Veeam Office 365 Complete Permissions

Challenge

Configuring the required granular permissions for Veeam Office 365 and troubleshooting permission errors.

Cause

When adding an Organization there are 11 Verification checks that happen. Below lists each of the verification and what it means if it fails. In addition any permission assigned in Office 365 Online can take 15-60 minutes to apply on Microsoft's end.

Connection to Microsoft Graph: This meaning can change based on if you are using Modern authentication or Basic authentication.

Modern authentication: This would mean that the Application ID and secret failed to authenticate.

Make sure the Application ID and Secret were properly entered
Check the Application APIs from the "Azure AD Application" section below
Try generating a new Application Secret from Azure AD

Basic authentication: This would mean that your username does not have permissions to authenticate with the Microsoft Graph Online.

If your Organization is Federated try creating a new cloud user account from Microsoft Azure AD for authentication.
Make sure that the user belongs to the Organization.
Check that user has all permissions assigned from the above SharePoint and Exchange section

Connect to EWS: This is a connection to the Exchange Web Service.

Modern authentication: This uses a duel authentication leveraging the Application ID and Username.

For the Application ID check in Microsoft Azure AD that the correct APIs were assigned as Application and not Delegated.
For the Username check Microsoft Exchange Admin center that all permissions have been assigned to the user as documented below.

Basic authentication:

For the Username check Microsoft Exchange Admin center that all permissions have been assigned to the user as documented below.

Connection to PowerShell: This step checks that we can connect to Exchange Online PowerShell. Only the username is used for this verification. Require AllowBasicAuthPowershell and AllowBasicAuthWebServices to be allowed in the group policy this user is added to.

In Azure AD check Conditional Access- Polices for anything blocking legacy authentication and make sure the service account is being excluded from these policies: https://aad.portal.azure.com/#blade/Microsoft_AAD_IAM/ConditionalAccessBlade/Policies
Check through PowerShell to see if the policies are allowed for the user:
1. Connect to Exchange Online PowerShell module: https://docs.microsoft.com/en-us/powershell/exchange/exchange-online/connect-to-exchange-online-powershell/connect-to-exchange-online-powershell?view=exchange-ps
2. Next you will run the "Get-AuthenticationPolicy" command. If there is a blank return then there is no policy in place.
3. If the current policy does not have true for AllowBasicAuthPowershell and AllowBasicAuthWebService contact your Domain admins to update the policy with the following Microsoft Document
4. https://docs.microsoft.com/en-us/powershell/module/exchange/organization/set-authenticationpolicy?view=exchange-ps

Check Exchange plan and SharePoint plan: If either of these fail then your plan cannot automatically identified as Valid. Use the below KB to add the proper plans to your configuration

Service plan is not found when adding Office 365 organization: https://www.veeam.com/kb2946

Check Required cmdlets access, Mailbox Search role, and Applicationimpersonation role: The roles are all related to Exchange Online.

Check that the user has been properly added to the role group with all necessary permissions as shown above in the Exchange section

Check SharePoint Online Administrators role: This refer the SharePoint Administrator role that you assign to the user in the Admin Center.

Refer to the SharePoint section above and make sure that the service has the SharePoint Administrator role assigned

Check LegacyAuthProtocolsEnabled: This is a setting in SharePoint Admin center to enable legacy Authentication.

Refer to the SharePoint section above to Allow Apps that don't use modern authentication.
“Unauthorized” error is thrown by SharePoint Online and/or OneDrive for business backup jobs: https://www.veeam.com/kb2714

Solution

Exchange
SharePoint
User App Password
Azure AD Application

Exchange

Configuring Permissions for Exchange (on-premises or Online):

First log into the Exchange Admin Center: https://outlook.office365.com/ecp/
Select Permissions and add a New Role Group

Create your role Group: -Name your role group appropriately (Example: VBO Permissions) -Add Roles: ApplicationImpersonation, View-Only Configuration, View-Only Recipients, Mailbox Search, and Mail Recipients -Add the Veeam Service account under Members and Save

SharePoint

Configuring Permissions for SharePoint Online

Add the SharePoint Administrator Role to user In Azure Admin Center: https://admin.microsoft.com/ Select: Users > Active Users > Select Backup Service account

Allow Apps that don't use modern authentication In the SharePoint Admin Center: https://[ORGANIZATION NAME]-admin.sharepoint.com/ Select: Access control > Apps that don't use modern authentication > Allow Access

User App Password

Configuring user App Password:

Set up user to leverage Multi Factor Authentication: https://account.activedirectory.windowsazure.com/UserManagement/MultifactorVerification.aspx? Select: Service account > Enable.

Once the account have been enabled for Multi-factor authorization you will need to sign-in with the service account and follow the steps for configuring Multi Factor authentication.
Generate an application password for the user: https://portal.office.com/account/#security Select: Additional security verification> Create and manage app password:

Or Directly to Application Password: https://account.activedirectory.windowsazure.com/AppPasswords.aspx Select Create:

Name App Password:

Copy App Password because it will no longer be available once you close the window:

Azure AD Application

Configuring Azure AD Application

Register a new App in Azure AD: https://aad.portal.azure.com/#blade/Microsoft_AAD_RegisteredApps/ApplicationsListBlade Can also be found under: All services> App Registrations-

Name the Application, add Redirect URL (URL does not need to be real. Example: "http://localhost/"), and Click Register

Select API permissions and Add permission. Please keep in mind that all permissions must be added as Application permissions and not Delegated permissions

First API will be at the top of the page: Microsoft Graph> Application Permissions

Check Directory.Read.All and Group.Read.All then select Add permissions.
Directory.Read.All permission is required to read organization and users’ properties. Group.Read.All is required to read groups properties and membership.

If you’re going to use application certificates, second API will be halfway down the page: SharePoint > Application Permissions

Check Sites.Fullcontrol.All and User.Read.All. Then select Add permission.
Sites.Fullcontrol.All is required to read sites content. User.Read.All is required to read user profiles.

Last API is also required only if using application certificates. It will be at the bottom of the page Under Supported legacy APIs: Exchange> Application Permissions.