Azure Backup: Recover Files without Permission to Modify Settings

Question

We have an ask from a client: They want permissions configured on their Azure tenant such that only a specified break-glass account would have the capability to modify settings on their backups. (Primarily AFS and VMs). The idea being to prevent something where a backup policy gets modified, either accidentally or maliciously, resulting in deletion of historical recovery points.

That being said, the IT staff needs to be able to retain the ability to carry out file recoveries and such from those same backups.

Per my research, Roles are assigned at the Vault level, and you can't get any more granular than that. Modifying the policies would require Backup Contributor or Backup Operator role. But I found that "To restore backups in Azure, you'll generally need either the Backup Contributor or Backup Operator role, depending on the specific resource and operation." So assigning the IT staff the Backup Reader role only would prevent access to modify policies, but would also prevent them from being able to do their jobs.

There's probably something obvious that I'm missing.

Answer 1

Hi @Branden Willis
Assign the Backup Contributor role to your designated Break-Glass account. This role provides full management capabilities over backup operations, including the ability to modify backup policies. It ensures that the account has sufficient privileges to respond to emergency situations effectively.

For your IT staff responsible for day-to-day backup and restore operations, assign the Backup Operator role. This role allows users to perform backup and restore actions—including file recovery—without the ability to alter backup policies. This helps safeguard your backup configurations against accidental or unauthorized changes.

If the built-in roles do not align perfectly with your requirements, consider creating a custom role. This custom role can be tailored to provide specific permissions, such as the ability to recover files, while explicitly denying the ability to change backup policies. This ensures tighter control over your backup environment.

By carefully applying these RBAC roles, you can strike the right balance between operational flexibility for your IT staff and the security of your backup configurations.

https://learn.microsoft.com/en-us/azure/backup/backup-rbac-rs-vault
https://learn.microsoft.com/en-us/azure/backup/backup-rbac-rs-vault#minimum-role-requirements-for-azure-vm-backup

https://learn.microsoft.com/en-us/azure/backup/guidance-best-practices#security-considerations

Kindly let us know if the above helps or you need further assistance on this issue.

---

Please do not forget to "Accept the answer” and upvote it wherever the information provided helps you, this can be beneficial to other community members.it would be greatly appreciated and helpful to others.