Required Permissions

This section explains required permissions for service accounts and repository accounts.

Permissions for Azure Service Accounts

Veeam Backup for Microsoft Azure uses a service account to establish and maintain a connection to Microsoft Azure.

Creating Service Account Automatically

When you create a new service account by selecting the Create service account automatically option, make sure that the user account that you use to log in to the Azure portal has either the User Access Administrator or Owner role. You can also configure a custom role.

For more information about roles in Azure, see this Microsoft article.

Using Existing Service Account

When you use an existing service account by selecting the Specify existing service account option, make sure that your service account (also known as Azure AD Application) is configured according to the following:

• A service account must have the Microsoft.Authorization/*/Write permission set in the subscription in which Veeam Backup for Microsoft Azure is deployed.

For more information about this permission, see this Microsoft article.

• If you have disabled the Users can register applications option on the Azure portal, make sure that the service account has the Application Developer role or higher.

For more information about this role, see this Microsoft article.

Permissions for Repository Accounts

Veeam Backup for Microsoft Azure uses a repository account to establish and maintain a connection to Microsoft Azure storage accounts.

Creating Repository Account Automatically

When you create a new repository account by selecting the Create repository account automatically option, make sure that the user account that you use to log in to the Azure portal has either the User Access Administrator or Owner role. You can also configure a custom role.

For more information about roles in Azure, see this Microsoft article.

Using Existing Repository Account

When you use an existing repository account by selecting the Specify existing repository account option, make sure that your repository account (also known as Azure AD Application) is granted the Storage Account Contributor role.

For more information about this role, see this Microsoft article.