Specifying Existing Microsoft Entra Application

If you choose to specify an existing service account, Veeam Data Cloud for Microsoft Azure will connect to an existing Microsoft Entra application that grants access to your Azure resources. For Veeam Data Cloud for Microsoft Azure to be able to connect to the Microsoft Entra application and to protect Azure resources, the application must be created in Microsoft Azure, and have the Contributor, Key Vault Crypto User and Storage Queue Data Contributor Azure built-in roles assigned. To learn how to create Microsoft Entra applications and assign Azure roles, see Microsoft Identity Platform and Azure RBAC documentation.

Tip

If you want the service account to have granular permissions, you can create a custom role in Microsoft Azure, assign the role to the Microsoft Entra application instead of the built-in roles, and make sure the role has all the permissions required to perform backup and restore operations. For the list of required permissions, see the Service Account Permissions section in the Veeam Backup for Microsoft Azure User Guide.

At the Specify Azure Application step of the wizard, specify an existing service account that grants access to your Azure resources:

In the Tenant ID field, enter the tenant ID of the specified Microsoft Entra application.

You can find the tenant ID on the Overview page of your Microsoft Entra application in the Microsoft Azure portal. For more information, see Microsoft Docs.

In the Application ID field, enter the application identifier. You can find the identifier on the Overview page of your Microsoft Entra application in the Microsoft Azure portal. For more information, see Microsoft Docs.
In the Client Secret field, enter the value of the secret. To learn how to create client secrets, see Microsoft Docs.
In the Select subscriptions field, select the subscriptions to which you want to have access. You must select at least one subscription.

Note

You can add multiple subscriptions to an Azure service account. However, a subscription can only be associated with a single service account. If a subscription has been previously added to another account, you will not be able to add such subscription to the account you are creating.

Click Connect & Save.