TRY NOW
book meeting
BACK TO KB LIST

How to Configure HTTP Proxy for Veeam Service Provider Console 9.3+

KB ID: 4930
Product: Veeam Service Provider Console | 9.3
Published: 2026-09-18
Last Modified: 2026-09-18
mailbox
Get weekly article updates
By subscribing, you are agreeing to have your personal information managed in accordance with the terms of Veeam's Privacy Notice.

Cheers for trusting us with the spot in your mailbox!

Now you’re less likely to miss what’s been brewing in our knowledge base with this weekly digest

error icon

Oops! Something went wrong.

Please, try again later.

Purpose

This article explains how to configure an HTTP proxy for Veeam Service Provider Console 9.3 and later, which introduced a dedicated proxy configuration mechanism that is disabled by default and does not use the WinHTTP, Internet Options, or environment variable proxy settings described in KB4875.

If a proxy is required to reach the internet and this mechanism is not configured, product update, license auto-update, and single sign-on features fail. Typical entries appear in Server.log:

VeeamAutoLk>>AutoLkClient: Failed to get data from the AutoLk service ... A connection attempt failed ... (vac.butler.veeam.com:443)

Saml2IdentityProvider: Failed to retrieve data from 'https://login.microsoftonline.com/...' due network error. Exception: System.Net.WebException: The operation has timed out.

 

In versions prior to Veeam Service Provider Console 9.3, the software had no dedicated proxy setting and always used the .NET defaults: the HTTPS_PROXY/HTTP_PROXY environment variables first, then the Internet Options (WinINET) proxy of the service account, as described in KB4875.

Solution

Summary

Veeam Service Provider Console 9.3 introduced a central HttpClient configuration section. All HTTP clients created by the Veeam Service Provider Console Server, Web UI, REST API, and Management Agent read from it, and the default value of HttpClient_UseProxy is False. Until this key is set to True, every outbound connection is sent directly, regardless of OS-level proxy settings.

Configuration Key Reference

Key Type Default Description
HttpClient_UseProxy Boolean False

Master switch.

  • False: no proxy is used, and OS-level settings are ignored.
  • True: uses HttpClient_ProxyAddress if set, otherwise the OS proxy.
HttpClient_ProxyAddress String   Proxy URI, for example http://proxy.corp.example:8080
  • Empty: the OS proxy is used, as described in Option 2 below (see also KB4875).
  • Set: the proxy is configured directly in Veeam Service Provider Console, as described in Option 1 below.

The settings below apply only when HttpClient_ProxyAddress is set, and do not affect the legacy OS proxy settings (KB4875).
HttpClient_ProxyBypassOnLocal Boolean True Sends local destinations directly rather than through the proxy.
HttpClient_ProxyBypassList List
|-separated		   Regular expressions for additional destinations that bypass the proxy.
HttpClient_ProxyUsername String   Proxy user. Credentials are sent only when this is non-empty.
HttpClient_ProxyPassword String   Proxy password. Stored in clear text in the configuration file.
Swipe to show more of the table

Part 1: Identify Configuration File Location

The HttpClient_* keys are added to one of two JSON files, depending on which Veeam Service Provider Console component is being configured:

  • Veeam Service Provider Console Server, Web UI, and REST API:
    %ProgramData%\Veeam\Veeam Availability Console\Configuration\Service\configuration.overrides.json
  • Veeam Service Provider Console Management Agent:
    %ProgramData%\Veeam\Veeam Availability Console\Configuration\Agent\configuration.overrides.json

The same folder can also contain incremental configuration files named configuration.overrides.NNNNNNNN.json. Those files are generated and merged automatically, and should not be edited manually.

Part 2: Add the Keys to the Configuration File

Add the HttpClient_* keys to the GeneratedConfiguration object in the file identified above. Keep any existing keys already present in the file. Every value, including Boolean values, must be written as a quoted JSON string, for example "True", not true.

Option 1: Use Modern Built-In Proxy Client (Recommended)

This mode is recommended because it does not depend on Windows Internet Options, and unlike legacy proxy methods, it supports proxy authentication.

Configuration Example

{
  "GeneratedConfiguration": {
    "HttpClient_UseProxy": "True",
    "HttpClient_ProxyAddress": "http://proxy.domain.tld:8080",
    "HttpClient_ProxyBypassList": "^https?://[^/]+\\.domain\\.tld(:\\d+)?$|^https?://10\\."
  }
}
  • Important: an invalid HttpClient_ProxyAddress value makes every HTTP client creation fail, which breaks license auto-update, single sign-on, and other HTTP-based features until it is corrected.
  • HttpClient_ProxyBypassList is one string with entries separated by |, where each entry is a .NET regular expression matched against scheme://host. Remember to double the backslashes inside JSON.

Using Proxy Authentication

If the proxy requires authentication, add the username and password keys as well, for example:

{
  "GeneratedConfiguration": {
    "HttpClient_UseProxy": "True",
    "HttpClient_ProxyAddress": "http://proxy.domain.tld:8080",
    "HttpClient_ProxyUsername": "DOMAIN\\username",
    "HttpClient_ProxyPassword": "<password>"
  }
}
Credentials are sent when the proxy challenges the connection (Basic, Digest, NTLM, or Negotiate, depending on what the proxy offers). Because the password is stored in plaintext, customers are advised to restrict NTFS permissions on the Configuration folder, or use an unauthenticated proxy rule for the Veeam Service Provider Console server's IP address instead.
Option 2: Use Legacy OS Proxy Behavior

This mode makes Veeam Service Provider Console resolve the proxy the same way any .NET application does on Windows: the HTTPS_PROXY and HTTP_PROXY environment variables first, then the Internet Options (WinINET) proxy of the account running the service. See KB4875 for how to configure either of these. Note: The netsh winhttp proxy is never used by Veeam Service Provider Console.

Configuration Example

{
  "GeneratedConfiguration": {
    "HttpClient_UseProxy": "True"
  }
}

Part 3: Restart Services

The keys are read once at process start, so the running process will not pick up the edit until it restarts:

  • Veeam Service Provider Console Server, Web UI, and REST API: restart the Veeam Service Provider Console Server service and recycle the IIS application pools for the Web UI and RESTful APIs sites (or run iisreset).
  • Veeam Service Provider Console Management Agent: restart the Veeam Service Provider Console Management Agent service.

Part 4: Verify Functionality

Confirm the proxy is being used by checking the proxy's access logs for CONNECT requests from the Veeam Service Provider Console server, or by retrying the operation that previously failed, such as a license auto-update or single sign-on.

More Information

What This Affects

Once enabled, HttpClient_UseProxy covers:

  • Server: AutoLK/Butler license and update checks, license auto-update, plugin package downloads, support-bundle API calls, SAML 2.0 SSO metadata retrieval, and REST calls to managed Veeam Backup & Replication, Veeam Backup for Microsoft 365, and Veeam ONE servers.
  • Web UI and REST API: the same HTTP client traffic as the Server, since the Web UI reads the Server's configuration file.
  • Management Agent: REST calls to the managed products it monitors. Keep those products in the bypass list if the agent must also reach the internet, or their traffic is sent to the proxy too.

A few flows are not covered by HttpClient_UseProxy and continue to use the .NET defaults, that is, the OS proxy via environment variables or Internet Options as described in KB4875, regardless of this setting:

  • Download of Veeam Backup & Replication and Veeam ONE deployment answer files.
  • Upload of the support bundle to the pre-signed storage URL.
  • Time synchronization for TOTP multi-factor authentication.
  • Google OAuth client-secret validation for Veeam Backup for Google Cloud credentials in the Web UI.
  • Webhook alarm actions.

If this KB article did not resolve your issue or you need further assistance with Veeam software, please create a Veeam Support Case.

To submit feedback regarding this article, please click this link: Send Article Feedback
To report a typo on this page, highlight the typo with your mouse and press CTRL + Enter.

Spelling error in text

Thank you!

Thank you!

Your feedback has been received and will be reviewed.

Oops! Something went wrong.

Please, try again later.

You have selected too large block!

Please try select less.

KB Feedback/Suggestion

This form is only for KB Feedback/Suggestions, if you need help with the software open a support case
By submitting, you are agreeing to have your personal information managed in accordance with the terms of Veeam's Privacy Notice.
Verify your email to continue your product download
We've sent a verification code to:
  • Incorrect verification code. Please try again.
An email with a verification code was just sent to
Didn't receive the code? Click to resend in sec
Didn't receive the code? Click to resend
Start using Veeam:
Download the product
&
Activate the license key
Thank you!

Thank you!

Your feedback has been received and will be reviewed.

error icon

Oops! Something went wrong.

Please, try again later.