---
title: "Add-VBREntraIDTenant"
description: "This cmdlet adds a tenant to the backup infrastructure. To add a tenant, you need an application already created in Entra ID. If you want to create an application automatically, add the tenant using the UI."
canonical: "https://helpcenter.veeam.com/docs/vbr/powershell/add-vbrentraidtenant.html"
breadcrumb: "Veeam PowerShell Reference > Veeam PowerShell Reference > Microsoft EntraID Support > Infrastructure Components > Add-VBREntraIDTenant"
dateModified: "2026-08-19"
---

# Add-VBREntraIDTenant

## Short Description
Adds a Microsoft Entra ID tenant to the backup infrastructure.

**Product Edition**: Standard, Enterprise, Enterprise Plus, Veeam Universal License

## Syntax

This cmdlet provides the following parameter sets:

<ul class="syntax-sets">
  <li>
    <p><code>SecretKey</code></p>

```
Add-VBREntraIDTenant [-Region <VBRAzureBlobRegionType>] [-Description <String>] -TenantId <String>
 -ApplicationId <String> -SecretKey <SecureString> -CacheRepository <CBackupRepository>
 [-ProtectedScope <VBREntraIDTenantProtectedScope[]>] [<CommonParameters>]
```
  </li>
  <li>
    <p><code>Certificate</code></p>

```
Add-VBREntraIDTenant [-Region <VBRAzureBlobRegionType>] [-Description <String>] -TenantId <String>
 -ApplicationId <String> -CertificatePath <String> [-Password <SecureString>]
 -CacheRepository <CBackupRepository> [-ProtectedScope <VBREntraIDTenantProtectedScope[]>] [<CommonParameters>]
```
  </li>
</ul>

## Detailed Description
This cmdlet adds a tenant to the backup infrastructure.

::: note

To add a tenant, you need an application already created in Entra ID. If you want to create an application automatically, add the tenant using the UI.

:::

## Parameters

<table style="width:100%;" class="Blue_Table">
      <tr style="vertical-align:top">
        <th style="width:20%;">
          <p>Parameter</p>
        </th>
        <th style="width:20%;">
          <p>Description</p>
        </th>
        <th style="width:20%;">
          <p>Type</p>
        </th>
        <th style="width:10%;">
          <p>Required</p>
        </th>
        <th style="width:10%;">
          <p>Position</p>
        </th>
        <th style="width:10%;">
          <p>Accept Pipeline Input</p>
        </th>
      </tr>
      <tr style="vertical-align:top">
        <td>
          <p class="Table_Text_Bold"><span class="Table_Text_Bold">ApplicationId</span></p>
        </td>
        <td>
          <p>Specifies the ID of an application. The cmdlet will use this application to access Entra ID resources.</p>
        </td>
        <td style="width:10%;">
          <p><code>String</code></p>
        </td>
        <td style="width:10%;">
          <p>True</p>
        </td>
        <td style="width:10%;">
          <p>Named</p>
        </td>
        <td style="width:10%;">
          <p>False</p>
        </td>
      </tr>
      <tr style="vertical-align:top">
        <td>
          <p class="Table_Text_Bold"><span class="Table_Text_Bold">CacheRepository</span></p>
        </td>
        <td>
          <p>Specifies a cache repository. The cmdlet will use this repository to store temporary cache files for log processing.</p><p>Accepts the <code>CBackupRepository</code> object. To get this object, run the <a href="get-vbrbackuprepository.md"><code>Get-VBRBackupRepository</code></a> cmdlet.</p>
        </td>
        <td style="width:10%;">
          <p><code>CBackupRepository</code></p>
        </td>
        <td style="width:10%;">
          <p>True</p>
        </td>
        <td style="width:10%;">
          <p>Named</p>
        </td>
        <td style="width:10%;">
          <p>False</p>
        </td>
      </tr>
      <tr style="vertical-align:top">
        <td>
          <p class="Table_Text_Bold"><span class="Table_Text_Bold">CertificatePath</span></p>
        </td>
        <td>
          <p>For the certificate-based authentication.</p><p>Specifies the path to the certificate. The cmdlet will use this certificate to authenticate to Entra ID.</p>
        </td>
        <td style="width:10%;">
          <p><code>String</code></p>
        </td>
        <td style="width:10%;">
          <p>True</p>
        </td>
        <td style="width:10%;">
          <p>Named</p>
        </td>
        <td style="width:10%;">
          <p>False</p>
        </td>
      </tr>
      <tr style="vertical-align:top">
        <td>
          <p class="Table_Text_Bold"><span class="Table_Text_Bold">Description</span></p>
        </td>
        <td>
          <p>Specifies the description for the tenant that you want to add.</p>
        </td>
        <td style="width:10%;">
          <p><code>String</code></p>
        </td>
        <td style="width:10%;">
          <p>False</p>
        </td>
        <td style="width:10%;">
          <p>Named</p>
        </td>
        <td style="width:10%;">
          <p>False</p>
        </td>
      </tr>
      <tr style="vertical-align:top">
        <td>
          <p class="Table_Text_Bold"><span class="Table_Text_Bold">Password</span></p>
        </td>
        <td>
          <p>For the certificate-based authentication.</p><p>Specifies the password that the cmdlet will use to authenticate to Entra ID.</p>
        </td>
        <td style="width:10%;">
          <p><code>SecureString</code></p>
        </td>
        <td style="width:10%;">
          <p>False</p>
        </td>
        <td style="width:10%;">
          <p>Named</p>
        </td>
        <td style="width:10%;">
          <p>False</p>
        </td>
      </tr>
      <tr style="vertical-align:top">
        <td>
          <p class="Table_Text_Bold"><span class="Table_Text_Bold">ProtectedScope</span></p>
        </td>
        <td>
          <p>Specifies the tenant protection scope.</p><p><strong>Note</strong>: If you do not specify this parameter, the following tenant resources will be protected by default:</p><ul><li>Users</li><li>Groups</li><li>Roles</li><li>Administrative units</li><li>Applications</li></ul><p>Accepts the <code>VBREntraIDTenantProtectedScope</code> object. To get this object, run the <a href="new-vbrentraidtenantprotectedscope.md"><code>New-VBREntraIDTenantProtectedScope</code></a> cmdlet.</p>
        </td>
        <td style="width:10%;">
          <p><a href="vbrentraidtenantprotectedscope.md"><code>VBREntraIDTenantProtectedScope[]</code></a></p>
        </td>
        <td style="width:10%;">
          <p>False</p>
        </td>
        <td style="width:10%;">
          <p>Named</p>
        </td>
        <td style="width:10%;">
          <p>False</p>
        </td>
      </tr>
      <tr style="vertical-align:top">
        <td>
          <p class="Table_Text_Bold"><span class="Table_Text_Bold">Region</span></p>
        </td>
        <td>
          <p>Specifies the region type where the tenant is located.</p>
        </td>
        <td style="width:10%;">
          <p><code>VBRAzureBlobRegionType</code></p>
        </td>
        <td style="width:10%;">
          <p>False</p>
        </td>
        <td style="width:10%;">
          <p>Named</p>
        </td>
        <td style="width:10%;">
          <p>False</p>
        </td>
      </tr>
      <tr style="vertical-align:top">
        <td>
          <p class="Table_Text_Bold"><span class="Table_Text_Bold">SecretKey</span></p>
        </td>
        <td>
          <p>For the password-based authentication.</p><p>Specifies an application secret. The cmdlet will use this secret to authenticate to Entra ID.</p>
        </td>
        <td style="width:10%;">
          <p><code>SecureString</code></p>
        </td>
        <td style="width:10%;">
          <p>True</p>
        </td>
        <td style="width:10%;">
          <p>Named</p>
        </td>
        <td style="width:10%;">
          <p>False</p>
        </td>
      </tr>
      <tr style="vertical-align:top">
        <td>
          <p class="Table_Text_Bold"><span class="Table_Text_Bold">TenantId</span></p>
        </td>
        <td>
          <p>Specifies the ID of the tenant which you want to add to the backup infrastructure. The cmdlet will search for the application within this tenant.</p>
        </td>
        <td style="width:10%;">
          <p><code>String</code></p>
        </td>
        <td style="width:10%;">
          <p>True</p>
        </td>
        <td style="width:10%;">
          <p>Named</p>
        </td>
        <td style="width:10%;">
          <p>False</p>
        </td>
      </tr>
    </table>

`<CommonParameters>`

This cmdlet supports Microsoft PowerShell common parameters. For more information on common parameters, see [ Microsoft Docs](https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_commonparameters?view=powershell-7).

## Output Object
The cmdlet returns the [`VBREntraIdTenant`](vbrentraidtenant.md) object that contains settings of the added tenant.

## Examples

::: example
### Example 1. Adding Tenant Using Password-Based Authentication

This example shows how to add an Entra ID tenant using the password-based authentication.

```
$tenantId = "xxxxx"
$appId = "xxxxx"
$appSecret = Read-Host -Prompt "Enter password" -AsSecureString
$repo = Get-VBRBackupRepository -Name "Default Backup Repository"
$scope = New-VBREntraIDTenantProtectedScope -ResourceType Users, Groups, AdminUnits, ConditionalAccessPolicies
$tenant = Add-VBREntraIdTenant -TenantId $tenantId -ApplicationId $appId -SecretKey $appSecret -CacheRepository $repo -ProtectedScope $scope
```

Perform the following steps:

1. Create the `$tenantId` and `$appId` variables whose values are the Entra ID tenant ID and the application ID.
2. Create the `$appSecret` variable. Use the `Read-Host` cmdlet to get the application secret and convert it to a secure string.
3. Run the [`Get-VBRBackupRepository`](get-vbrbackuprepository.md) cmdlet. Specify the `Name` parameter value. Save the result to the `$repo` variable.
4. Run the [`New-VBREntraIDTenantProtectedScope`](new-vbrentraidtenantprotectedscope.md) cmdlet. Specify the `ResourceType` parameter value. Save the result to the `$scope` variable.
5. Run the `Add-VBREntraIdTenant` cmdlet. Specify the following settings:

   - Set the `$tenantId` variable as the `TenantId` parameter value.
   - Set the `$appId` variable as the `ApplicationId` parameter value.
   - Set the `$appSecret` variable as the `SecretKey` parameter value.
   - Set the `$repo` variable as the `CacheRepository` parameter value.
   - Set the `$scope` variable as the `ProtectedScope` parameter value.
   - Save the result to the `$tenant` variable to be used with other cmdlets.

:::

::: example
### Example 2. Adding Tenant Using Certificate-Based Authentication

This example shows how to add an Entra ID tenant using the certificate-based authentication.

```
$tenantId = "xxxxx"
$appId = "xxxxx"
$psswd = Read-Host -Prompt "Enter password" -AsSecureString
$repo = Get-VBRBackupRepository -Name "Default Backup Repository"
$tenant = Add-VBREntraIdTenant -TenantId $tenantId -ApplicationId $appId -CertificatePath "C:\Users\Administrator\Locked\certificate-3518.pfx" -Password $psswd -CacheRepository $repo
```

Perform the following steps:

1. Create the `$tenantId` and `$appId` variables whose values are the Entra ID tenant ID and the application ID.
2. Create the `$psswd` variable. Use the `Read-Host` cmdlet to get the password and convert it to a secure string.
3. Run the [`Get-VBRBackupRepository`](get-vbrbackuprepository.md) cmdlet. Specify the `Name` parameter value. Save the result to the `$repo` variable.
4. Run the `Add-VBREntraIdTenant` cmdlet. Specify the following settings:

   - Set the `$tenantId` variable as the `TenantId` parameter value.
   - Set the `$appId` variable as the `ApplicationId` parameter value.
   - Specify the `CertificatePath` parameter value.
   - Set the `$psswd` variable as the `Password` parameter value.
   - Set the `$repo` variable as the `CacheRepository` parameter value.
   - Save the result to the `$tenant` variable to be used with other cmdlets.

:::

## Related Commands

- [`Get-VBRBackupRepository`](get-vbrbackuprepository.md)
- [`New-VBREntraIDTenantProtectedScope`](new-vbrentraidtenantprotectedscope.md)