Configuring Roles

To perform Veeam Backup & Replication operations, you can either assign the default roles to users or create custom roles depending on your needs.

Default Roles

The default roles are the following:

Default Roles
Role	Operations
Backup Administrator	Can perform all administrative activities in the Veeam Backup & Replication console. Backup Administrator has full access to all files on servers and hosts added to the backup infrastructure.
Security Administrator	Can perform the following operations: Add, edit and delete all types of credential records supported by Veeam Backup & Replication. For details, see Managing Credentials. Manage Security & Compliance Analyzer: run security checks, configure scan scheduling, exclude parameters from the checklist. For details, see Security & Compliance Analyzer. Approve four-eyes authorization requests. For details, see Four-Eyes Authorization.
Incident API Operator	Can perform Veeam Backup & Replication REST API requests to manage malware detection events. For details, see the Malware Detection section in the Veeam Backup & Replication REST API Reference. Users with the Incident API Operator role do not have access to the Veeam Backup & Replication console. Since they interact only with the Veeam Backup & Replication REST API, make sure that multi-factor authentication is disabled for the user you add as Incident API Operator. For details, see Disabling MFA for Service Accounts.
Restore Operator	Can perform the following operations: Restore data from existing backups and replicas. Overwrite existing VM, disk and file instances during VM, disk and file-level restore operations. Migrate VMs recovered with Instant Recovery to the production environment. Restore Operator can restore disks and files with specially crafted malicious content from any backup. To reduce the risk of privilege escalation attacks and full system takeover, assign this role with caution.
Backup Operator	Can start and stop existing jobs, export backups, copy backups and create VeeamZip backups.
Backup Viewer	Has read-only access to the Veeam Backup & Replication console. Can view existing jobs and job session details.
Tape Operator	Can perform the following tape operations: Rescan tape libraries and tape servers. Run tape backup jobs, tape catalog jobs, tape inventory jobs, tape verification jobs. Eject tapes. Import and export tapes. Mark tapes as free. Move tapes to a media pool. Erase tapes. Set a tape password. Copy tapes.

You can assign several roles to the same user. For example, if you want a user to start jobs and perform restore operations, you can assign both the Backup Operator and Restore Operator roles to this user.

Custom Roles

You can create custom roles in Veeam Backup & Replication to assign tailored permissions and granular access scopes to users or groups. Custom roles help you enforce the principle of least privilege and align user access with your organization’s operational policies.

You can configure custom roles in one of the following ways:

For details on custom role limitations, see Considerations and Limitations.