How to configure service account permissions required for Veeam Backup for Microsoft 365

You are required to provide a username and password to authenticate to your Microsoft 365 organization if you add an organization using the basic authentication or Modern Authentication and Legacy Protocols method.

I won’t recommend adding organization with basic authentication, Microsoft announced that effective October 1, 2022, they will begin disabling Basic authentication for Outlook, EWS, RPS, POP, IMAP, and EAS protocols in Exchange Online. SMTP Auth will also be disabled if it is not being used.

Backup account permissions requirements:

When you add Microsoft 365 organization using basic authentication, you use Veeam Backup account. Also, you use Veeam Backup account for on-premises Microsoft Exchange and on-premises Microsoft SharePoint organizations.

To provide Veeam Backup for Microsoft 365 with the ability to work with Microsoft Exchange organizations, Microsoft SharePoint and OneDrive for Business organizations, and protect Microsoft Teams data, you must grant the requirement permissions to the Veeam Backup account.

Microsoft Exchange Organizations permissions requirement:

The account you are using to add an organization must be a member of this organization
The account you are using to add an organization is not required to have a mailbox in such an organization
If you are backing up public folder mailboxes, the Veeam Backup account must have a valid Exchange Online license and an active mailbox within the Microsoft 365 organization

Role	Description
Role Management	Required to grant the ApplicationImpersonation role.
ApplicationImpersonation	Required to back up Exchange data.
Organization Configuration	Required to manage role assignments.
View-Only Configuration	Required to obtain necessary configuration parameters.
View-Only Recipients	Required to view mailbox recipients.
Mailbox Search or Mail Recipients	Required to back up groups.
Owner	Required to backup/restore public folders.

Microsoft SharePoint and OneDrive for Business permissions requirement:

On-Premises Microsoft SharePoint Organizations

Role	Description	Misc.
Site Collection Administrator	Required to back up Microsoft SharePoint Sites.	The account must be a member of the Farm Administrator group.

Microsoft SharePoint Online Organizations

Role	Description	Misc.
SharePoint Admin	Required to back up Microsoft SharePoint Sites.	You can assign the Global Admin role that overrides these roles.
View-only Configuration	Required to get a list of available groups and users.
View-Only Recipients

Microsoft Teams
- The account must have a Microsoft 365 license that permits access to Microsoft Teams API. The minimum sufficient license is Microsoft Teams Exploratory experience
- The account must have the Team Administrator role assigned

Note:

In case you add an organization in Veeam Backup for Microsoft 365 using the modern authentication method with legacy protocols allowed, and specify different accounts to connect to Microsoft Exchange and Microsoft SharePoint, the required license and role must be assigned to the account used to connect to Microsoft SharePoint.
When backing up Microsoft Teams data in an organization added using the basic authentication, Veeam Backup for Microsoft 365 at first adds a service account to every team and then removes it.

The detail permissions requirement as link.

https://helpcenter.veeam.com/docs/vbo365/guide/permissions_veeam_backup_account.html?ver=60

Azure AD Application Permissions requirement

Permissions for Modern Authentication and Legacy Protocols

API	Permission name	Exchange Online	SharePoint Online and OneDrive for Business	Microsoft Teams	Description
Microsoft Graph	Directory.Read.All	✔	✔	✔	Querying Azure AD for organization properties, the list of users and groups and their properties.
	Group.Read.All	✔	✔	✔	Querying Azure AD for the list of groups and group sites.
	TeamSettings.ReadWrite.All			✔	Accessing archived teams.
	Sites.Read.All		✔		Accessing sites of the applications that are installed from the SharePoint store.
Office 365 Exchange Online	full_access_as_app	✔		✔	Reading mailboxes content.
SharePoint	Sites.FullControl.All		✔	✔	Reading SharePoint sites and OneDrive accounts content.
	User.Read.All		✔	✔	Reading OneDrive accounts (getting site IDs).

1.Login to Veeam Backup for Microsoft 365 Manager server.

2.Open PowerShell as Administrator.

3.In a PowerShell window, run below command, type Y and then press Enter.

Set-ExecutionPolicy RemoteSigned

4.Run below command, type Y and then press Enter.

Install-Module -Name PowerShellGet -Force

5.Run below command to make sure the module is up to dat, type Y and then press Enter.

Update-Module -Name PowerShellGet

Assign Exchange Online permissions to backup service account

6.Run below command to install the latest Exchange Online PowerShell Module, type Y and then press Enter.

Install-Module -Name ExchangeOnlineManagement

7.Run below commands to load the EXO V2 module.

Import-Module ExchangeOnlineManagement

8.Run below commands to connect to ExchangeOnline.

Connect-ExchangeOnline -UserPrincipalName navin@contoso.com.

9.On the sign-in window that opens, enter your password, and then click Sign in.

10.Select your verification Method.

11.Enter the code, click Verify.

12.Run the following cmdlet to grant ApplicationImpersonation role for backup account.

New-ManagementRoleAssignment –Role ApplicationImpersonation –User user.name@domain.com

13.If it happened error message as below, you need to run following command first and then re-run above command.

Enable-OrganizationCustomization

14.Run Below command to obtain the list of users whom the ApplicationImpersonation role has already been granted.

Get-ManagementRoleAssignment -Role "ApplicationImpersonation"

15.Run the following cmdlet to grant Role Management role for backup account.

New-ManagementRoleAssignment –Role "Role Management" –User user.name@domain.com

16.Run Below command to obtain the list of users whom the Role Management role has already been granted.

Get-ManagementRoleAssignment -Role "Role Management"

17.Run the following cmdlet to grant Organization Configuration role for backup account.

New-ManagementRoleAssignment –Role "Organization Configuration" –User user.name@domain.com

18.Run Below command to obtain the list of users whom the Organization Configuration role has already been granted.

Get-ManagementRoleAssignment -Role "Organization Configuration"

19.Run the following cmdlet to grant View-Only Configuration role for backup account.

New-ManagementRoleAssignment –Role "View-Only Configuration" –User user.name@domain.com

20.Run Below command to obtain the list of users whom the View-Only Configuration role has already been granted.

Get-ManagementRoleAssignment -Role "View-Only Configuration"

21.Run the following cmdlet to grant View-Only Recipients role for backup account.

New-ManagementRoleAssignment –Role "View-Only Recipients" –User user.name@domain.com

22.Run Below command to obtain the list of users whom the View-Only Recipient role has already been granted.

Get-ManagementRoleAssignment -Role "View-Only Recipients"

23.Run the following cmdlet to grant Mailbox Search role for backup account.

New-ManagementRoleAssignment –Role "Mailbox Search" –User user.name@domain.com

24.Run Below command to obtain the list of users whom the Mailbox Search role has already been granted.

Get-ManagementRoleAssignment -Role "Mailbox Search"

25.if you are using public folder and would like to backup/restore public folders, you need to assign Owner role to folder permission of public folder.

26.Sign in office365 with global admin account, open office 365 admin center.

27.On the Microsoft 365 admin center page, select Exchange.

28.In the Exchange admin center (EAC), navigate to Public folders.

29.In the list view, select the public folder.

30.In the details pane, under Folder permissions, click Manage.

31.In Public Folder Permissions, click Add +.

32.Click Browse to select a user (backup service account, in my case is VBOBK)

33.In the Permission level list, select a level. At least one user should be an Owner.

34.Click Save.

35.To protect your Microsoft 365 organization data properly when you add an organization using either modern authentication with legacy protocols allowed or basic authentication, Run below commands to create a new authentication policy with the AllowBasicAuthPowershell and AllowBasicAuthWebService parameters enabled for the Veeam Backup account.

New-AuthenticationPolicy -Name "Allow Basic Auth"

Set-AuthenticationPolicy -Identity "Allow Basic Auth" -AllowBasicAuthPowershell

Set-AuthenticationPolicy -Identity "Allow Basic Auth" -AllowBasicAuthWebService

Set-User -Identity &lt;VeeamBackupAccount&gt; -AuthenticationPolicy "Allow Basic Auth"

36.Run below command to back up public folder mailboxes correctly, enable the AllowBasicAuthAutodiscover parameter for the created authentication policy.

Set-AuthenticationPolicy -Identity "Allow Basic Auth" -AllowBasicAuthAutodiscover

Assign SharePoint Online Permissions to backup service account

37.Run below command to install the latest SharePoint Online PowerShell Module, type Y and then press Enter.

Install-Module -Name Microsoft.Online.SharePoint.PowerShell

38.Run below command to make sure the module is up to dat, type Y and then press Enter.

Update-Module -Name Microsoft.Online.SharePoint.PowerShell

39.Run below commands to connect to SharePoint Online.

Connect-SPOService -Url <a>https://&lt;your</a> tenant id&gt;-admin.sharepoint.com/

40.On the sign-in window, enter the account name, and then click Next.

41.On the Enter Password window, enter password of the account, and then click Sign in.

42.Select your verification Method.

43.Enter the code, click Verify,

44.Run below command to add Microsoft SharePoint Online organizations, make sure that the LegacyAuthProtocolsEnabled setting is enabled.

Set-SPOTenant -LegacyAuthProtocolsEnabled $True

45.Run below command to install the Azure AD Module, type Y and then press Enter..

Install-Module MSOnline

46.Run below commands to connect to Azure AD service.

Connect-MsolService

47.On the sign-in window, enter the account name, and then click Next.

48.On the Enter Password window, enter password of the account, and then click Sign in.

49.Select your verification Method.

50.Enter the code, click Verify,

51.Run below commands to grant the SharePoint Administrator role to backup account (for Microsoft SharePoint Online organizations).

$role=Get-MsolRole -RoleName "SharePoint Administrator"

$accountname="example@domain.com"

Add-MsolRoleMember -RoleMemberEmailAddress $accountname -RoleName $role.Name

Configure the App password for backup service account

52.Sign in Office 365 portal with Global Admin account, select Admin.

53.On the Microsoft 365 admin center, expend Users, select Active users.

54.On the Active users page, select Multi-factor authentication.

55.On the multi-factor authentication page, select service settings.

56.On the service settings page, select Allow users to create app password to sign in to non-browser apps, click save and then sign out from office 365 portal.