TRY NOW
book meeting
BACK TO KB LIST

Sign-In Error After Migrating Configuration From MFA-Enabled Server

KB ID: 4898
Product: Veeam Backup & Replication | 13 | 13.1
Published: 2026-08-10
Last Modified: 2026-08-10
mailbox
Get weekly article updates
By subscribing, you are agreeing to have your personal information managed in accordance with the terms of Veeam's Privacy Notice.

Cheers for trusting us with the spot in your mailbox!

Now you’re less likely to miss what’s been brewing in our knowledge base with this weekly digest

error icon

Oops! Something went wrong.

Please, try again later.

Challenge

After performing Configuration Restore using the Migration mode from a Configuration Backup created by a Veeam Backup & Replication server that had MFA enabled, login attempts using local accounts cause the Veeam Backup & Replication Console to display the error:

Unable to sign in: user is not authorized for access.
Veeam Backup & Replication Console showing error "Unable to sign in: user is not authorized for access."
While this issue will always occur when migrating between machines, it is more noticeable when migrating from a domain-joined machine to a non-domain-joined machine due to only being able to use local accounts to sign in via the Veeam Backup & Replication Console.

Cause

This issue occurs because the local account being used to log in has no Role assigned within the migrated Configuration Database and therefore has no access. The user accounts, their respective roles, and MFA data are stored within the Configuration Database using the user account's SID. While the local account names between the two machines may be the same, the SID is different and is therefore treated as a user that was never assigned a role.

Note: This same issue will impact domain accounts when migrating the configuration to a machine in a different domain that uses the same domain account names as the initial domain to which the original machine was connected.

Solution

Scenario 1: Migrating to a Machine Joined to the Same Domain

If the configuration was migrated to a machine joined to the same domain as the original Veeam Backup Server:

  1. Sign in to the Veeam Backup & Replication Console using a domain account that was assigned a Veeam Backup Administrator role.
  2. Remove the local accounts associated with the old machine from the Users and Roles panel
  3. (Optional) Add local accounts from the new machine as needed.

Scenario 2: Migrating to a Machine That Is Not in a Domain or Joined to a Different Domain

If the configuration migration was to a machine that is not in a domain or is joined to a different domain than the original Veeam Backup Server, perform the following steps to assign the Veeam Backup Administrator role to the local machine's Administrators user group.

Explanation: On all default deployments, the Administrators user group is assigned the Backup Administrator role. However, when enabling MFA, users are notified to remove all security groups, which results in the Administrators group being removed. After the configuration is restored to the new machine, MFA will be disabled, meaning user groups can be added, but without access to the Veeam Backup & Replication Console the user group must be added via a direct configuration database modification.

  1. Use the query below to modify the configuration database, assigning the Backup Administrator role to the Administrators user group:
    KB1443: How to apply a SQL script to Veeam Backup & Replication/Veeam Backup Enterprise Manager Database

For Microsoft SQL:

INSERT INTO [dbo].[Backup.Security.RoleAccounts] ([id], [role_id], [account_id])
VALUES (NEWID(), '5FF0E0EB-45CF-48CC-9677-7613FC79BC11', '38E4B8DF-65B5-4D3C-9A26-86F9142AE26F');
For PostgreSQL: 
INSERT INTO public."backup.security.roleaccounts" (id, role_id, account_id)
VALUES (gen_random_uuid(), '5ff0e0eb-45cf-48cc-9677-7613fc79bc11', '38e4b8df-65b5-4d3c-9a26-86f9142ae26f');
  1. Sign in to the Veeam Backup & Replication Console using an account that is a member of the local Administrators group.
  2. Open the Users and Roles Security panel.
  3. Remove Users associated with the old Veeam Backup Server or domain that the machine previously connected to.
  4. Add accounts as needed and assign their roles.
  5. If MFA will be enabled again, the BUILTIN\Administrators group must first be removed from the Users and Roles panel. Before removing the group, confirm that the Backup Administrator role has been assigned to at least one account that is accessible.
    Note: Each added account must perform the initial MFA setup steps on the next login.

If this KB article did not resolve your issue or you need further assistance with Veeam software, please create a Veeam Support Case.

To submit feedback regarding this article, please click this link: Send Article Feedback
To report a typo on this page, highlight the typo with your mouse and press CTRL + Enter.

Spelling error in text

Thank you!

Thank you!

Your feedback has been received and will be reviewed.

Oops! Something went wrong.

Please, try again later.

You have selected too large block!

Please try select less.

KB Feedback/Suggestion

This form is only for KB Feedback/Suggestions, if you need help with the software open a support case
By submitting, you are agreeing to have your personal information managed in accordance with the terms of Veeam's Privacy Notice.
Verify your email to continue your product download
We've sent a verification code to:
  • Incorrect verification code. Please try again.
An email with a verification code was just sent to
Didn't receive the code? Click to resend in sec
Didn't receive the code? Click to resend
Start using Veeam:
Download the product
&
Activate the license key
Thank you!

Thank you!

Your feedback has been received and will be reviewed.

error icon

Oops! Something went wrong.

Please, try again later.