______ Article Applicability This article is specifically for Veeam Backup _for Microsoft Azure_ v8. With the release of**Veeam Backup _for Microsoft Azure_ v8.1**, the process for adding Veeam Data Cloud Vault as a repository has been fully integrated. ## Purpose This article documents the procedure for registering Veeam Data Cloud Vault in Veeam Backup _for Microsoft Azure_ version 8.0. ## Solution #### **Software Prerequisites** * Veeam Backup & Replication v12.3.1 * Veeam Backup _for Microsoft Azure_ v8 #### **Instructions** ##### **Part 1:** Register Veeam Data Cloud Vault Repository 1. Register the Veeam Data Cloud Vault repository in Veeam Backup & Replication. **Note:** When adding the repository, **_DO NOT_** enable the option "Enable manual credentials input wizard mode (advanced)." _The repository** _must_ **be added using the Authorize... link on the Account tab to ensure the connection details are correctly added to the Configuration Database and can be queried in later steps of this procedure._ 2. After registering Veeam Data Cloud Vault using Veeam Backup & Replication, navigate to the VDC Portal and select the "**Allow from all networks**" option for the registered Vault. ![Allow from all networks](https://cdn.veeam.com/content/veeam/en/knowledge-base/kb4736/_jcr_content/content-parsys/section-main/section-with-background-content/section-sections/section-with-background-content/section_with_backgro_solution/section-with-background-content/image_2017523588/file.web.ntfile.png/AllowAll.png?ck=1747323380936) #### **Part 2:** Extract Veeam Data Cloud Vault Connection Details from Configuration Database _Expand_ the section below based on which SQL Database engine is used to host the Veeam Backup & Replication configuration database. **Hint:** To identify which database engine is in use, use the PowerShell script from KB1471. PostgreSQL 3. Download and install pgAdmin. https://www.pgadmin.org/download/ 4. Connect to PostgreSQL instance hosting the Veeam Backup & Replication configuration database. * Review the **Identify Veeam Database Location** section of KB1471 for information about identifying the PostgreSQL connection details. * If you get the error "SSPI authentication failed for user" when connecting to the PostgreSQL instance, review KB4542. 5. After connecting, expand the tree and right-click on the VeeamBackup database, and from the context menu select **Query Tool**. 6. Run the following query: SELECT reps."name" as "repository_name", creds."password" as "encrypted_certificate", cloudcreds."options" as "account_settings" FROM "backuprepositories" reps JOIN "credentials" creds ON creds."id" = reps."share_creds_id" JOIN "credentials.cloud" cloudcreds ON cloudcreds."creds_id" = creds."id" WHERE reps."type" = 38 Copy 7. From the query results, copy the **encrypted_certificate** and **account_settings** values for the Veeam Data Cloud Vault repository to a notepad; you'll need these in the next steps. ![database data](https://cdn.veeam.com/content/veeam/en/knowledge-base/kb4736/_jcr_content/content-parsys/section-main/section-with-background-content/section-sections/section-with-background-content/section_with_backgro_solution/section-with-background-content/expander/expander-content/image_copy/file.web.ntfile.png/PGSQLExtract.png?ck=1747326581742) Microsoft SQL Server 3. Download and install Microsoft SQL Server Management Studio. https://learn.microsoft.com/en-us/ssms/download-sql-server-management-studio-ssms#download-ssms 4. Connect to the Microsoft SQL Server instance hosting the Veeam Backup & Replication configuration database. * Review the **Identify Veeam Database Location** section of KB1471 for information about identifying the Microsoft SQL Server connection details. 5. After connecting, expand the tree and right-click on the VeeamBackup database, and from the context menu select **New Query**. 6. Run the following query: SELECT reps.[name] as [repository_name], creds.[password] as [encrypted_certificate], cloudCreds.[options] as [account_settings] FROM [dbo].[BackupRepositories] reps JOIN [dbo].[Credentials] creds ON creds.[id] = reps.[share_creds_id] JOIN [dbo].[Credentials.Cloud] cloudCreds ON cloudCreds.[creds_id] = creds.[id] WHERE reps.[type] = 38 Copy 7. From the query results, copy the **encrypted_certificate** and **account_settings** values for the Veeam Data Cloud Vault repository to a notepad; you'll need these in the next steps. ![database data](https://cdn.veeam.com/content/veeam/en/knowledge-base/kb4736/_jcr_content/content-parsys/section-main/section-with-background-content/section-sections/section-with-background-content/section_with_backgro_solution/section-with-background-content/expander_713577993/expander-content/image_copy/file.web.ntfile.png/SQLExtract.png?ck=1747329761878) ##### **Part 3:** Extract the Certificate Data from the Encrypted Value 8. Open**Windows PowerShell ISE** using the _Run as administrator_. 9. Start a new script, if a new one is not automatically opened, and paste in the following script: _Do not run the script yet._ # MANUAL ACTION REQUIRED: # Give us the hash from dbo.credentials $passwordFromDB = 'INPUT_DATA_HERE' # AUTOMATIC Add-Type -AssemblyName System.Security # Obtain salt $saltbase = (Get-ItemProperty -Path "HKLM:\SOFTWARE\Veeam\Veeam Backup and Replication\Data" -Name "EncryptionSalt").EncryptionSalt # Convert Base64 from DB to HEX $bytes = [System.Convert]::FromBase64String($passwordFromDB) $hex = New-Object -TypeName System.Text.StringBuilder -ArgumentList ($bytes.Length * 2) foreach ($byte in $bytes) {$hex.AppendFormat("{0:x2}", $byte) > $null} # Cut off first 75 characters (salt prefix) $hex = $hex.ToString().Substring(74,$hex.Length-74) # Convert back to Base64 without salt prefix $bytes = New-Object -TypeName byte[] -ArgumentList ($hex.Length / 2) for ($i = 0; $i -lt $hex.Length; $i += 2) {$bytes[$i / 2] = [System.Convert]::ToByte($hex.Substring($i, 2), 16)} $securedPassword = [System.Convert]::ToBase64String($bytes) # Finally, decode password $data = [System.Convert]::FromBase64String($securedPassword) $salt = [System.Convert]::FromBase64String($saltbase) $unprotect = [System.Security.Cryptography.ProtectedData]::Unprotect($data, $salt, [System.Security.Cryptography.DataProtectionScope]::LocalMachine) $chars = [System.Text.Encoding]::UTF8.Getstring($unprotect) $chars Copy 10. On **Line 4,** replace the `INPUT_DATA_HERE` placeholder with the `**encrypted_certificate**` value copied from the configuration database in Step 7 (in Part 2). ![encrypted_cert](https://cdn.veeam.com/content/veeam/en/knowledge-base/kb4736/_jcr_content/content-parsys/section-main/section-with-background-content/section-sections/section-with-background-content/section_with_backgro_solution/section-with-background-content/image_1859798433/file.web.ntfile.png/Step9%20$2$.png?ck=1746631925649) 11. Run the updated PowerShell script and save the output value of $chars to a file for use in the next steps. _Save the file with the extension .crt to make it easier to find in Step 13._ ![chars](https://cdn.veeam.com/content/veeam/en/knowledge-base/kb4736/_jcr_content/content-parsys/section-main/section-with-background-content/section-sections/section-with-background-content/section_with_backgro_solution/section-with-background-content/image_1589097818/file.web.ntfile.png/Step9.png?ck=1746631963630) #### **Part 4:** Import the Certificate and Export PFX File 12. Open the **Certificate Manager** (certmgr.msc). 13. Expand the **Personal** node, right-click on **Certificates** , and select **Import** from the context menu under **All Tasks**. * When prompted to specify the file to be imported, select the file created in Step 11. _Depending on the file extension of the file created in Step 11, you may have to change the file extension filter in the file Open browser._ * On the **Private key protection** step, select the option **Mark this key as exportable**. _The password field can be left empty._ 14. After importing the certificate, right-click on the certificate and under **All Tasks** select **Export**. * Select the option for **Yes, export the private key**. * Choose **AES256-SHA256** as the encryption and specify a password that will later be used in Veeam Backup _for Microsoft Azure_. * Save it as a **PFX** file. ![export](https://cdn.veeam.com/content/veeam/en/knowledge-base/kb4736/_jcr_content/content-parsys/section-main/section-with-background-content/section-sections/section-with-background-content/section_with_backgro_solution/section-with-background-content/image_1763524083/file.web.ntfile.jpeg/Step13.jpg?ck=1746631989211) #### **Part 5:** Add the Service Account to Veeam Backup _for Microsoft Azure_ 15. Log in to **Veeam Backup _for Microsoft Azure_**. 16. Add a new **Service Account**. 1. On the **Type** tab of the wizard, select **Specify existing service account**. 2. On the **Login** tab of the wizard: * Specify the **Application ID** and **Tenant ID** using the information within the **account_settings** value saved in Step 7 (in Part 2). account_settings example: <**TenantId** >**4eff6498-b64e-4bc5-9443-fa212bfdddfg** 0 <**ApplicationId** >**cabb0705-3ec3-430a-8c6b-9835e6e72c61** /ApplicationId> 2 2EB6C292C71FF4AA4CB53A71BDE9109E 2 * Select the radio option for **Certificate** and provide the PFX file exported in Step 13. 17. On the **Roles** tab of the wizard, toggle the **Enable granular role assignment** , then click the link to **Edit Roles**. * Check only **Repository management**. * Uncheck all **Operational roles**. ![Roles](https://cdn.veeam.com/content/veeam/en/knowledge-base/kb4736/_jcr_content/content-parsys/section-main/section-with-background-content/section-sections/section-with-background-content/section_with_backgro_solution/section-with-background-content/image_1168987479/file.web.ntfile.png/Roles.png?ck=1747324995633) 18. Complete the**Service Account** creation wizard and use the newly registered Veeam Data Cloud Vault repository. ** Note:** The Permission check step of the wizard will fail with the error, "**Your account is missing the required permissions.** " this is **_expected_**. ![Expected Error](https://cdn.veeam.com/content/veeam/en/knowledge-base/kb4736/_jcr_content/content-parsys/section-main/section-with-background-content/section-sections/section-with-background-content/section_with_backgro_solution/section-with-background-content/image/file.web.ntfile.png/Permissions%20Check%20Fail.png?ck=1747324276934) _**This is expected behavior and can be ignored.**_ #### **Part 6:** Add the Repository 19. After adding the storage account, create the Repository: * Adding Backup Repositories Using Console * Adding Backup Repositories Using Web UI If this KB article did not resolve your issue or you need further assistance with Veeam software, please create a Veeam Support Case. To submit feedback regarding this article, please click this link: Send Article Feedback To report a typo on this page, highlight the typo with your mouse and press CTRL + Enter.