Veeam Enterprise Manager setup and User Role management

Veeam Backup Enterprise Manager (VBEM or VEM) is a centralised management and reporting platform that lets administrators control multiple Veeam Backup & Replication servers from a single web-based console. It is designed for large-scale and ROBO (remote office/branch office) environments, providing full visibility across the entire backup infrastructure. In this blogpost, we will discuss “Veeam Enterprise Manager setup and User Role management”. Please, see how to fix the “Failed to connect to Deployer Service Error, and Upgrade legacy VHR to Veeam Infrastructure Hardened Repository.

How does VBEM fit into the broader Veeam ecosystem?
Access the VBEM
Access the Veeam Host Management Interface

By consolidating management into one interface, Enterprise Manager simplifies license control, job and policy management, reporting, and recovery operations across distributed Veeam deployments. With Veeam Backup Enterprise Manager, you can:

Automate operations and integrations using the Veeam Backup Enterprise Manager REST API.

Centrally manage backup jobs and policies across multiple Veeam Backup & Replication servers.

Monitor real-time job status, analyse operational statistics, and configure global email notifications.

Search backups and replicas for virtual machines, physical machines, file shares, object storage, and guest-level files.

Perform centralised recovery operations, including:
– 1-Click VM and physical machine restore
– Guest OS file restore
– Application item recovery for Microsoft Exchange, Microsoft SQL Server, and Oracle
– 1-Click restore for unstructured data backups

Manage and distribute licenses centrally to ensure compliance.
Delegate restore permissions securely to authorised users.
Support service providers by managing VMware Cloud Director organisations through the Self-Service Backup Portal.
Enable self-service restores for vSphere users via the vSphere Self-Service Backup Portal.
Deploy and manage the vSphere Client plug-in on vCenter Servers.
Enforce data security through centralised encryption and decryption management.

Please see the following relevant links: “How to set up Devolusion Remote Desktop Manager on Windows, What are the differences between a Role and a Feature, and how to set up Veeam Backup for Microsoft Azure.

How does VBEM fit into the broader Veeam ecosystem?

In architectural terms, VBEM is a centralised management and reporting layer as discussed above. It is positioned above multiple Veeam Backup & Replication instances, as shown in the image below.

Data aggregation layer: Enterprise Manager retrieves configuration, job, and reporting data from one or more Veeam Backup & Replication servers via scheduled data collection jobs.

Central store: Collected data is written to the Enterprise Manager database, providing a consistent, consolidated data store that can be accessed by users through the web interface.

Control plane: Changes made through the Enterprise Manager web UI, such as editing jobs or managing licenses, are pushed back to the respective backup server’s own configuration database.

User interface layer (Web UI): Administrators, help-desk staff, and self-service users access VBEM’s browser-based console to manage jobs, delegate permissions, view reports, search backups, and initiate restores.

Note: If you have a Veeam Agent integrated with Veeam Backup & Replication, you can use Veeam Backup Enterprise Manager to browse and restore guest OS files and application items from a backup stored in a Veeam backup repository. These processes involve appropriate backup job setup, as well as “mount” and “data transfer” operations.

Please, see “how to run Windows 11 on HyperV“, What are the differences between dnf and apt package managers?, and “how to Perform a Self-service Password Reset using the Windows Login Integration Client“.

Hardware Requirements

Deploy as a VM (Proxmox/Hyper-V or XCP-ng, etc.) with these minimum requirements for smooth deployment and administration. For more information, kindly take a look at the help centre.

Component	Minimum	Recommended
CPU	4 vCPUs	8+ vCPUs
RAM	8 GB	16+ GB
System Disk	240 GB SSD	480 GB NVMe
Data Disk	240 GB SSD (2nd disk)	1+ TB (auto-LVM pooled)
Network	1 Gbps NIC	10 Gbps + VLANs

Due to the storage requirements and think provisioning leverage, I would suggest you take a look at how to Add Synology NFS Storage to Proxmox VE for VMs and Backups, and how to install an NFS Server on Windows Server.

Install VBEM on XCP-ng

Veeam Backup Enterprise Manager (VBEM), now deployable as a Linux-based Software Appliance in v13, centralises multi-site backup oversight, self-service restores, and reporting across Veeam Backup & Replication (VBR) servers. This product is ideal for MSPs, DRaaS providers, or distributed enterprises.

The v13 appliance packs VBEM onto Rocky Linux, ditching Windows/SQL complexity for a hardened, auto-updating Linux VM. Comes with a built-in immutability/RBAC security, as we will see shortly. Also supports SAML 2.0 SSO for portals, and REST API automation for DRaaS services. It supports thousands of VMs/jobs across sites while matching VBR’s PostgreSQL DB.

For the steps to create a VM on Promox and XCP-ng. Please see how to create a bootable USB on Mac: Proxmox VE Setup, how to set up the OOTBI Virtual Appliance on Proxmox VE, and the A-Z of XCP-ng and Xen Orchestra setup and VM Creation.

With the reference links, you should be able to provision a VM that will support VBEM installation in your environment. Since we are installing on XCP-ng, we will select “New VM” and populate the field as shown below.

Please, see Prevent Microsoft Teams from starting automatically on Windows, How to fix Wi-Fi not connecting on Windows 11, and How to add a new Domain Controller to an Existing Domain.

Deployment of Veeam Enterprise Manager

Before you install Veeam Software Appliance, review the known issues and limitations described in the release notes. It is also vital to take a look at the Help Centre as referenced above.

Next, download the latest version of the ISO file from the Product Downloads section of your Veeam account. Then, mount the ISO file to the machine where you plan to install Veeam Software Appliance or burn the ISO file to a flash drive or other removable storage device, as the case may be, for your installation.

For me, I am installing on a VM. Therefore, I will use the built-in tools of the virtualisation management software to mount the ISO file. These steps are well discussed here: “Building VIHR: Ransomware-Proof Repository with Veeam JeOS“.

In the installation menu, select Veeam Backup Enterprise Manager and press [Enter]

In the installation menu, select Install and press [Enter].

Select Yes to continue

As you can see, the installation is in progress.

Review and accept the terms of the EULA, and Veeam licensing policy, etc.

Set a hostname and click on next

Please, see Step-by-step guide on how to set up the Synology DS923+ NAS, and how to Upgrade Path and In-Place Upgrade for VBR v13 and Known Fixes

Set Static IP Address

Configure Static IP address parameters and apply

Click Next to proceed, as we have completed the network configuration as desired.

For the NTP server, you can change the Time Zone

Host Administrator Account Setup

At the Host Administrator step of the Initial Configuration wizard, configure the default host administrator account to perform administrative activities in the Host Management console. The username is “veeamadmin“, and do not forget to set the password.

Shortly, you will also do the same for the Security Officer (vveamso). Set the password as well and click next. When you logon to the Host Management Web Interface, that is when you will set the MFA.

Services are bing started as well.

After installation and initialization complete, the appliance displays links to the Host Management web UI on port 10443 on the splash screen as well as the Web UI for administration of VBEM.

Please, see how to upgrade PowerShell Core on Windows or Mac and Linux systems, how to create a two-way Active Directory Trust, and how to create a new Azure SQL Database [PaaS].

Access the VBEM

You can also use the VBEM Web UI, as shown below or the Veeam Host Management interface on port 10443.

We are right in the dashboard of the Veeam Enterprise Manager.

Please, see How to upgrade Veeam Backup and Replication 12.3, how to restore MSSQL Server on Azure VMs using Azure Backup, and MSSQL Server Error 833: Synthesis of Real-World Case Studies.

Access the Veeam Host Management Interface

You can also use the Web UI following by the port 10443 to access the Veeam Host Management interface.

Here, you can create a new user and assign a role as desired. I will be creating a new user as Christian

I will assign the role of a Host Admin as shown below.

You will be required to assign or enable MFA for this user. Otherwise, they will not be able to log in to the Host Management or VEM Web UI.

I have decided to disable MFA just to show you this behaviour.

As you can see, we have created a new user called Christian.

Here, you can perform the following operations when the user is selected, and you click on settings.

When you sign out and attempt to sign in with the veeamadmin. You will get the error message below: “Unable to sign in: user is not authorised for access. You have to change this password. Shortly, you will be prompted to enter a new password and click confirm.