Veeam Support Knowledge Base
How to register Veeam Data Cloud Vault in Veeam Backup for Microsoft Azure

How to register Veeam Data Cloud Vault in Veeam Backup for Microsoft Azure

KB ID:	4736
Product:	Veeam Backup & Replication \| 12.3.1 Veeam Backup for Microsoft Azure \| 8
Published:	2025-05-19
Last Modified:	2025-06-02

Cheers for trusting us with the spot in your mailbox!

Now you’re less likely to miss what’s been brewing in our knowledge base with this weekly digest

Oops! Something went wrong.

Please, try again later.

Article Applicability

This article documents a procedure for integrating Veeam Data Cloud Vault with Veeam Backup for Microsoft Azure.

This capability will be included natively in the next release of Veeam Backup for Microsoft Azure, and at that time, this article will then be retired.

Purpose

This article documents the procedure for registering Veeam Data Cloud Vault in Veeam Backup for Microsoft Azure.

Solution

Software Prerequisites

Veeam Backup & Replication v12.3.1
Veeam Backup for Microsoft Azure v8

Instructions

Part 1: Register Veeam Data Cloud Vault Repository

Register the Veeam Data Cloud Vault repository in Veeam Backup & Replication.
After registering Veeam Data Cloud Vault using Veeam Backup & Replication, navigate to the VDC Portal and select the "Allow from all networks" option for the registered Vault.

Part 2: Extract Veeam Data Cloud Vault Connection Details from Configuration Database

Expand the section below based on which SQL Database engine is used to host the Veeam Backup & Replication configuration database.
Hint: To identify which database engine is in use, use the PowerShell script from KB1471.

PostgreSQL

Download and install pgAdmin. https://www.pgadmin.org/download/
Connect to PostgreSQL instance hosting the Veeam Backup & Replication configuration database.
- Review the Identify Veeam Database Location section of KB1471 for information about identifying the PostgreSQL connection details.
- If you get the error "SSPI authentication failed for user" when connecting to the PostgreSQL instance, review KB4542.
After connecting, expand the tree and right-click on the VeeamBackup database, and from the context menu select Query Tool.
Run the following query:

SELECT
reps."name" as "repository_name",
creds."password" as "encrypted_certificate",
cloudcreds."options" as "account_settings"
FROM
"backuprepositories" reps
JOIN "credentials" creds ON creds."id" = reps."share_creds_id"
JOIN "credentials.cloud" cloudcreds ON cloudcreds."creds_id" = creds."id"
WHERE
reps."type" = 38
                
            

From the query results, copy the encrypted_certificate and account_settings values for the Veeam Data Cloud Vault repository to a notepad; you'll need these in the next steps.

Microsoft SQL Server

Download and install Microsoft SQL Server Management Studio.
https://learn.microsoft.com/en-us/ssms/download-sql-server-management-studio-ssms#download-ssms
Connect to the Microsoft SQL Server instance hosting the Veeam Backup & Replication configuration database.
- Review the Identify Veeam Database Location section of KB1471 for information about identifying the Microsoft SQL Server connection details.
After connecting, expand the tree and right-click on the VeeamBackup database, and from the context menu select New Query.
Run the following query:

SELECT
  reps.[name] as [repository_name],
  creds.[password] as [encrypted_certificate],
  cloudCreds.[options] as [account_settings]
FROM
  [dbo].[BackupRepositories] reps
  JOIN [dbo].[Credentials] creds ON creds.[id] = reps.[share_creds_id]
  JOIN [dbo].[Credentials.Cloud] cloudCreds ON cloudCreds.[creds_id] = creds.[id] 
WHERE
  reps.[type] = 38
                
            

From the query results, copy the encrypted_certificate and account_settings values for the Veeam Data Cloud Vault repository to a notepad; you'll need these in the next steps.

Part 3: Extract the Certificate Data from the Encrypted Value

Open Windows PowerShell ISE using the Run as administrator.
Start a new script, if a new one is not automatically opened, and paste in the following script:
Do not run the script yet.

# MANUAL ACTION REQUIRED:

    # Give us the hash from dbo.credentials
    $passwordFromDB = 'INPUT_DATA_HERE' 

# AUTOMATIC  

    Add-Type -AssemblyName System.Security 
    # Obtain salt
    $saltbase = (Get-ItemProperty -Path "HKLM:\SOFTWARE\Veeam\Veeam Backup and Replication\Data" -Name "EncryptionSalt").EncryptionSalt

    # Convert Base64 from DB to HEX
    $bytes = [System.Convert]::FromBase64String($passwordFromDB)
    $hex = New-Object -TypeName System.Text.StringBuilder -ArgumentList ($bytes.Length * 2)
    foreach ($byte in $bytes) {$hex.AppendFormat("{0:x2}", $byte) > $null}

    # Cut off first 75 characters (salt prefix)
    $hex = $hex.ToString().Substring(74,$hex.Length-74)

    # Convert back to Base64 without salt prefix
    $bytes = New-Object -TypeName byte[] -ArgumentList ($hex.Length / 2)
    for ($i = 0; $i -lt $hex.Length; $i += 2) {$bytes[$i / 2] = [System.Convert]::ToByte($hex.Substring($i, 2), 16)}
    $securedPassword = [System.Convert]::ToBase64String($bytes)

    # Finally, decode password 
    $data = [System.Convert]::FromBase64String($securedPassword) 
    $salt = [System.Convert]::FromBase64String($saltbase)

    $unprotect = [System.Security.Cryptography.ProtectedData]::Unprotect($data, $salt, [System.Security.Cryptography.DataProtectionScope]::LocalMachine) 
    $chars = [System.Text.Encoding]::UTF8.Getstring($unprotect) 
    $chars

                
            

On Line 4, replace the INPUT_DATA_HERE placeholder with the encrypted_certificate value copied from the configuration database in Step 7 (in Part 2).

Run the updated PowerShell script and save the output value of $chars to a file for use in the next steps.
Save the file with the extension .crt to make it easier to find in Step 13.

Part 4: Import the Certificate and Export PFX File

Open the Certificate Manager (certmgr.msc).
Expand the Personal node, right-click on Certificates, and select Import from the context menu under All Tasks.
- When prompted to specify the file to be imported, select the file created in Step 11.
  Depending on the file extension of the file created in Step 11, you may have to change the file extension filter in the file Open browser.
- On the Private key protection step, select the option Mark this key as exportable.
  The password field can be left empty.
After importing the certificate, right-click on the certificate and under All Tasks select Export.
- Select the option for Yes, export the private key.
- Choose AES256-SHA256 as the encryption and specify a password that will later be used in Veeam Backup for Microsoft Azure.
- Save it as a PFX file.

Part 5: Add the Service Account to Veeam Backup for Microsoft Azure

Add a new Service Account.

On the Type tab of the wizard, select Specify existing service account.

On the Login tab of the wizard:

Specify the Application ID and Tenant ID using the information within the account_settings value saved in Step 7 (in Part 2).
account_settings example:

<CloudCredentialsOptions>
  <AzureStorageAccountOptions>
    <TenantId>4eff6498-b64e-4bc5-9443-fa212bfdddfg</TenantId>
    <EnvironmentType>0</EnvironmentType>
    <ApplicationId>cabb0705-3ec3-430a-8c6b-9835e6e72c61/ApplicationId>
    <RegistrationMode>2</RegistrationMode>
    <CertificateSerialNumber>2EB6C292C71FF4AA4CB53A71BDE9109E</CertificateSerialNumber>
    <CredentialsType>2</CredentialsType>
    <TenantLicenses/>
  </AzureStorageAccountOptions>
</CloudCredentialsOptions>

Select the radio option for Certificate and provide the PFX file exported in Step 13.

On the Roles tab of the wizard, toggle the Enable granular role assignment, then click the link to Edit Roles.
- Check only Repository management.
- Uncheck all Operational roles.

Complete the Service Account creation wizard and use the newly registered Veeam Data Cloud Vault repository.

Note: The Permission check step of the wizard will fail with the error, "Your account is missing the required permissions." this is expected.

This is expected behavior and can be ignored.

Part 6: Add the Repository

After adding the storage account, create the Repository:
- Adding Backup Repositories Using Console
- Adding Backup Repositories Using Web UI

To submit feedback regarding this article, please click this link: Send Article Feedback
To report a typo on this page, highlight the typo with your mouse and press CTRL + Enter.

Spelling error in text

Thank you!

Your feedback has been received and will be reviewed.

Oops! Something went wrong.

Please, try again later.

You have selected too large block!

Please try select less.

KB Feedback/Suggestion

This form is only for KB Feedback/Suggestions, if you need help with the software open a support case

Product

Topic

Description

By submitting, you are agreeing to have your personal information managed in accordance with the terms of Veeam's Privacy Notice.

Verify your email to continue your product download

We've sent a verification code to:

An email with a verification code was just sent to

Didn't receive the code? Click to resend in sec

Didn't receive the code? Click to resend

Thank you!

Your feedback has been received and will be reviewed.

Oops! Something went wrong.

Please, try again later.