Considerations and Limitations

When you plan to deploy and configure Veeam Backup for Microsoft Entra ID, keep in mind the following limitations and considerations.

Backup Infrastructure

It is not recommended that you delete or disable the default general-purpose backup proxy deployed during Veeam Backup & Replication installation. Otherwise, Veeam Backup for Microsoft Entra ID will not be able to perform any backup operations.
Veeam Backup for Microsoft Entra ID does not support creation of more than one Microsoft Entra ID backup repository on the backup server. For more information on Microsoft Entra ID backup repository, see Solution Architecture.
Veeam Backup for Microsoft Entra ID supports storing backed-up tenant data in Microsoft Entra ID backup repositories running PostgreSQL 14 or higher.
Veeam Backup for Microsoft Entra ID supports only PostgreSQL password authentication to connect to remote Microsoft Entra ID backup repositories. For more information, see Connecting to Remote Microsoft Entra ID Backup Repository.

Tenant Backup and Restore

Veeam Backup for Microsoft Entra ID does not support backup and restore of Microsoft Entra ID tenants registered in China. For more information, see Microsoft Docs.
Veeam Backup for Microsoft Entra ID does not support backup and restore of Azure Government tenants and tenants registered in the Azure Government geography. For more information, see Microsoft Docs.
Veeam Backup for Microsoft Entra ID does not support backup and restore of external tenants. For more information, see Microsoft Docs.
Veeam Backup for Microsoft Entra ID does not support backup and restore of Azure Active Directory B2C tenants. For more information, see Microsoft Docs.
Veeam Backup for Microsoft Entra ID does not support restoring more than 1000 tenant items per restore session.
Veeam Backup for Microsoft Entra ID does not support protecting more than one tenant by the same tenant backup job.
Veeam Backup for Microsoft Entra ID does not support protecting one tenant by multiple backup jobs.
Veeam Backup for Microsoft Entra ID does not support restoring Microsoft Entra built-in roles, distribution security groups and mail-enabled security groups.
By default, Veeam Backup for Microsoft Entra ID does not back up relationships between protected resources and management groups. If you want to add these relationships into the backup scope, you must perform additional configuration steps described in this Veeam KB article.
Veeam Backup for Microsoft Entra ID does not support restoring more than one type of tenant items at a time.
[Entire restore of permanently deleted and linked applications and service principles] You can restore a service principle that represents an application only together with this application and within one restore session. If you restore the application in a separate restore session, the restored application gets a new AppID. The service principal will not recognize this new ID, and the restore of the service principal will fail.
Restore of users synchronized with Microsoft Active Directory (hybrid identities) is possible using Veeam Backup for Microsoft Entra ID. For more information, see Appendix. Restoring Synchronized Users (Hybrid Identity).
Veeam Backup for Microsoft Entra ID does not support restore of Intune Device Configuration of type editionUpgradeConfiguration with application permissions. You can restore this intune policy using delegated permissions only. During restore of Intune Device Configuration of type editionUpgradeConfiguration, the properties License and ProductKey are restored to predefined placeholder values. After restore, these properties must be manually updated in the Intune Admin Center.

Log Backup and Restore

Veeam Backup for Microsoft Entra ID does not support storing backed-up sign-in and audit logs in multi-bucket repositories. For more information, see section Object Storage Repository.
You cannot back up sign-in logs with Microsoft Entra ID free license. With this license, you can back up only audit logs.
To create a log backup, you must have the backup of the tenant whose logs you want to protect. The latest restore point of this backup must be created within 30 days before the log backup.