User rights for Metallic service account

Hi ​@Dennis ,

• A global administrator role is required for the initial setup and registration of a new Exchange Online app. Once the initial configuration is complete, Commvault no longer needs the global administrator permission to run backups.
  https://documentation.commvault.com/11.46/software/getting_started_with_exchange_online.html

Please refer to Arlie response below:

For Metallic Microsoft 365 backups, the service account does NOT require global admin rights after initial setup. You should assign only the minimum Azure AD roles necessary for each workload you want to protect. This follows the principle of least privilege and improves security.

Minimum Required Azure AD Roles per Workload:

• Exchange Online: Exchange Administrator or a custom role with the required permissions
• SharePoint Online: SharePoint Administrator
• OneDrive for Business: SharePoint Administrator
• Teams: Teams Administrator
• Azure Active Directory (for user/group discovery): Directory Reader

Best Practices:

• Remove global admin privileges from the backup service account after setup.
• Assign only the roles needed for the specific workloads you are protecting.
• Periodically audit service account permissions to maintain security compliance.
• Update role assignments if you add or remove workloads from protection.

Ongoing backup and restore operations will function as expected with these minimum roles. There is no need to retain global admin rights for the service account.

Documentation Links:

• Backup & Recovery for Microsoft 365
• Getting Started with Exchange Online
• Getting Started with SharePoint Online
• Getting Started with OneDrive for Business
• Getting Started with Teams
• Monitoring Backups for Microsoft 365

Thanks,

Abdu