p>
    </td>
    <td>
      <p>Local users and groups on the machine where vCenter Server is installed.</p>
      <p>To log in to Veeam ONE, you must provide user name in the following format: <span class="T_Filenames">hostname\username</span>.</p>
    </td>
  </tr>
  <tr style="vertical-align:middle">
    <td>
      <p>Single Sign-On users and groups</p>
    </td>
    <td>
      <p>Single Sign-On users and groups on vCenter Server. For details, see <a href="https://docs.vmware.com/en/VMware-vSphere/6.7/com.vmware.psc.doc/GUID-B98DF9C2-FE7D-483F-9521-C17C138B59D8.html" target="_blank">vSphere Authentication with vCenter Single Sign-On</a>.</p>
      <p><span style="font-weight:bold;">Note</span>: Single Sign-On must be installed on the machine where vCenter Server runs, with the default installation path and port settings. Otherwise, Veeam ONE will not be able to detect its database with user groups and users.</p>
      <p>To log in to Veeam ONE, you must provide user name in the following format: <span class="T_Filenames">ssodomain\username</span>.</p>
    </td>
  </tr>
  <tr style="vertical-align:middle">
    <td>
      <p><span style="font-weight:bold;">ESXi host</span></p>
    </td>
    <td>
      <p>Domain users and groups</p>
    </td>
    <td>
      <p>Members of the Active Directory domain.</p>
      <p>Standalone hosts must be configured to use Active Directory for authentication. For details, see <a href="https://docs.vmware.com/en/VMware-vSphere/6.7/com.vmware.vsphere.security.doc/GUID-4FD32125-4955-439D-B39F-C654CCB207DC.html?hWord=N4IghgNiBcIKoGcCWA7A5gAgIIGMAuSAbgKYYAiSATsfgPaUCeGetGAsmCmGqQKIDKADSQZExSghABfIA" target="_blank">Using Active Directory to Manage ESXi Users</a>.</p>
      <p>To log in to Veeam ONE, you must provide user name in the following format: <span class="T_Filenames">domain\username</span>.</p>
    </td>
  </tr>
  <tr style="vertical-align:middle">
    <td rowspan="2">
      <p><span style="font-weight:bold;">VMware Cloud Director</span></p>
    </td>
    <td>
      <p>Domain users and groups</p>
    </td>
    <td>
      <p>Members of the Active Directory domain.</p>
      <p>Users must be able to authenticate to an LDAP server. For details, see <a href="https://docs.vmware.com/en/VMware-Cloud-Director/10.3/VMware-Cloud-Director-Service-Provider-Admin-Portal-Guide/GUID-4ECA36E9-E051-489C-A039-67621DE2C688.html#GUID-4ECA36E9-E051-489C-A039-67621DE2C688" target="_blank">VMware Cloud Director documentation</a>.</p>
      <p>To log in to Veeam ONE, you must provide user name in the following format: <span class="T_Filenames">domain\username</span>.</p>
    </td>
  </tr>
  <tr style="vertical-align:middle">
    <td>
      <p>Local users and groups</p>
    </td>
    <td>
      <p>Local users and groups in VMware Cloud Director.</p>
      <p>To log in to Veeam ONE, you must provide user name in the following format:</p>
      <ul>
        <li class="Table_List">For organization user: <span class="T_Filenames">organization\username</span></li>
        <li class="Table_List">For VMware Cloud Director administrator: <span class="T_Filenames">system\username</span></li>
      </ul>
    </td>
  </tr>
</table>

::: note

For each local or Single Sign-On user that authenticates to Veeam ONE, Veeam ONE creates a temporary Windows account on the machine that runs the Veeam ONE Server component. This temporary account is deleted after 30 days of inactivity.

:::

## Authorizing with Veeam ONE {#authorizeONE}

To authorize with Veeam ONE components (Veeam ONE Client and Veeam ONE Web Client), a user must have the *Allow log on locally* privilege assigned.

By default, this privilege is assigned to users included in the local Administrators group. For users not included in the local Administrators group, you must assign this privilege manually.

::: note

If you use the advanced deployment scenario, you must assign the *Allow log on locally* privilege on the machines that host the Veeam ONE Server and Veeam ONE Web UI components.

:::