Configuring SAML Authentication for Microsoft Entra ID

For Veeam Backup & Replication to be able to use Microsoft Entra ID as an identity provider, you must perform the steps described in this section.

Step 1. Obtain Service Provider Settings

To obtain the service provider authentication settings, do the following:

1. From the main menu, select Users & Roles.
2. In the User & Roles window, select the Identity Provider tab.
3. Select the Enable SAML authentication check box.
4. In the Service Provider (SP) information section, do the following:

1. Select a certificate to use. By default, the current backup server certificate is used. To use a different certificate, click Install and select an existing certificate from the certificate store or import a certificate from a file. For more information, see Backup Server Certificate.
2. Click Download to get the service provider settings for Microsoft Entra ID. Veeam Backup & Replication exports the XML metadata file together with a separate file that contains the public part of the SP certificate. Alternatively, you can copy the service provider settings manually.

Step 2. Set up Single Sign-On with SAML for Microsoft Entra ID Application

To set up single sign-on (SSO) with SAML in your Microsoft Entra ID, do the following:

1. Log in to the Microsoft Entra ID portal.
2. Navigate to Enterprise applications and click New application > Create your own application.
3. In the Create your own application window, specify a name for your Microsoft Entra ID application and select the Integrate any other application you don't find in the gallery (Non-gallery) option.
4. In the newly created application, navigate to Single sign-on and click SAML.

Step 3. Forward Service Provider Settings to Microsoft Entra ID

To forward the service provider authentication settings to your Microsoft Entra ID, do the following:

1. In the Single sign-on window of your Microsoft Entra ID application, click Upload metadata file.
2. In the Upload metadata file window, click the folder icon to locate the metadata file with the service provider settings you downloaded.
3. Click Add.
4. In the Basic SAML Configuration window, click Save.

Step 4. Create Claim for Microsoft Entra ID Application

To authenticate an SSO user, Microsoft Entra ID sends a SAML authentication response to Veeam Backup & Replication. The SAML response contains an attribute that will be used by Veeam Backup & Replication to identify the user. To send the attributes required for user or group-based authentication, you must create the appropriate claim in Microsoft Entra ID.

To be able to authenticate SSO users in Veeam Backup & Replication, do the following:

1. In the Single sign-on window of your Microsoft Entra ID application, locate the Attributes & Claims section and click Edit.
2. Click Unique User Identifier (Name ID).
3. In the Manage claim window, set the Name Identifier Format to Persistent.

To be able to use group-based SSO authentication in Veeam Backup & Replication, do the following:

1. In the Single sign-on window of your Microsoft Entra ID application, locate the Attributes & Claims section and click Edit.

2. Click Add a group claim.
3. In the Group Claims window, select Groups assigned to the application.
4. In the Source attribute drop-down menu, select Cloud-only group display names.
5. In Advanced options:

1. Select the Customize the name of the group claim check box.
2. Specify Group in the Name field.
3. Specify http://schemas.xmlsoap.org/claims in the Namespace field.

6. Click Save.

Step 5. Obtain Microsoft Entra ID Metadata

To obtain the Microsoft Entra ID identity provider settings, do the following:

1. In the Single sign-on window of your Microsoft Entra ID application, locate the Federation Metadata XML field in the SAML Certificates section.
2. Click Download.

Step 6. Import Microsoft Entra ID Metadata

To import the obtained Microsoft Entra ID identity provider settings to Veeam Backup & Replication, do the following:

1. From the main menu, select Users & Roles.
2. In the User & Roles window, select the Identity Provider tab.
3. In the Identity provider configuration section:

1. In the Identity Provider information section, click Browse to locate the federation metadata file with the identity provider settings.
2. Click Open.

Step 7. Assign SSO Users

To assign users that will be able to access Veeam Backup & Replication using SSO, do the following:

1. In the Single sign-on window of your Microsoft Entra ID application, navigate to Users and groups.
2. Click Add user/group.
3. In the Add assignment window, click None selected and select users in the Users list.
4. Click Assign.

Step 8. Add External User or Group

You can add external users or groups and assign roles to them in the Veeam Backup & Replication console or web UI.

Adding External User or Group Using Console

To add an external user or group in the Veeam Backup & Replication console, do the following:

1. From the main menu, select Users & Roles.
2. In the User & Roles window, select the Security tab.
3. Click Add > External user or group.
4. From the Type drop-down list, select User or Group.
5. In the Name field, enter the group name or user name in the UPN format, for example, john.doe@domain.com.
6. From the Role drop-down list, select the role that you want to assign to this user or group.
7. Click OK.

Adding External User or Group Using Web UI

To add an external user or group in the Veeam Backup & Replication web UI, do the following:

1. From the top bar, select Configuration > Users & Roles.
2. Click Add.
3. From the Type drop-down list, select External User or External Group.
4. In the Name field, enter the group name or user name in the UPN format, for example, john.doe@domain.

5. From the Role drop-down list, select the role that you want to assign to this user or group.
6. Click OK.