Operational Defect Database

BugZero found this defect 873 days ago.

Veeam | kb4262

Restricting Veeam Backup for Microsoft Azure Permissions to Resource Group

Last update date:


Affected products:

Veeam Backup for Microsoft Azure

Affected releases:


Fixed releases:

No fixed releases provided.



When deploying Veeam Backup for Microsoft Azure, and initially adding the Azure account, it must have the Microsoft.Authorization/*/Write permissions assigned in the subscription associated with the backup appliance. After deployment, the account can then be restricted to only allow full permission on the Resource Groups that will host the tenant's Azure VMs, virtual networking, and storage account. However, as a result of the restricted permissions, attempting to Restore to the original location when the original VM is still present will fail.


When restoring a VM to the original location, if the original VM is detected as still being present, the following steps are performed: VM is restored to a temporary Resource Group The Original VM is deleted from the original Resource Group The Restored VM is moved from the temporary Resource Group to the original one   When the permissions are restricted to only a specific Resource Group, Veeam Backup for Microsoft Azure cannot create the temporary Resource Group, and the restore operation fails.


To work around this issue either: assign adequate permissions to allow the temporary Resource Group to be created.or  delete the original VM before performing a restore to the original location. If the original VM is not present, the "Restore to original location" procedure will not need to create the temporary Resource Group, and will instead restore the VM directly to the original Resource Group.

More Information

A temporary Resource Group is utilized as a part of the Restore to the original location only when the original VM exists because it is currently impossible to rename resources in Azure. This means that Veeam cannot simply restore the VM to the original location with a temporary name, remove the original VM, and rename the restored VM.

Additional Resources / Links


BugZero® Risk Score

What's this?

Coming soon



Learn More