Updated 3/10/2025
Permissions are the backbone of successful backups in Veeam for Microsoft 365. Without the right access levels, Veeam cannot read, write, or manage the data required for seamless backup and restore operations.
With the recent update to version 8, Veeam for Microsoft 365 requires the following permissions to be granted to the backup Application Registration:
- ChannelMember.Read.All
- Exchange.ManageAsApp
- Global Reader
Assigning the Global Reader Role to the Application Registration
To assign the Global Reader role, follow these steps:
1. Sign in to the Microsoft Entra admin center and on the left side panel, navigate to Identity and click on Show More
2. Next, navigate to Roles & admins > Roles & admins.
3. In the Administrative roles list, find the Global Reader role and click on it.
4. In the Global Reader window, click Add assignments.
The Add assignments wizard will open.
*If you don’t have any members assigned to the role, click on Select members link at the bottom.
*The role needs to be assigned to the App Registration, not the service account.
5. In the Add Assignments window, search for the App Registration used for M365 backup jobs. (If you are unsure which application is used for backups, please contact our support team.)
6.Check the box next to the App Registration and click Add.
The Global Reader role is now assigned to the App Registration.
Assigning API Permissions to the Application Registration
To assign missing permissions or verify existing ones, follow these steps:
1. Navigate to Applications > App Registrations, click on All Registrations and click on the App Registration used for the backup jobs. (If you are unsure which application is used for backups, please contact our support team.)
2. Once the App Registration is opened, under Manage, click on API Permissions
Here, you can review the list to see what permissions have already been granted.
3. Click Add a permission to add new permissions.
For ChannelMember.Read.All, after clicking on Add a permission button, navigate to Microsoft Graph > Application Permissions and search for ChannelMember. Expand ChannelMember line, check ChannelMember.Read.All and click Add Permissions.
For Exchange.ManageAsApp, after clicking on Add a permission button, navigate to APIs my organization uses and search for Office 365 Exchange Online and click on Office 365 Exchange Online > Application Permissions. Search for Exchange, expand the Exchange line, check Exchange.ManageAsApp and click Add Permissions.
4. After adding new permissions, click on Grant admin consent for [your organization] to activate them. Without admin consent, the newly added permissions will remain inactive.
Conclusion
Ensuring the proper permissions are assigned in Microsoft Entra is critical for the smooth operation of Veeam for Microsoft 365. Following the steps outlined above will help you resolve the “Missing Permissions” warning and ensure your backup jobs run successfully. If you encounter any issues during this process, please reach out to our support team at support@managecast.com for assistance. We will be happy to help!
