Challenge

                    

Configuring the required granular permissions for Veeam Office 365 and troubleshooting permission errors.

                                            

Cause

                                                    

  • When adding an Organization there are 11 Verification checks that happen. Below lists each of the verification and what it means if it fails. In addition any permission assigned in Office 365 Online can take 15-60 minutes to apply on Microsoft's end.
         

Connection to Microsoft Graph: This meaning can change based on if you are using Modern authentication or Basic authentication.

Modern authentication: This would mean that the Application ID and secret failed to authenticate.

  • Make sure the Application ID and Secret were properly entered
  • Check the Application APIs from the "Azure AD Application" section below
  • Try generating a new Application Secret from Azure AD

Basic authentication: This would mean that your username does not have permissions to authenticate with the Microsoft Graph Online.

  • If your Organization is Federated try creating a new cloud user account from Microsoft Azure AD for authentication.
  • Make sure that the user belongs to the Organization.
  • Check that user has all permissions assigned from the above SharePoint and Exchange section

Connect to EWS: This is a connection to the Exchange Web Service.

Modern authentication: This uses a duel authentication leveraging the Application ID and Username.

  • For the Application ID check in Microsoft Azure AD that the correct APIs were assigned as Application and not Delegated.
  • For the Username check Microsoft Exchange Admin center that all permissions have been assigned to the user as documented below.

Basic authentication:

  • For the Username check Microsoft Exchange Admin center that all permissions have been assigned to the user as documented below.

Connection to PowerShell: This step checks that we can connect to Exchange Online PowerShell. Only the username is used for this verification. Require AllowBasicAuthPowershell and AllowBasicAuthWebServices to be allowed in the group policy this user is added to.

Check Exchange plan and SharePoint plan: If either of these fail then your plan cannot automatically identified as Valid.

Check Required cmdlets access, Mailbox Search role, and Applicationimpersonation role: The roles are all related to Exchange Online.

  • Check that the user has been properly added to the role group with all necessary permissions as shown above in the Exchange section

Check SharePoint Online Administrators role: This refer the SharePoint Administrator role that you assign to the user in the Admin Center.

  • Refer to the SharePoint section above and make sure that the service has the SharePoint Administrator role assigned

Check LegacyAuthProtocolsEnabled: This is a setting in SharePoint Admin center to enable legacy Authentication. 

  • Refer to the SharePoint section above to Allow Apps that don't use modern authentication.