Dealing with Microsoft API permissions has long been one of the hard parts of working extensively with Veeam Backup for Office 365. They tend to change fairly often and with little notice, leaving Veeam and other backup service providers for Microsoft365 in the enviable spot of needing to chase these permissions with their applications.
Veeam recently released version 5 of their M365 backup product and while the requirements are mostly the same permissions wise as they were in version 4 I’ve found there are a couple that potentially v4 was able to work without having in place due to other legacy setups that now don’t work in v5. My specific issue results in any Exchange Online jobs returning with the following error:
Processing mailbox XXXX failed with error: The remote server returned an error: (401) Unauthorized.
Fixing this requires adding the “full_access_as_app” permission but getting to that point is a bit more complicated for those not familiar with azure AD apps. This post will show you how to get to your existing Veeam Backup for Office 365 Azure app registration and verify that all of the necessary permissions have been added.
- Connect to https://portal.azure.com and login with your global administrator permissions
- Navigate to Azure Active Directory and then app registrations
- Click on your current app registration used for Veeam Backup for O365
- Select API permissions. Once there the desired state for Veeam Backup for Office 365 currently is
- Microsoft Graph
- Office 365 Exchange Online
- Microsoft Graph
- If you have performed the v5 upgrade and your backups are currently failing the bolded permissions above may likely be missing and you will need to add them. When done adding your API permissions window should look like this
- To add permissions you will need to
- click the “+ Add a permission” button
- click the tile for the necessary API group (Graph, Office 365 Exchange Online)
* For the Office 365 Exchange Online direct access has been deprecated by Microsoft. In that case you will need to choose the “API my organization uses and search for “Office 365 Exchange” to find it. This looks like
- Choose “Application permissions”
- Check the box for the permission you are requesting and click “Add permissions”
- After adding permissions you will need to click the “Grand admin consent for <your organization>” button to complete adding the permissions for your organization.
It is worth noting that for future reference the documentation for Veeam required permissions for Veeam Backup for Office 365 modern authentication with legacy protocols allowed is located at https://helpcenter.veeam.com/docs/vbo365/guide/ad_app_permissions_legacy.html?ver=50. As these permissions are changed by Microsoft from time to time it is worth notating this link.