Veeam: what's protected, how recoverable it is, and what's failing now

Veeam Service Provider Console is the one place a Veeam partner can see every customer at once. Backup & Replication manages a single backup server and Veeam Backup for Microsoft 365 manages a single Microsoft 365 server; neither of them knows what a customer is. The console does, and it sits in front of both. This connector reads that view into Current, per partner, so an account manager can answer "is their data actually recoverable" from the company record. One API key covers the whole estate, and Current only ever reads.

1. 1
   1 · Pick or create a service account with the Portal Readonly Operator role

   Mint the key against a service account rather than a person. A VSPC key never expires on its own — it stays valid until the user behind it is disabled or deleted, so a key created by a technician who later leaves stops working the day their account is disabled, with nothing in Current having changed. The Portal Readonly Operator role also caps what the key can do regardless of how it was created. Use a provider-level account: a key minted against a company-scoped user sees one company and looks like a broken sync.
2. 2
   2 · Open Configuration (top right) ▸ Access Management ▸ REST API Keys ▸ New

   Choose Simple Key, the option the console marks Recommended. It is the type that carries the Read-only access toggle.
3. 3
   3 · Give it a description and switch Read-only access ON

   Name it for Current so the next person to read this list knows what it feeds.
4. 4
   4 · Save and copy the key

   The console shows it once.
5. 5
   5 · Check the console is reachable and its certificate is publicly trusted

   Current connects from the internet, so the console has to be published there or our egress allowlisted. It also needs a certificate from a public authority: Current will not skip certificate checks to reach a backup console, and there is no option to make it. If yours is self-signed or from a private authority, install a publicly trusted one before you connect.

1. 1
   1 · Open Settings → Integrations → Veeam Service Provider Console

   Only Tenant Admins see this page.
2. 2
   2 · Paste the console address, including the port

   For example https://vspc.example.com:1280. Port 1280 is the console's default for both the web interface and the API, but the API port can be set separately at install time and 1281 is a common alternative. If the first attempt cannot connect, try the other one before you assume the key is wrong. Any path you paste is discarded.
3. 3
   3 · Paste the API key and press Test connection

   Current makes one read — a single-row company list — and reports what your console said. The key is stored server-side and is never shown again.
4. 4
   4 · Map your companies

   Current writes one row per company in your console straight away, before it reads anything else, and links each one to a company in Current where exactly one name matches. Anything ambiguous waits on the Unmapped list for a person. A mapping you set by hand is never overwritten by a later automatic match, and mapping a company attaches its workloads, jobs and alarms immediately rather than waiting for the next sync.

Every six hours. You can press Sync now on the card at any time. The sync paces itself deliberately: your console is a production system, its rate limits are configured on your own server rather than published by Veeam, and a sync that slows down someone's backup console is worse than a sync that is a few hours behind. A large estate fills in across several runs rather than one burst.

Every health figure on the card can be blank, and blank means Veeam did not report it. Blank never means zero and never means healthy. Four cases come up often enough to name:

• ＋A workload with no restore point at all is reported as never backed up. Veeam knows about the machine, and it has never made a copy of it — that is a finding, and it shows as one.
• ＋A workload Current has no record of shows as not reporting. Nothing is claimed about it, because nothing is known about it.
• ＋Malware state is stored exactly as Veeam sends it. Infected and Suspicious are findings. Clean is a pass. Unverified and Unknown mean the scan did not run or did not reach a conclusion, and they read as unknown — the card will not show a reassuring result off them.
• ＋Immutability is reported for virtual machines, because that is where Veeam reports it. A company whose estate is all agent-backed computers shows no immutability figure at all rather than a zero percent that would be about the connector rather than the partner.

• ＋The Veeam card on a company record: protected workloads split by kind, jobs failing now with their names and last run, immutability coverage across virtual machines, the oldest restore point, the company's status when it is not Active, and the count of lit alarms.
• ＋The Backup cluster in Infrastructure & security, where protected systems and failing systems fold in alongside your other backup feeds.
• ＋The company alert band, through the backups-failing alert. Where both Veeam and Backup Radar are connected, a company raises one alert rather than two.
• ＋Strategic Business Reviews, in the Backup & continuity chapter.
• ＋Dashboard tiles for protected workloads, failing jobs, immutability coverage and Microsoft 365 objects.