#1 Global Leader in Data Resilience
#1 Global Leader in Data Resilience
BACK TO KB LIST

How to Back Up ARM Role Assignments with Veeam Backup for Entra ID

KB ID: 4683
Product: Veeam Backup & Replication | 12.3
Published: 2024-12-03
Last Modified: 2025-02-18
mailbox
Get weekly article updates
By subscribing, you are agreeing to have your personal information managed in accordance with the terms of Veeam's Privacy Notice.
This site is protected by hCaptcha and its Privacy Policy and Terms of Service apply except as noted in our Privacy Policy.

Cheers for trusting us with the spot in your mailbox!

Now you’re less likely to miss what’s been brewing in our knowledge base with this weekly digest

error icon

Oops! Something went wrong.

Please, try again later.

Challenge

This article documents the additional configuration necessary to enable Veeam Backup for Microsoft Entra ID to back up relationships between protected resources and management groups as part of the backup scope.

By default, Veeam Backup for Microsoft Entra ID does not back up relationships between protected resources and management groups.

Solution

Part 1: Set Permissions

The application must have a Reader Role in the Azure Root management group.

This can be added automatically or manually depending on whether or not the Tenant has been added to the Inventory already.

Expand the section that represents the current state of the Inventory section of Veeam Backup & Replication.

The tenant has not yet been added to the Inventory.
Automatic

This method can be used when the Tenant has not yet been added to Veeam Backup & Replication Inventory.

  1. The user should be able to assign roles in all Azure subscriptions and management groups associated with the tenant.
    To learn how to grant this privilege, see Microsoft Azure Docs.
  2. Close all Veeam Backup & Replication Consoles (veeam.backup.shell.exe)
  3. Create the following registry value on the Veeam Backup Server:
    • Key Location: HKLM\SOFTWARE\Veeam\Veeam Backup and Replication\
    • Value Name: ProcessARMRoleAssignments
    • Value Type: String Value (REG_SZ)
    • Value Data: true
New-ItemProperty -Path 'HKLM:\SOFTWARE\Veeam\Veeam Backup and Replication\' -Name 'ProcessARMRoleAssignments' -Value "true" -PropertyType 'String' -Force
  1. Open the Veeam Backup & Replication Console.
  2. Add the Tenant to Inventory.
The tenant has already been added to the Inventory.

This method must be used when the tenant has already been added to the Veeam Backup & Replication Inventory node.

  1. The user should be able to assign roles in all Azure subscriptions and management groups associated with the tenant.
    To learn how to grant this privilege, see Azure Documentation - Elevate access to manage all Azure subscriptions and management groups.
  2. Assign the Reader role to the application in the Root management group.
    For more information, see Azure Documentation - Assign Azure roles using the Azure portal.
    1. Navigate to the Management Group page.
    2. Select the Root management group.
    3. Add a new IAM role assignment.
    4. Assign the Reader role to the application.

Part 2: Enable Processing

After setting the Reader role, you must enable the processing of ARM RoleAssignments.

  1. Enable the processing of ARM RoleAssignments by adding the option key "ProcessArmRoleAssignments" to the appsettings.json file.
    You must create the file manually if it doesn't exist in the Plugin folder:
    C:\Program Files (x86)\Veeam\Backup Transport\x64\Plugins\EntraId\

Example of appsettings.json file content:

{
  "EntraIdEntitiesBackupSettings": {
    "ProcessArmRoleAssignments": true
  }
}
To submit feedback regarding this article, please click this link: Send Article Feedback
To report a typo on this page, highlight the typo with your mouse and press CTRL + Enter.

Spelling error in text

This site is protected by hCaptcha and its Privacy Policy and Terms of Service apply except as noted in our Privacy Policy.
Thank you!

Thank you!

Your feedback has been received and will be reviewed.

Oops! Something went wrong.

Please, try again later.

You have selected too large block!

Please try select less.

KB Feedback/Suggestion

This form is only for KB Feedback/Suggestions, if you need help with the software open a support case
By submitting, you are agreeing to have your personal information managed in accordance with the terms of Veeam's Privacy Notice.
This site is protected by hCaptcha and its Privacy Policy and Terms of Service apply except as noted in our Privacy Policy.
Verify your email to continue your product download
We've sent a verification code to:
  • Incorrect verification code. Please try again.
An email with a verification code was just sent to
Didn't receive the code? Click to resend in sec
Didn't receive the code? Click to resend
Start using Veeam:
Download the product
&
Activate the license key
Thank you!

Thank you!

Your feedback has been received and will be reviewed.

error icon

Oops! Something went wrong.

Please, try again later.