#1 Global Leader in Data Resilience
#1 Global Leader in Data Resilience
TRY NOW
book meeting
BACK TO KB LIST

How to register Veeam Data Cloud Vault in Veeam Backup for Microsoft Azure

KB ID: 4736
Product: Veeam Backup & Replication | 12.3.1
Veeam Backup for Microsoft Azure | 8
Published: 2025-05-19
Last Modified: 2025-09-23
mailbox
Get weekly article updates
By subscribing, you are agreeing to have your personal information managed in accordance with the terms of Veeam's Privacy Notice.

Cheers for trusting us with the spot in your mailbox!

Now you’re less likely to miss what’s been brewing in our knowledge base with this weekly digest

error icon

Oops! Something went wrong.

Please, try again later.

Article Applicability

This article is specifically for Veeam Backup for Microsoft Azure v8.

With the release of Veeam Backup for Microsoft Azure v8.1, the process for adding Veeam Data Cloud Vault as a repository has been fully integrated.

Purpose

This article documents the procedure for registering Veeam Data Cloud Vault in Veeam Backup for Microsoft Azure version 8.0.

Solution

Software Prerequisites

  • Veeam Backup & Replication v12.3.1
  • Veeam Backup for Microsoft Azure v8

Instructions

Part 1: Register Veeam Data Cloud Vault Repository
  1. Register the Veeam Data Cloud Vault repository in Veeam Backup & Replication.

    Note: When adding the repository, DO NOT enable the option "Enable manual credentials input wizard mode (advanced)."
    The repository must be added using the Authorize... link on the Account tab to ensure the connection details are correctly added to the Configuration Database and can be queried in later steps of this procedure.
  2. After registering Veeam Data Cloud Vault using Veeam Backup & Replication, navigate to the VDC Portal and select the "Allow from all networks" option for the registered Vault.
Allow from all networks

Part 2: Extract Veeam Data Cloud Vault Connection Details from Configuration Database

Expand the section below based on which SQL Database engine is used to host the Veeam Backup & Replication configuration database.
Hint: To identify which database engine is in use, use the PowerShell script from KB1471.

PostgreSQL
  1. Download and install pgAdmin. https://www.pgadmin.org/download/
  2. Connect to PostgreSQL instance hosting the Veeam Backup & Replication configuration database.
  3. After connecting, expand the tree and right-click on the VeeamBackup database, and from the context menu select Query Tool.
  4. Run the following query:
SELECT
reps."name" as "repository_name",
creds."password" as "encrypted_certificate",
cloudcreds."options" as "account_settings"
FROM
"backuprepositories" reps
JOIN "credentials" creds ON creds."id" = reps."share_creds_id"
JOIN "credentials.cloud" cloudcreds ON cloudcreds."creds_id" = creds."id"
WHERE
reps."type" = 38
  1. From the query results, copy the encrypted_certificate and account_settings values for the Veeam Data Cloud Vault repository to a notepad; you'll need these in the next steps.
database data
Microsoft SQL Server
  1. Download and install Microsoft SQL Server Management Studio. 
    https://learn.microsoft.com/en-us/ssms/download-sql-server-management-studio-ssms#download-ssms
  2. Connect to the Microsoft SQL Server instance hosting the Veeam Backup & Replication configuration database.
  3. After connecting, expand the tree and right-click on the VeeamBackup database, and from the context menu select New Query.
  4. Run the following query:
SELECT
  reps.[name] as [repository_name],
  creds.[password] as [encrypted_certificate],
  cloudCreds.[options] as [account_settings]
FROM
  [dbo].[BackupRepositories] reps
  JOIN [dbo].[Credentials] creds ON creds.[id] = reps.[share_creds_id]
  JOIN [dbo].[Credentials.Cloud] cloudCreds ON cloudCreds.[creds_id] = creds.[id] 
WHERE
  reps.[type] = 38
  1. From the query results, copy the encrypted_certificate and account_settings values for the Veeam Data Cloud Vault repository to a notepad; you'll need these in the next steps.
database data
Part 3: Extract the Certificate Data from the Encrypted Value
  1. Open Windows PowerShell ISE using the Run as administrator.
  2. Start a new script, if a new one is not automatically opened, and paste in the following script:
    Do not run the script yet.
# MANUAL ACTION REQUIRED:

    # Give us the hash from dbo.credentials
    $passwordFromDB = 'INPUT_DATA_HERE' 

# AUTOMATIC  

    Add-Type -AssemblyName System.Security 
    # Obtain salt
    $saltbase = (Get-ItemProperty -Path "HKLM:\SOFTWARE\Veeam\Veeam Backup and Replication\Data" -Name "EncryptionSalt").EncryptionSalt

    # Convert Base64 from DB to HEX
    $bytes = [System.Convert]::FromBase64String($passwordFromDB)
    $hex = New-Object -TypeName System.Text.StringBuilder -ArgumentList ($bytes.Length * 2)
    foreach ($byte in $bytes) {$hex.AppendFormat("{0:x2}", $byte) > $null}

    # Cut off first 75 characters (salt prefix)
    $hex = $hex.ToString().Substring(74,$hex.Length-74)

    # Convert back to Base64 without salt prefix
    $bytes = New-Object -TypeName byte[] -ArgumentList ($hex.Length / 2)
    for ($i = 0; $i -lt $hex.Length; $i += 2) {$bytes[$i / 2] = [System.Convert]::ToByte($hex.Substring($i, 2), 16)}
    $securedPassword = [System.Convert]::ToBase64String($bytes)

    # Finally, decode password 
    $data = [System.Convert]::FromBase64String($securedPassword) 
    $salt = [System.Convert]::FromBase64String($saltbase)

    $unprotect = [System.Security.Cryptography.ProtectedData]::Unprotect($data, $salt, [System.Security.Cryptography.DataProtectionScope]::LocalMachine) 
    $chars = [System.Text.Encoding]::UTF8.Getstring($unprotect) 
    $chars
  1. On Line 4, replace the INPUT_DATA_HERE placeholder with the encrypted_certificate value copied from the configuration database in Step 7 (in Part 2).
encrypted_cert
  1. Run the updated PowerShell script and save the output value of $chars to a file for use in the next steps.
    Save the file with the extension .crt to make it easier to find in Step 13.
chars

Part 4: Import the Certificate and Export PFX File

  1. Open the Certificate Manager (certmgr.msc).
  2. Expand the Personal node, right-click on Certificates, and select Import from the context menu under All Tasks.
    • When prompted to specify the file to be imported, select the file created in Step 11.
      Depending on the file extension of the file created in Step 11, you may have to change the file extension filter in the file Open browser.
    • On the Private key protection step, select the option Mark this key as exportable.
      The password field can be left empty.
  3. After importing the certificate, right-click on the certificate and under All Tasks select Export.
    • Select the option for Yes, export the private key.
    • Choose AES256-SHA256 as the encryption and specify a password that will later be used in Veeam Backup for Microsoft Azure.
    • Save it as a PFX file.
export

Part 5: Add the Service Account to Veeam Backup for Microsoft Azure

  1. Log in to Veeam Backup for Microsoft Azure.
  2. Add a new Service Account.
    1. On the Type tab of the wizard, select Specify existing service account.
    2. On the Login tab of the wizard:
      • Specify the Application ID and Tenant ID using the information within the account_settings value saved in Step 7 (in Part 2).
        account_settings example: 
        <CloudCredentialsOptions>
  <AzureStorageAccountOptions>
    <TenantId>4eff6498-b64e-4bc5-9443-fa212bfdddfg</TenantId>
    <EnvironmentType>0</EnvironmentType>
    <ApplicationId>cabb0705-3ec3-430a-8c6b-9835e6e72c61/ApplicationId>
    <RegistrationMode>2</RegistrationMode>
    <CertificateSerialNumber>2EB6C292C71FF4AA4CB53A71BDE9109E</CertificateSerialNumber>
    <CredentialsType>2</CredentialsType>
    <TenantLicenses/>
  </AzureStorageAccountOptions>
</CloudCredentialsOptions>
      • Select the radio option for Certificate and provide the PFX file exported in Step 13.
  3. On the Roles tab of the wizard, toggle the Enable granular role assignment, then click the link to Edit Roles.
    • Check only Repository management.
    • Uncheck all Operational roles.
Roles
  1. Complete the Service Account creation wizard and use the newly registered Veeam Data Cloud Vault repository.

    Note:     The Permission check step of the wizard will fail with the error, "Your account is missing the required permissions." this is expected.
Expected Error
This is expected behavior and can be ignored.

Part 6: Add the Repository

  1. After adding the storage account, create the Repository:

If this KB article did not resolve your issue or you need further assistance with Veeam software, please create a Veeam Support Case.

To submit feedback regarding this article, please click this link: Send Article Feedback
To report a typo on this page, highlight the typo with your mouse and press CTRL + Enter.

Spelling error in text

Thank you!

Thank you!

Your feedback has been received and will be reviewed.

Oops! Something went wrong.

Please, try again later.

You have selected too large block!

Please try select less.

KB Feedback/Suggestion

This form is only for KB Feedback/Suggestions, if you need help with the software open a support case
By submitting, you are agreeing to have your personal information managed in accordance with the terms of Veeam's Privacy Notice.
Verify your email to continue your product download
We've sent a verification code to:
  • Incorrect verification code. Please try again.
An email with a verification code was just sent to
Didn't receive the code? Click to resend in sec
Didn't receive the code? Click to resend
Start using Veeam:
Download the product
&
Activate the license key
Thank you!

Thank you!

Your feedback has been received and will be reviewed.

error icon

Oops! Something went wrong.

Please, try again later.