You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/backup/multi-user-authorization.md
-12Lines changed: 0 additions & 12 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -158,9 +158,6 @@ Now that the Backup admin has the Reader role on the Resource Guard, they can ea
158
158
159
159
1. Go to the Recovery Services vault. Navigate to **Properties** on the left navigation panel, then to **Multi-User Authorization** and click **Update**.
160
160
161
-
:::image type="content" source="./media/multi-user-authorization/testvault-properties.png" alt-text="Screenshot showing the recovery services vault-properties.":::
162
-
163
-
164
161
1. Now you are presented with the option to enable MUA and choose a Resource Guard using one of the following ways:
165
162
166
163
1. You can either specify the URI of the Resource Guard, make sure you specify the URI of a Resource Guard you have **Reader** access to and that is the same regions as the vault. You can find the URI (Resource Guard ID) of the Resource Guard in its **Overview** screen:
@@ -194,9 +191,6 @@ Depicted below is an illustration of what happens when the Backup admin tries to
194
191
1. Select the directory containing the Resource Guard and Authenticate yourself. This step may not be required if the Resource Guard is in the same directory as the vault.
195
192
1. Proceed to click **Save**. The request fails with an error informing them about not having sufficient permissions on the Resource Guard to let you perform this operation.
196
193
197
-
:::image type="content" source="./media/multi-user-authorization/testvault-properties-security-settings-inline.png" alt-text="Screenshot showing the TestVault1 properties-security settings." lightbox="./media/multi-user-authorization/testvault-properties-security-settings-expanded.png":::
198
-
199
-
200
194
## Authorize critical (protected) operations using Azure AD Privileged Identity Management
201
195
202
196
The following sub-sections discuss authorizing these requests using PIM. There are cases where you may need to perform critical operations on your backups and MUA can help you ensure that these are performed only when the right approvals or permissions exist. As discussed earlier, the Backup admin needs to have a Contributor role on the Resource Guard to perform critical operations that are in the Resource Guard scope. One of the ways to allow just-in-time for such operations is through the use of [Azure Active Directory (Azure AD) Privileged Identity Management](/azure/active-directory/privileged-identity-management/pim-configure).
@@ -278,11 +272,6 @@ Once the Backup admin’s request for the Contributor role on the Resource Guard
278
272
>[!NOTE]
279
273
> If the access was assigned using a JIT mechanism, the Contributor role is retracted at the end of the approved period. Else, the Security admin manually removes the **Contributor** role assigned to the Backup admin to perform the critical operation.
280
274
281
-
Following screenshot shows an example of disabling soft delete for an MUA-enabled vault.
282
-
283
-
:::image type="content" source="./media/multi-user-authorization/disable-soft-delete-inline.png" alt-text="Screenshot showing to disable soft delete." lightbox="./media/multi-user-authorization/disable-soft-delete-expanded.png":::
284
-
285
-
286
275
## Disable MUA on a Recovery Services vault
287
276
288
277
Disabling MUA is a protected operation, and hence, is protected using MUA. This means that the Backup admin must have the required Contributor role in the Resource Guard. Details on obtaining this role are described here. Following is a summary of steps to disable MUA on a vault.
@@ -294,4 +283,3 @@ Disabling MUA is a protected operation, and hence, is protected using MUA. This
294
283
1. Choose the Directory that contains the Resource Guard and verify access using the Authenticate button (if applicable).
295
284
1. After **authentication**, click **Save**. With the right access, the request should be successfully completed.
296
285
297
-
:::image type="content" source="./media/multi-user-authorization/disable-mua.png" alt-text="Screenshot showing to disable multi-user authentication.":::
0 commit comments