Configure permissions for Azure Virtual Machines protection

Before you configure backups, grant Commvault access to the Azure resources you want to protect.

Prerequisites

You must have the following:

Grant the required permissions in Microsoft Azure before you configure backups.

The required permissions depend on how Commvault accesses your Azure resources:

For Azure application authentication, assign the required Azure role to the application at the subscription or resource-group scope. For information about roles and permissions for protecting Azure resources, see Role and Permission Requirements for Protecting Azure Resources.
For managed identity authentication, assign the required Azure role to the managed identity that is associated with the access node.
For Express configuration, Commvault creates and configures the required Azure application and permissions automatically.

A Microsoft Entra Global Administrator or Application Administrator must be available when you configure backups to approve the application creation and permission grant process. Contributor permissions alone aren't sufficient for this process.

Commvault requires Azure permissions to discover resources and perform data protection operations.

Depending on the resources you protect and the operations you perform, permissions are required for tasks such as:

For a detailed list of Azure resource providers that Commvault uses during protection operations, see Azure resource provider usage for Azure Virtual Machines protection.

Commvault uses Azure permissions only to perform data protection operations.

Depending on the operations you perform, permissions are used to:

Discover Azure resources you want to protect
Create and manage snapshots
Access managed disks and associated storage resources
Restore VMs, disks, and related Azure resources
Create network resources that are required during restore operations
Clean up temporary resources that are created during backup, restore, and replication operations

Commvault does not use these permissions for administrative tasks that are unrelated to data protection.

Access nodes require Azure permissions to discover resources and perform data protection operations.

If you use self-managed infrastructure (access nodes):

Assign the required Azure roles
Configure managed identities if you use managed identity authentication
Access nodes must have the permissions that are required to communicate with the Azure services that are used for authentication, resource management, snapshots, storage access, and restore operations.