Unable to add an Azure service account to Veeam Backup for Azure

Challenge

When you try to add a service account to Veeam Backup for Azure using an existing Azure account, you get the following error: "Unexpected error occurred. Check the service logs for additional details Trace ID: <...>"

The Veeam Backup for Azure service log (Veeam.Azure_%date_time%.log) displays the following message:

5/5/2020 12:46:27 PM    5 (1) Error: The current subscription type is not permitted to perform operations on any provider namespace. Please use a different subscription.

Cause

Usually an Office 365 subscription includes a free subscription "Access to Azure Active Directory" that allows you to integrate Office 365 with Azure AD. This subscription is created automatically and provides synchronization of user accounts between Office 365 and Azure Active Directory. The capabilities of the "Access to Azure Active Directory" subscription are limited and may prevent Veeam Backup for Azure from managing the access control in Azure Active Directory.

To check whether an account is assigned the "Access to Azure Active Directory" subscription, run the following command in the Azure command-line interface (Azure CLI):

az account list output table

For more information on isolation and access control in Azure Active Directory, see Microsoft Docs. For more information on what the Azure CLI is, how to install and use it, see Microsoft Docs.

Solution

To work around the issue, use an account that does not have the "Access to Azure Active Directory" subscription assigned.