# Configure permissions for Azure Virtual Machines protection

Before you configure backups, grant Commvault access to the Azure resources you want to protect.

## Prerequisites

You must have the following:

- Azure subscription ID

- Azure tenant ID

## Grant permissions in Azure

Grant the required permissions in Microsoft Azure before you configure backups.

The required permissions depend on how Commvault accesses your Azure resources:

- For Azure application authentication, assign the required Azure role to the application at the subscription or resource-group scope. For information about roles and permissions for protecting Azure resources, see Role and Permission Requirements for Protecting Azure Resources.

- For managed identity authentication, assign the required Azure role to the managed identity that is associated with the access node.

- For Express configuration, Commvault creates and configures the required Azure application and permissions automatically.

  A Microsoft Entra Global Administrator or Application Administrator must be available when you configure backups to approve the application creation and permission grant process. Contributor permissions alone aren't sufficient for this process.

## Required Azure permissions

Commvault requires Azure permissions to discover resources and perform data protection operations.

Depending on the resources you protect and the operations you perform, permissions are required for tasks such as:

- Discovering Azure resources

- Creating and managing snapshots

- Restoring VMs and disks

- Accessing storage resources

- Creating Azure resources that are required during restore operations

For a detailed list of Azure resource providers that Commvault uses during protection operations, see Azure resource provider usage for Azure Virtual Machines protection.

## How Commvault uses Azure permissions

Commvault uses Azure permissions only to perform data protection operations.

Depending on the operations you perform, permissions are used to:

- Discover Azure resources you want to protect

- Create and manage snapshots

- Access managed disks and associated storage resources

- Restore VMs, disks, and related Azure resources

- Create network resources that are required during restore operations

- Clean up temporary resources that are created during backup, restore, and replication operations

Commvault does not use these permissions for administrative tasks that are unrelated to data protection.

## Access node permissions

Access nodes require Azure permissions to discover resources and perform data protection operations.

If you use self-managed infrastructure (access nodes):

- Assign the required Azure roles

- Configure managed identities if you use managed identity authentication

- Access nodes must have the permissions that are required to communicate with the Azure services that are used for authentication, resource management, snapshots, storage access, and restore operations.

×

Loading...