Access to Tenant Backups

The SP can restore data from tenant backups stored in the cloud repository. The tenant controls the restore scope, which is the group of backups the SP can access for restore. Starting from Veeam Backup & Replication version 13.1, the tenant can grant the SP access to both encrypted and unencrypted backups. As a result, the SP can perform recovery operations on behalf of the tenant directly in the SP infrastructure.

The tenant selects the restore scope when connecting to the SP or later when editing the SP connection. The following options are available:

None. The SP cannot restore data from tenant backups in the cloud repository.
Unencrypted backups only. The SP can only restore data from unencrypted tenant backups.
All. The SP can restore data from both unencrypted and encrypted tenant backups.

To enable data restore from encrypted backups, Veeam Backup & Replication on the tenant side releases the encryption password to the SP, so that the SP can decrypt the backup for the restore operation. For details, see How Access to Tenant Backups Works.

For details on how to set up access to tenant backups, see Specify Backup Storage Settings.

When the tenant allows restore from encrypted backups, Veeam Backup & Replication stores information about the eligible backups in the SP configuration database in decrypted form. This allows the SP to work with these backups as with unencrypted backups and restore data from them. The backup files in the cloud repository remain encrypted. For backups outside the granted scope, or of unsupported types, Veeam Backup & Replication keeps this information encrypted. The SP cannot restore data from these backups.

How Access to Tenant Backups Works

After the tenant grants restore access to the SP, Veeam Backup & Replication on the tenant side performs the following steps:

Veeam Backup & Replication synchronizes information about all backups with the SP backup server. Synchronization runs when the feature is first enabled and every 15 minutes after that.
Veeam Backup & Replication checks what kind of restore access is granted to the SP.
Veeam Backup & Replication checks whether the backup is encrypted.
If the backup is encrypted, the tenant has allowed data restore from All backups, and the backup type is supported, Veeam Backup & Replication starts decryption at the end of the synchronization process. It releases the encryption password to the SP backup server, which uses it in the memory to decrypt information about the backup and store this information in the SP configuration database. The backup files in the cloud repository remain encrypted. Otherwise, this information remains encrypted and the backup is skipped during the SP restore.

Veeam Backup & Replication also starts the decryption when a tenant backup job starts if a supported encrypted backup on the SP side has not been decrypted yet.

As a result of these operations, the SP has up-to-date information about which tenant backups they can restore, and information about all eligible encrypted backups is stored in the SP configuration database in decrypted form. This allows the SP to restore these backups without requesting the encryption password from the tenant. The password is used only in the memory during decryption and is never saved to the SP database.

Veeam Backup & Replication keeps the backup files in the cloud repository encrypted. If the repository is lost or compromised, backup data cannot be accessed without the encryption password.

Considerations and Limitations

For restore access to tenant backups, consider the following:

To use this feature, both the SP and tenant must run Veeam Backup & Replication version 13.1 or later.
The feature is not supported for backup formats unsupported in Veeam Backup & Replication version 13.0 (or earlier), such as reverse incremental backups or per-VM backups in the legacy (split VM) format.
The restore access settings apply to all backups of the tenant stored in the SP cloud repository.
If the tenant changes the restore scope in the Veeam Backup & Replication console, the new settings apply immediately. If the tenant change the restore scope using PowerShell, the settings take effect during the next synchronization cycle, which runs every 15 minutes.
The feature is not supported if the SP uses tenant backup to tape functionality for the tenant.

If the SP has added the tenant to a tenant backup to tape job, the tenant cannot set the restore scope to All. The SP can only restore data from unencrypted tenant backups.

If the tenant has set the restore scope to All, the SP cannot add the tenant to a tenant backup to tape job.

The feature is not supported for backups created by Veeam Agent for Linux, Veeam Agent for Mac, Veeam Agent for Oracle Solaris and Veeam Agent for IBM AIX in any operation mode. Backups of these platforms created by a backup copy job are supported.
For backups created by Veeam Agent for Microsoft Windows, apply the following limitations:

The feature is not supported for Veeam Agent for Microsoft Windows operating in the standalone mode.
The feature is not supported for Veeam Agent for Microsoft Windows version 13.0 or earlier. Only imported or orphaned backups created by these versions are decrypted.
For Veeam Agent for Microsoft Windows operating in the managed by agent mode, the tenant must apply the backup policy after setting the restore scope to All. Until the policy is applied, Veeam Backup & Replication does not decrypt these backups on the SP side.

For backups encrypted with a KMS key, only backups created after the upgrade to Veeam Backup & Replication version 13.1 are supported. Veeam Backup & Replication processes them in the same way as backups encrypted with a password. Backups encrypted with a KMS key before the upgrade are skipped, because the tenant has no password to release to the SP.
The feature is not supported for backups decrypted with Enterprise Manager keys. To make these backups available to the SP, the tenant must map the backup to a backup job, assign a password, and run the job to re-encrypt the backup. After that, the backup works like a regular encrypted backup.

If a backup was decrypted on the SP side and then the backup is re-imported into the SP Veeam Backup & Replication configuration database, the backup will be encrypted again. Veeam Backup & Replication decrypts it again during the next synchronization cycle. To restore it sooner, the tenant can start the synchronization manually.
If a tenant backup was ever offloaded to the capacity tier or archive tier of a scale-out backup repository, Veeam Backup & Replication skips its decryption on the SP side. This applies even if the backup was later removed from the configuration and re-imported, or if the capacity tier or archive tier was removed from the scale-out backup repository. Once a backup has been offloaded, it is never decrypted.
Backups that are created after the feature is enabled and are decrypted on the SP side are not offloaded to the capacity tier or archive tier.