Restricting Veeam Backup for Microsoft Azure Permissions to Resource Group

When deploying Veeam Backup for Microsoft Azure, and initially adding the Azure account, it must have the Microsoft.Authorization/*/Write permissions assigned in the subscription associated with the backup appliance.

After deployment, the account can then be restricted to only allow full permission on the Resource Groups that will host the tenant's Azure VMs, virtual networking, and storage account.

However, as a result of the restricted permissions, attempting to Restore to the original location when the original VM is still present will fail.

When restoring a VM to the original location, if the original VM is detected as still being present, the following steps are performed:

1. VM is restored to a temporary Resource Group
2. The Original VM is deleted from the original Resource Group
3. The Restored VM is moved from the temporary Resource Group to the original one
    

When the permissions are restricted to only a specific Resource Group, Veeam Backup for Microsoft Azure cannot create the temporary Resource Group, and the restore operation fails.

To work around this issue either:

• assign adequate permissions to allow the temporary Resource Group to be created.
  
  or 
• delete the original VM before performing a restore to the original location.
  If the original VM is not present, the "Restore to original location" procedure will not need to create the temporary Resource Group, and will instead restore the VM directly to the original Resource Group.

A temporary Resource Group is utilized as a part of the Restore to the original location only when the original VM exists because it is currently impossible to rename resources in Azure. This means that Veeam cannot simply restore the VM to the original location with a temporary name, remove the original VM, and rename the restored VM.