Challenge
When deploying Veeam Backup for Microsoft Azure, and initially adding the Azure account, it must have the Microsoft.Authorization/*/Write permissions assigned in the subscription associated with the backup appliance.
After deployment, the account can then be restricted to only allow full permission on the Resource Groups that will host the tenant's Azure VMs, virtual networking, and storage account.
However, as a result of the restricted permissions, attempting to Restore to the original location when the original VM is still present will fail.
Cause
When restoring a VM to the original location, if the original VM is detected as still being present, the following steps are performed:
VM is restored to a temporary Resource Group
The Original VM is deleted from the original Resource Group
The Restored VM is moved from the temporary Resource Group to the original one
When the permissions are restricted to only a specific Resource Group, Veeam Backup for Microsoft Azure cannot create the temporary Resource Group, and the restore operation fails.
Solution
To work around this issue either:
assign adequate permissions to allow the temporary Resource Group to be created.
or
delete the original VM before performing a restore to the original location.If the original VM is not present, the "Restore to original location" procedure will not need to create the temporary Resource Group, and will instead restore the VM directly to the original Resource Group.
More Information
A temporary Resource Group is utilized as a part of the Restore to the original location only when the original VM exists because it is currently impossible to rename resources in Azure. This means that Veeam cannot simply restore the VM to the original location with a temporary name, remove the original VM, and rename the restored VM.
