Step 3. Configure Backup Source Settings

At the Sources step of the wizard, select a service account whose permissions will be used to perform Azure VM backup, choose regions where Azure VMs that you plan to back up reside, and select resources to back up.

Step 3a. Select Service Account

In the Account section of the Sources step of the wizard, specify a service account whose permissions will be used to access Azure services and resources, and to create cloud-native snapshots of Azure VMs:

Click Choose account.
In the Choose service account window, select the necessary service account from the available accounts list. The specified service account must belong to the Microsoft Entra tenant that contains the Azure VMs that you want to protect, and must be assigned permissions listed in section Azure VM Permissions.

For a service account to be displayed in the list of available accounts, it must be added to Veeam Backup for Microsoft Azure and assigned the Azure VMs Snapshot and Backup operational role as described in section Adding Service Accounts. If you have not added the necessary service account to Veeam Backup for Microsoft Azure beforehand, you can do it without closing the Add VM Policy wizard. To do that, click Add and complete the Add Account wizard.

To save changes made to the backup policy settings, click Apply.

Step 3b. Select Regions

In the Region section of the Sources step of the wizard, select regions where Azure resources that you want to back up reside:

Click Choose regions.
In the Choose regions window, select the necessary regions from the Available regions list, and then click Add.
To save changes made to the backup policy settings, click Apply.

Step 3c. Select Resources

In the Resources section of the Sources step of the wizard, specify the backup scope — select resources that Veeam Backup for Microsoft Azure will back up:

Click Select resources to protect.
In the Choose resource protection options window, choose whether you want to back up all Azure resources from the regions selected at step 3b, or only specific resources.

If you select the All resources option, Veeam Backup for Microsoft Azure will regularly check for new Azure VMs launched in the selected regions and automatically update the backup policy settings to include these VMs in the backup scope.

If you select the Protect the following resources option, you must also specify the resources explicitly:

Use the Resource type drop-down list to select either of the following options:

Subscription — to back up Azure VMs managed by specific subscriptions.

Resource group — to back up Azure VMs that belong to specific resource groups.

Tag — to back up Azure VMs that have specific tags assigned.

Virtual machine — to back up only specific Azure VMs.

Use the search field to the right of the Resource type list to find the necessary resource, and then click Protect to add the resource to the backup scope.

For a resource to be displayed in the list of available resources, it must reside in an Azure region that has ever been specified in any backup policy. Otherwise, the only option to discover available resources is to click Browse to select specific source from the global list and wait for Veeam Backup for Microsoft Azure to populate the resource list.

Note that your web browser zoom must not exceed 135% for the list of protected resources to be displayed correctly.

Tip

You can simultaneously add multiple resources to the backup scope. To do that, click Browse to select specific source from the global list, select check boxes next to the necessary items in the list of available resources, and then click Protect.

If the list does not show the resources that you want to back up, click Rescan to launch the data collection process — as soon as the process is over, Veeam Backup for Microsoft Azure will update the resource list. If you still cannot find the necessary resources in the list, make sure that the Microsoft.ManagedServices provider is registered in the subscription to which the resources belong, return to step 3a and click Rescan in the Choose service account window. To learn how to register a resource provider, see Microsoft Docs.

If you add a tag to the backup scope, Veeam Backup for Microsoft Azure will regularly check for new Azure VMs assigned the added tag and automatically update the backup policy settings to include these VMs in the scope. However, this applies only to Azure VMs from the regions selected at step 3b. If you select a tag assigned to Azure VMs from other regions, these VMs will not be protected by the backup policy. To work around the issue, either go back to step 3b and add the missing regions, or create a new backup policy.

To save changes made to the backup policy settings, click Apply.

Tip

As an alternative to selecting the Protect the following resources option and specifying the resources explicitly, you can select the All resources option and exclude a number of resources from the backup scope. To do that, click Select resources to exclude and specify Azure VMs or tags that you want to exclude from the backup scope — the procedure is the same as described for including resources in the backup scope.

Consider that if a resource appears both in the list of included and excluded resources, Veeam Backup for Microsoft Azure will still not process the resource because the list of excluded resources has a higher priority.

When you add subscriptions, resource groups and tags to the backup scope, Veeam Backup for Microsoft Azure links all these resources using the OR operator. To instruct Veeam Backup for Microsoft Azure to use the AND operator, follow the instructions provided in section Configuring Conditions.