# Permissions required for configuring Azure AD

## Microsoft Graph permissions

These permissions are configured on the Microsoft Entra ID app registration (service principal) that Commvault uses to access your tenant.

### Application permissions for backup and restore

The following application permissions are required:

Category | Permission | Description
--- | --- | ---
AccessReview | AccessReview.ReadWrite.All | Manage all access reviews that user can access
AdministrativeUnit | AdministrativeUnit.ReadWrite.All | Read and write all administrative units
Application | Application.ReadWrite.All | Read and write all applications
AppRoleAssignment | AppRoleAssignment.ReadWrite.All | Manage app permission grants and app role assignments
AuditLog | AuditLog.Read.All | Read all audit log data
CustomSecAttributeAssignment | CustomSecAttributeAssignment.ReadWrite.All | Read and write custom security attribute assignments
DelegatedPermissionGrant | DelegatedPermissionGrant.ReadWrite.All | Manage all delegated permission grants
DeviceManagementConfiguration | DeviceManagementConfiguration.ReadWrite.All | Read and write Microsoft Intune Device Configuration and Policies
DeviceManagementRBAC | DeviceManagementRBAC.ReadWrite.All | Read and write Microsoft Intune RBAC settings
DeviceManagementScripts | DeviceManagementScripts.ReadWrite.All | Read and write Microsoft Intune Scripts
Directory | Directory.ReadWrite.All | Read and write directory data
Domain | Domain.ReadWrite.All | Read and write domains
Group | Group.ReadWrite.All | Read and write all groups
Policy | Policy.Read.All | Read your organization's policies
Policy | Policy.ReadWrite.AuthenticationMethod | Read and write your organization's authentication method policies
Policy | Policy.ReadWrite.ConditionalAccess | Read and write your organization's conditional access policies
PrivilegedAssignmentSchedule | PrivilegedAssignmentSchedule.ReadWrite.AzureADGroup | Read, create, and delete assignment schedules for access to Azure AD groups
PrivilegedEligibilitySchedule | PrivilegedEligibilitySchedule.ReadWrite.AzureADGroup | Read, create, and delete eligibility schedules for access to Azure AD groups
Reports | Reports.Read.All | Read all usage reports
RoleAssignmentSchedule | RoleAssignmentSchedule.ReadWrite.Directory | Read, update, and delete all policies for privileged role assignments of your company's directory
RoleManagement | RoleManagement.ReadWrite.Directory | Read and write all directory RBAC settings
RoleManagementPolicy | RoleManagementPolicy.ReadWrite.AzureADGroup | Read, update, and delete all policies in PIM for Groups
User | User-Mail.ReadWrite.All | Read and write all secondary mail addresses for users
User | User-Phone.ReadWrite.All | Read and write all user mobile phone and business phones
User | User.DeleteRestore.All | Delete and restore all users
User | User.ReadWrite.All | Read and write all users' full profiles
UserAuthenticationMethod | UserAuthenticationMethod.ReadWrite.All | Read and write all users' authentication methods

### Delegated permissions for backup and restore

The following Delegated permissions are required:

Category | Permission | Description
--- | --- | ---
Directory | Directory.AccessAsUser.All | Access directory as the signed in user
RoleEligibilitySchedule | RoleEligibilitySchedule.ReadWrite.Directory | Read, update, and delete all eligible role assignments and schedules in your company's directory

### Least application permissions for backups only

Category | Permission | Description
--- | --- | ---
AccessReview | AccessReview.Read.All | Read all access reviews that user can access
AdministrativeUnit | AdministrativeUnit.Read.All | Read all administrative units
Application | Application.Read.All | Read all applications
AppRoleAssignment | AppRoleAssignment.ReadWrite.All | Read app permission grants and app role assignments Note There is no read only permission available.
AuditLog | AuditLog.Read.All | Read all audit log data
CustomSecAttributeAssignment | CustomSecAttributeAssignment.Read.All | Read custom security attribute assignments
DelegatedPermissionGrant | DelegatedPermissionGrant.Read.All | Read all delegated permission grants
DeviceManagementConfiguration | DeviceManagementConfiguration.Read.All | Read Microsoft Intune Device Configuration and Policies
DeviceManagementRBAC | DeviceManagementRBAC.ReadWrite.All | Read and write Microsoft Intune RBAC settings
DeviceManagementScripts | DeviceManagementScripts.Read.All | Read Microsoft Intune Scripts
Directory | Directory.Read.All | Read directory data
Domain | Domain.Read.All | Read domains
Group | Group.Read.All | Read all groups
Policy | Policy.Read.All | Read your organization's policies
Policy | Policy.Read.ConditionalAccess | Read your organization's conditional access policies
PrivilegedAssignmentSchedule | PrivilegedAssignmentSchedule.Read.AzureADGroup | Read assignment schedules for access to Azure AD groups
PrivilegedEligibilitySchedule | PrivilegedEligibilitySchedule.Read.AzureADGroup | Read eligibility schedules for access to Azure AD groups
RoleAssignmentSchedule | RoleAssignmentSchedule.Read.Directory | Read all policies for privileged role assignments of your company's directory
RoleManagement | RoleManagement.Read.Directory | Read all directory RBAC settings
RoleManagementPolicy | RoleManagementPolicy.ReadWrite.AzureADGroup | Read, update, and delete all policies in PIM for Groups
User | User-Mail.ReadWrite.All | Read and write all secondary mail addresses for users Note There is no read only permission available.
User | User-Phone.ReadWrite.All | Read and write all user mobile phone and business phones Note There is no read only permission available.
User | User.Read.All | Read all users' full profiles
UserAuthenticationMethod | UserAuthenticationMethod.Read.All | Read all users' authentication methods

### Least delegated permissions for backup only

No delegated permissions are required for backup only.

## Azure role assignment permissions

Backing up and restoring Azure role assignments requires permissions beyond Microsoft Graph API permissions.

Azure role assignments are managed through Azure RBAC and must be assigned at the subscription level, separate from app registration permissions.

The service principal is the enterprise application linked to the Microsoft Entra ID app registration that Commvault uses to access your tenant. It might be created automatically (Express configuration) or manually (Custom configuration).

Important

- Assign the role for each subscription that you want to protect.

- Required for both backup and restore operations.

- Without this role, Azure role assignments aren’t discovered or backed up.

### Additional permissions required for Azure role assignments

Scope | Role | Assigned to
--- | --- | ---
Subscription (each) | User Access Administrator | Commvault app registration (service principal)

### Assign Azure role assignment for backup and restore

1. Go to Subscriptions.

2. Select the subscription.

3. Open Access control (IAM).

4. Click Add role assignment.

5. Select User Access Administrator.

6. Assign the role to the enterprise application (service principal) that Commvault uses.

×

Loading...