Microsoft Graph permissions
These permissions are configured on the Microsoft Entra ID app registration (service principal) that Commvault uses to access your tenant.
Application permissions for backup and restore
The following application permissions are required:
| Category | Permission | Description |
|---|---|---|
| AccessReview | AccessReview.ReadWrite.All | Manage all access reviews that user can access |
| AdministrativeUnit | AdministrativeUnit.ReadWrite.All | Read and write all administrative units |
| Application | Application.ReadWrite.All | Read and write all applications |
| AppRoleAssignment | AppRoleAssignment.ReadWrite.All | Manage app permission grants and app role assignments |
| AuditLog | AuditLog.Read.All | Read all audit log data |
| BitlockerKey | BitlockerKey.Read.All | Read BitLocker key metadata and recovery keys |
| CustomSecAttributeAssignment | CustomSecAttributeAssignment.ReadWrite.All | Read and write custom security attribute assignments |
| DelegatedPermissionGrant | DelegatedPermissionGrant.ReadWrite.All | Manage all delegated permission grants |
| Device | Device.ReadWrite.All | Read and write all devices |
| DeviceLocalCredential | DeviceLocalCredential.Read.All | Read all local administrator password solution (LAPS) credentials |
| DeviceManagementConfiguration | DeviceManagementConfiguration.ReadWrite.All | Read and write Microsoft Intune Device Configuration and Policies |
| DeviceManagementManagedDevices | DeviceManagementManagedDevices.ReadWrite.All | Read and write Microsoft Intune devices |
| DeviceManagementRBAC | DeviceManagementRBAC.ReadWrite.All | Read and write Microsoft Intune RBAC settings |
| DeviceManagementScripts | DeviceManagementScripts.ReadWrite.All | Read and write Microsoft Intune Scripts |
| Directory | Directory.ReadWrite.All | Read and write directory data |
| Domain | Domain.ReadWrite.All | Read and write domains |
| Group | Group.ReadWrite.All | Read and write all groups |
| Policy | Policy.Read.All | Read your organization's policies |
| Policy | Policy.ReadWrite.AuthenticationMethod | Read and write your organization's authentication method policies |
| Policy | Policy.ReadWrite.ConditionalAccess | Read and write your organization's conditional access policies |
| PrivilegedAssignmentSchedule | PrivilegedAssignmentSchedule.ReadWrite.AzureADGroup | Read, create, and delete assignment schedules for access to Azure AD groups |
| PrivilegedEligibilitySchedule | PrivilegedEligibilitySchedule.ReadWrite.AzureADGroup | Read, create, and delete eligibility schedules for access to Azure AD groups |
| Reports | Reports.Read.All | Read all usage reports |
| RoleAssignmentSchedule | RoleAssignmentSchedule.ReadWrite.Directory | Read, update, and delete all policies for privileged role assignments of your company's directory |
| RoleManagement | RoleManagement.ReadWrite.Directory | Read and write all directory RBAC settings |
| RoleManagementPolicy | RoleManagementPolicy.ReadWrite.AzureADGroup | Read, update, and delete all policies in PIM for Groups |
| User | User-Mail.ReadWrite.All | Read and write all secondary mail addresses for users |
| User | User-Phone.ReadWrite.All | Read and write all user mobile phone and business phones |
| User | User.DeleteRestore.All | Delete and restore all users |
| User | User.ReadWrite.All | Read and write all users' full profiles |
| UserAuthenticationMethod | UserAuthenticationMethod.ReadWrite.All | Read and write all users' authentication methods |
Delegated permissions for backup and restore
The following Delegated permissions are required:
| Category | Permission | Description |
|---|---|---|
| Directory | Directory.AccessAsUser.All | Access directory as the signed in user |
| RoleEligibilitySchedule | RoleEligibilitySchedule.ReadWrite.Directory | Read, update, and delete all eligible role assignments and schedules in your company's directory |
Least application permissions for backups only
| Category | Permission | Description |
|---|---|---|
| AccessReview | AccessReview.Read.All | Read all access reviews that user can access |
| AdministrativeUnit | AdministrativeUnit.Read.All | Read all administrative units |
| Application | Application.Read.All | Read all applications |
| AuditLog | AuditLog.Read.All | Read all audit log data |
| BitlockerKey | BitlockerKey.Read.All | Read BitLocker key metadata and recovery keys |
| CustomSecAttributeAssignment | CustomSecAttributeAssignment.Read.All | Read custom security attribute assignments |
| DelegatedPermissionGrant | DelegatedPermissionGrant.Read.All | Read all delegated permission grants |
| Device | Device.Read.All | Read all devices |
| DeviceLocalCredential | DeviceLocalCredential.Read.All | Read all local administrator password solution (LAPS) credentials |
| DeviceManagementConfiguration | DeviceManagementConfiguration.Read.All | Read Microsoft Intune Device Configuration and Policies |
| DeviceManagementManagedDevices | DeviceManagementManagedDevices.Read.All | Read Microsoft Intune devices |
| DeviceManagementRBAC | DeviceManagementRBAC.Read.All | Read Microsoft Intune RBAC settings |
| DeviceManagementScripts | DeviceManagementScripts.Read.All | Read Microsoft Intune Scripts |
| Directory | Directory.Read.All | Read directory data |
| Domain | Domain.Read.All | Read domains |
| Group | Group.Read.All | Read all groups |
| Policy | Policy.Read.All | Read your organization's policies |
| Policy | Policy.Read.AuthenticationMethod | Read your organization's authentication method policies |
| Policy | Policy.Read.ConditionalAccess | Read your organization's conditional access policies |
| PrivilegedAssignmentSchedule | PrivilegedAssignmentSchedule.Read.AzureADGroup | Read assignment schedules for access to Azure AD groups |
| PrivilegedEligibilitySchedule | PrivilegedEligibilitySchedule.Read.AzureADGroup | Read eligibility schedules for access to Azure AD groups |
| RoleAssignmentSchedule | RoleAssignmentSchedule.Read.Directory | Read all policies for privileged role assignments of your company's directory |
| RoleEligibilitySchedule | RoleEligibilitySchedule.Read.Directory | Read all eligible role assignments and schedules in your company's directory |
| RoleManagement | RoleManagement.Read.Directory | Read all directory RBAC settings |
| RoleManagementPolicy | RoleManagementPolicy.Read.AzureADGroup | Read all policies in PIM for Groups |
| User | User.Read.All | Read all users' full profiles |
| UserAuthenticationMethod | UserAuthenticationMethod.Read.All | Read all users' authentication methods |
Least delegated permissions for backup only
No delegated permissions are required for backup only.
Azure role assignment permissions
Backing up and restoring Azure role assignments requires permissions beyond Microsoft Graph API permissions.
Azure role assignments are managed through Azure RBAC and must be assigned at the subscription level, separate from app registration permissions.
The service principal is the enterprise application linked to the Microsoft Entra ID app registration that Commvault uses to access your tenant. It might be created automatically (Express configuration) or manually (Custom configuration).
Important
-
Assign the role for each subscription that you want to protect.
-
Required for both backup and restore operations.
-
Without this role, Azure role assignments aren’t discovered or backed up.
Additional permissions required for Azure role assignments
| Scope | Role | Assigned to |
|---|---|---|
| Subscription (each) | User Access Administrator | Commvault app registration (service principal) |
Assign Azure role assignment for backup and restore
-
Go to Subscriptions.
-
Select the subscription.
-
Open Access control (IAM).
-
Click Add role assignment.
-
Select User Access Administrator.
-
Assign the role to the enterprise application (service principal) that Commvault uses.