Connection to Veeam Backup & Replication Servers

The account used to connect Veeam Backup & Replication servers must:

Have the Veeam Backup Administrator role assigned.

This role must be assigned to the account on the machine that runs Veeam Backup & Replication.

Be a member of the Performance Monitor Users and Event Log Readers security groups.

These permissions must be granted to the account on machines that run:

Veeam Backup & Replication
Backup proxy, backup repository (Windows-based), WAN Accelerator, tape server and cloud gateway components (required to collect performance data from these servers)

Have permissions to remotely access WMI.

This includes remote access, activation and launching the DCOM application of WMI, and remote access to the root WMI namespace and sub-namespaces. For details on granting these permissions, see Configuring Permissions to Remotely Access WMI.

This permission must be granted to the account on machines that run:

Veeam Backup & Replication
Backup proxy, backup repository (Windows-based), WAN Accelerator, tape server and cloud gateway components (required to collect performance data from these servers)

Note:

You must use the account with local Administrator permissions in the following cases:

When you install Veeam Analytics service on a Veeam Backup & Replication server you must disable MFA for the account under which Veeam Analytics service connects to Veeam Backup & Replication. For details, see section Disabling MFA for Service Accounts of the Veeam Backup & Replication User Guide.
If machines that run Veeam ONE server and Veeam Backup & Replication server belong to different domains or workgroups.
If you are using the default local administrator account, UAC settings do not affect elevation behavior. If you are using a custom local administrator account, you must either configure the LocalAccountTokenFilterPolicy registry key or disable UAC to ensure proper elevation. UAC behavior is affected if a custom user is added to the local Administrators group, regardless of whether Veeam Backup & Replication and Veeam ONE are deployed on the same domain, different domains, or workgroups.
[For Linux servers] When using a user account other than the default veeamadmin, it is recommended to assign the Service Account role in Veeam Host Management and also Backup Administrator permissions in Veeam Backup & Replication. For details on roles and permissions, see Configuring Users and Configuring Roles in the Veeam Backup & Replication User Guide.

For newly created local users in Veeam Host Management with a role other than Service Account, the user must first log in to the Veeam Software Appliance Web Client to change the password. Otherwise, an error occurs when connecting to the backup server to deploy Veeam Analytics service.

Veeam Analytics Service Permissions

The account used to install Veeam Analytics service on the Veeam Backup & Replication server must:

[Microsoft Windows accounts] have an access to the administrative share on the machine where Veeam Analytics service is deployed.
[Linux accounts] have the Veeam Backup Administrator role assigned.

Veeam Backup Enterprise Manager Administrator Permissions

From Veeam Backup Enterprise Manager versions 12.3 or later, Veeam Backup Enterprise Manager monitoring users must be members of a built-in Administrators group with the following privileges configured:

Member of Performance Monitor Users and Event Log Readers security groups.
Have permission to remotely access WMI.

For details on granting these permissions, see Configuring Permissions to Remotely Access WMI.

For permissions for Veeam Backup & Replication servers under Veeam Backup Enterprise Manager, see Connection to Veeam Backup & Replication Servers.