TERRA CLOUD Veeam Data Protection/en

Introduction

Product presentation TERRA CLOUD Veeam Data Protection

TERRA CLOUD Veeam Data Protection is a data backup platform from TERRA CLOUD powered by Veeam.
At the heart of this platform is the multi-tenant portal protection.terracloud.de, which grants you access to various backup products from Veeam.

What possibilities does the TERRA CLOUD Veeam Data Protection platform offer?

1. A Software-as-a-Service backup solution for Microsoft 365, fully hosted in the TERRA CLOUD (Hüllhorst location)
2. Licensing and centralized management of, for example, Veeam Backup & Replication Servers or Veeam Agents *NEW*

Facility

Network Configuration

Port Overview TERRA CLOUD Veeam Data Protection

Protocol	Port	Source	Destination	Function	Note
HTTPS	443	Browser	protection.terracloud.de	TERRA CLOUD Veeam Data Protection Management Portal	185.35.13.60
HTTPS	4443	Browser	Veeam Backup for Microsoft 365 Restore Portal	Restore from Microsoft 365 Backup	185.35.13.240/28
TCP	6180	Management Agent	Cloud Gateways	Management of Veeam Backup Servers and Agents	185.35.13.224/28

Setup process overview

Setting up data backup consists of four steps in total, with steps 2-4 being repeated for each end customer.

Deployment of the TERRA CLOUD Veeam Data Protection Platform

You can have your TERRA CLOUD Veeam Data Protection Platform created with a one-time order in the TERRA CLOUD Center.
Upon completion of the deployment, you will receive a confirmation email. Your initial login credentials will be displayed in the TERRA CLOUD Technical Center.
Further setup of your customers and data backups is done in the technical administration portal protection.terracloud.de.

Establishment of the portal "protection.terracloud.de"

First login and change of initial access data

First Login:
After the setup is complete, you will receive a confirmation email.
You can retrieve your initial login credentials for protection.terracloud.de via the Technical Center.
Note: Access to the login credentials requires the user role "Reseller Admin".

The login is structured as follows:
(Wortmann Customer Number)\(Wortmann Customer Number-Administrator)
Example:
111490\111490-Administrator

Change of the Initial access data and multi-factor authentication:
After your first login, we recommend the following adjustments to your initial administrator access (Service Provider Global Administrator):

1. Change your password
2. Activate and configure multi-factor authentication
3. Verify the registered email address (using the "Forgot password" function)

Editing a User

Option 1:
Please go to Settings via the gear icon "Configuration" in the upper right corner.
In the "Roles & Users" section, select the Service Provider Global Administrator using the checkbox and edit it using the pencil icon.

Option 2:
The currently logged-in user can also be edited via the drop-down menu next to the username.

Administrator Profile Adjustment:
Please assign a new password for this Service Provider Global Administrator user.
Check the email address in the "User Info" section; this is required for the "Forgot Password" function.
The default email address is the Cloud Master Account address. Change the address listed there if necessary.

We recommend enabling multi-factor authentication for all users in the Protection Portal.

Further configuration will be completed upon your next login.
In the final step, you will receive a summary of the configured changes.

Configure email notifications

Please follow these steps to configure email notifications:

1. Configuring the TERRA CLOUD SMTP Server
Please open the portal settings via the "Configuration" gear icon and select "Server Settings".
Enter "mail.protection.terracloud.de" for the SMTP server and set the "Encryption protocol" to "None".
Since this SMTP server is located within the management infrastructure, encryption up to the SMTP server is not required.
Outgoing emails are encrypted if the receiving mail server requests it.

2. Setting up notifications
First, change the "Default sender" to "no-reply@protection.terracloud.de".
Choose whether you want to be notified of every event or only receive summaries.
In the "Alarms" section, re-enter the sender address and the desired recipient address.
The "Discovery Rules" and "Billing" sections are not needed.

Configuration of Alarm Management

The Protection Portal offers its own monitoring function, which can be configured in the "Configuration --> Templates --> Predefined Alarms" section.

Disabling the "Managed tenants quota" alarm

Please enter "Managed tenants quota" in the search bar and disable this alarm.
TERRA CLOUD uses the Company Quota function to manage the provisioning of end customers via the TERRA CLOUD Technical Center.
For this purpose, the quota is set to the current number of managed end customers and only increased by 1 when a new end customer is automatically provisioned.
This automation incorrectly triggers the "Managed tenants quota" alarm, which should be disabled beforehand.

Email notification when a Managed tenants quota alarm is triggered.
If the alarm has not yet been disabled, the following message will be displayed in the Protection Portal and/or sent to you by email.

Create and link end customers

General:
In the Protection Portal, end-customer organizations are represented by a "Company." Your "Reseller" organization can manage any number of companies and thus end customers.
Companies can only be created automatically via the TERRA CLOUD Technical Center and not manually in the Protection Portal.
This enables the clear assignment of TERRA CLOUD Veeam Data Protection usage data to an end customer from the TERRA CLOUD Center/Technical Center.

Deploy TERRA CLOUD Veeam Data Protection for an end customer

1. Please navigate to the "Customer Management" section in the TERRA CLOUD Technical Center
2. Select the desired end customer and go to the "SERVICE SETTINGS" tab
3. Start the deployment by clicking "CREATE AND LINK END CUSTOMER" (see screenshot below)

The automated deployment performs the following steps in the background:

1. Create a company based on the end customer information from the Technical Center
2. Assign your resources for data backup (Veeam Backup for M365 Server and Repository)
3. Create a user account for the company

After successful completion, the created user account and a green check mark will be displayed.
The The displayed user access is a default of the Veeam Service Provider Console and is not required for setting up and managing data backups.
This provides insight into the data backup configuration within the company.

Microsoft 365 Backup

Setting up a Microsoft 365 data backup

Setting up data backup for the Wortmann partner's Microsoft 365 organization

During the initial deployment of the TERRA CLOUD Veeam Data Protection platform, a company is automatically created for the Wortmann partner's company.
If you want to back up your own Microsoft 365 organization, you can skip the step Create and link end customers, as the company has already been created.
Please start directly with the step Setting up a Microsoft 365 data backup.

Connect and link Microsoft 365 organizations

Prerequisite:

• This guide assumes that you have already linked your end customer to the Protection Portal via the Technical Center.

Step 1:
To configure data protection, please switch to the Protection Portal.
The link between a created Company (End Customer) and a Microsoft 365 tenant can be configured within the "Veeam Backup for Microsoft 365 Plugin."
You can find this plugin in the Plugin Library list under the "Configuration" section.

Step 2:
Navigate to the "Organizations" menu item and add a new one by clicking "New."

First, please select the Company/End Customer to be linked, and in the next step, select the object types to be protected ("Protected Services").
This selection determines the permissions that will be assigned to the Entra ID application used for data protection within the tenant.

Please leave the Region set to the default value of Default and click Next.

Please register a new Entra ID application within the tenant that is to be backed up.
In this example, the abbreviation TCVDP within the new application's name stands for TERRA CLOUD Veeam Data Protection and facilitates its identification within Entra ID.
Please note that the "export mode for SharePoint Web Parts" should only be enabled if this feature is utilized by SharePoint.

To create the Entra ID application and assign the necessary permissions, authentication and approval by a Global Administrator are required.
Please copy the code and sign in to Microsoft 365 using the displayed link.

Confirm the sign-in to the Microsoft Azure CLI to authorize the creation and permissioning of the Entra ID application.

Following a successful sign-in and confirmation, the "Verification" status should change to "Verified."
If it does not, you can generate a new code by clicking "Refresh code" and attempt the sign-in process again.

Finally, the status of both the M365 Organization and the VSPC Company should be listed as "Mapped."

Create a Microsoft 365 backup job

To configure a Microsoft365 backup job, select the "Backup Jobs" tab in the left-hand menu under "Management."
You can create a new backup job using "Create Job."
First, enter a name for the backup job and, optionally, a description.
We recommend choosing a name, as in our example, that reflects the content being backed up.

Please select the Microsoft 365 tenant that is already linked to be backed up.
Under Backup Mode, you configure the scope of your job's backup. The backup of the entire organization is pre-selected.

However, you can also customize the scope and define granular exclusions.
Best Practice for Exclusions:
We recommend backing up the entire organization and excluding specific objects (e.g., groups) instead of including only individual objects.
In the next step, the schedule is added. Here you can define the frequencies, days, and retry attempts.
Optionally, you can allow or disallow data backups within a backup window (e.g., during business hours).

In the final summary, you can use the "Start the job when I click finish" option to run the data backup immediately.

Recovering Microsoft 365 data

Requirements

1. Active Entra ID Backup Application, which is already created during setup
2. Microsoft 365 credentials (affected user or global administrator)
3. TERRA CLOUD Veeam Data Protection Restore Portal Application added to the tenant

Add Restore Portal Application in the tenant

TERRA CLOUD uses a Microsoft Entra ID Enterprise Application to perform a restore in the backed-up tenant.
To enable this, the application must be added and authorized once per Microsoft 365 tenant.
You can do this directly via the TERRA CLOUD Technical Center using the "SET RESTORE PERMISSIONS" function.

Instructions:
Step 1: Log in to the TERRA CLOUD Technical Center as a "Reseller Admin."
Step 2: Navigate to the TERRA CLOUD Veeam Data Protection product in the menu under the "Products" category.
Step 3: Click the "SET RESTORE PERMISSIONS" button.
Step 4: In the newly opened tab, log in with a Global Administrator user of the tenant for which you want to configure the restore.

Step 5: Confirm the requested permissions for the "TERRA CLOUD Veeam Data Protection - Restore Portal" application by clicking "Accept." You will then be redirected to your Restore Portal.

Functional test: Please log in to the Restore Portal with a Microsoft 365 user from the tenant or the Global Administrator used above.

Restore as user

Step 1:
Under the "Protected Data" menu item, you can open a new tab with the "Restore Portal" link to access the Restore Portal.
Please log in with the Microsoft 365 user for whom you want to restore something.

Step 2:
Select the desired restore point from the calendar.

Step 3:
Now assemble the recovery set from the required files or objects.
You can navigate through the backup and the various object types, as well as use the search function.
You can select individual files directly and restore them using the "Restore" function or add them to the restore set using "Add to Restore List."

Step 4:
Please check whether all the desired files are included in the restore list under "Items."
You can then specify the "Restore Mode" to determine whether the files should be overwritten or retained in their original location.
Click the "Finish" button to start the restore.

Performing a restore as an administrator for other or multiple users

Prerequisite:
You can authorize one or more users as "Restore Operators" through TERRA CLOUD Support.
Please provide us with the desired tenant, e.g., contoso.onmicrosoft.com, and the desired user, e.g., admin@contoso.onmicrosoft.com.
As a "Restore Operator," you can use the "Scope" to change your identity and perform the restore for other or multiple users.
The procedure is identical to restoring as a user.

---

Consumption data

Determine consumption values ​​via the TERRA CLOUD Technical Center

The TERRA CLOUD Technical Center provides you with an overview per end customer and a summary of usage data for the selected month.
Within the table view, you can filter the values ​​as usual using the respective function and export them as a CSV file.
The default selection "Current" shows you the license usage for the current month. However, only the usage reports for completed months are relevant for billing.

Microsoft 365 Backup Usage Values ​​

This tab displays the usage data for the TERRA CLOUD Veeam Data Protection Microsoft 365 Backup:
Date

• Indicates the completed and billable month selected in the "Report Month" drop-down menu.
• If nothing is selected, the current month is displayed.

End Customer

• Indicates the end customer associated with the backed-up Microsoft 365 tenant.

Number of Backed-Up M365 Users

• Total of new and billed M365 users.

Number of New Backed-Up M365 Users

• Users newly added to the backup in the selected month are not billed.
• This applies to both the initial tenant setup and newly added users for existing customers.

Number of Billed M365 Users

• Users billed in the selected month.

Below the table showing consumption figures per end customer, you will also find your total consumption figures as a partner.

When does a Microsoft 365 user consume a backup license?

A Microsoft 365 user consumes one license for TERRA CLOUD Veeam Data Protection Microsoft 365 Backup in the billing month if the following criteria are met:

1. The online services Exchange Online and/or SharePoint Online/OneDrive for Business are used and backed up by the product.
   
2. The user has been part of at least one backup within the last 31 days.

Important note:
Restoration from previously created backups is also possible without an active license.

When both criteria are met for the first time, the user is registered as "new."
If a user has not been backed up in the last 31 days, no more licenses are consumed.

What doesn't consume a license for Microsoft 365 Backup?

The following objects can be included in the backup, but they do not consume a license.

1. Microsoft Teams objects
2. Groups and non-personal SharePoint sites
3. Shared mailboxes (unless a Microsoft 365 license has been assigned)
4. Resource mailboxes (unless a Microsoft 365 license has been assigned)
5. Public folders (unless a Microsoft 365 license has been assigned)
6. External SharePoint users
7. Microsoft Teams guest users

Licensing: The VCSP Pulse Plug-in

The Protection Portal offers you the option to rent Veeam software licenses through Wortmann AG (Service Provider) via the "VCSP Pulse Plugin".
The abbreviation "VCSP" stands for the Veeam Cloud & Service Provider Program. VCSP Pulse is a web-based license reporting platform for Service Providers operated by Veeam.
To create a license, your end customer/company must be set up in VCSP Pulse and linked to the company in the Protection Portal.

Structure of the VCSP Licensing Model

The Veeam VCSP licensing model is based on VCSP license points, which are billed uniformly according to the license size and feature set.
A point value determined by Veeam is charged based on the workload and feature set.
The workloads to be backed up are the determining factor for the license size. In this context, a workload refers, for example, to backing up a VM, a physical server, or a Microsoft 365 user, etc.
In addition to the license size, the feature set and edition of the software product are also crucial.
The core product, "Veeam Backup & Replication," is... B. Available individually in Standard, Enterprise, and Enterprise Plus versions, or bundled with the Veeam Data Platform.
Some products are only available in one version, in which case only the license size or the number of workloads is relevant.

When planning your license requirements, you can use these two questions as a guide:

1. What feature set, and therefore which edition of Veeam Backup & Replication or the Veeam Data Platform, is required?
2. Which workloads, and how many of them, need to be backed up? (VMs, network shares, S3 buckets, etc.)

Overview of score values ​​for Veeam Backup & Replication

Workload	Default	Enterprise	Enterprise Plus
Virtual Machine	5	9	11
Server	11	11	11
Workstation	4	4	4
Public Cloud VM	11	11	11
Public Cloud Database	11	11	11
Public Cloud File Share	11	11	11
Object Storage (500GB)	10	10	10
File Shares (500 GB)	10	10	10
Application	11	11	11
Microsoft Entra ID (10 User Package)	10	10	10

Overview of score values ​​for the Veeam Data Platform

Workload	Foundation Edition	Advanced Edition	Premium edition
Virtual Machine	11	13	16
Server	11	13	16
Workstation	4	5	5
Public Cloud VM	11	13	16
Public Cloud Database	11	13	16
Public Cloud File Share	11	13	16
Object Storage (500GB)	10	11	11
File Shares (500 GB)	10	11	11
Application	11	13	16
Microsoft Entra ID (10 User Package)	10	11	11

Overview of the scores for Veeam Backup for Microsoft 365

Note: Please note that you do not need to issue a Veeam Backup for Microsoft 365 license for TERRA CLOUD Veeam Data Protection Microsoft 365 Backup, as the Veeam license is already included in the product.
The point value per user is only relevant for licensing self-managed Veeam Backup for Microsoft 365 servers.

Workload	Veeam Backup for Microsoft 365
User	1.5

Licensing Veeam Agents directly via the Protection Portal

All Veeam agents installed via Protection Portal are automatically licensed through TERRA CLOUD.
You will be billed according to usage based on the following point values:

Workload	Workstation	Server
Microsoft Windows	4	11
Linux	4	11
Mac	4	11

Prerequisites for Automatic License Reporting and the transmission of usage data

Veeam’s "Automatic License Reporting" feature allows for the creation of licenses that automatically expand on a regular basis.
Additionally, usage data is transmitted directly to Veeam and recorded in the billing system of the respective service provider (Wortmann AG).
To ensure smooth operation and accurate billing, please meet the following requirements:

1. Create licenses exclusively with the "Automatic reporting on" option enabled.
2. Activate the Automatic License Key Update feature for your Veeam product (see example image below).
3. The licensed Veeam products must be able to reach the Veeam license servers (see table below).
4. The Management Agent is also required; it connects the licensed Veeam products to the Protection Portal (usage data is transmitted via the Management Agent).

Veeam License Update Server

Product	License Update Server	Port
Veeam Backup & Replication	vbr.butler.veeam.com, autolk.veeam.com, vbrad.butler.veeam.com	443
Veeam Backup Enterprise Manager	vbr.butler.veeam.com, autolk.veeam.com, vbrad.butler.veeam.com	443
Veeam ONE	one.butler.veeam.com	443
Veeam Backup for Microsoft 365	vbo.butler.veeam.com	443
Veeam Recovery Orchestrator	vao.butler.veeam.com	443
Veeam Backup for Salesforce	vbsf.butler.veeam.com	443

Certificate Revocation List

Certificate Revocation List URLs	Example	Port
*.ss2.us	o.ss2.us	80
*.amazontrust.com	ocsp.sca1b.amazontrust.com, ocsp.rootca1.amazontrust.com, ocsp.rootg2.amazontrust.com	80

Example: Active Automatic License Key Update on a Veeam Backup for Microsoft 365 server:

Setting up the VCSP Pulse Plug-in

You can find the VCSP Pulse plug-in in the "Configuration" section of the plug-in library.

First, activate the "Company creation in VCSP Pulse" option. This will automatically create all newly created companies as "VCSP Pulse Companies."
If companies already exist, you can simply select them using the checkbox and create them via "Create Company" --> "In VCSP Pulse."
The mapping between the company in the Protection Portal/Service Provider Console and VCSP Pulse is required so that licenses can be assigned to individual customers.

Creating, assigning and downloading a license key

1. Start the license creation process via License Keys --> New License
'2. Select a product from the range
Please note that the Automatic Reporting option must remain active so that license usage is automatically reported to Wortmann AG.

'3. Equip your license with the required workloads, e.g. B. 5 VMs Repeat this step for all other required workloads (e.g., for backing up a network share or Entra ID)

4. Create the license, provided all required workloads are included (you can also edit the license later)
5. Select the new license from the list of License Keys and assign the license via License Actions --> Assign

6. Finally, you can download the license file via License Actions --> Download and install it in the respective product

Managing Veeam Backup Server and Agents

The TERRA CLOUD Veeam Data Protection Portal allows you to centrally manage the following Veeam software components:

• Veeam Backup & Replication Server
• Veeam Agents (Windows, Linux, and Mac)
• Veeam Backup for Microsoft 365
• Veeam ONE
• Veeam Cloud Connect

Requirements

1. The Veeam product is licensed via Wortmann AG's VCSP licensing model
2. The respective management agent (Windows, Linux, or Mac) is installed on the system to be managed (exception: no management agent is required for the Veeam software appliance)
3. The management agents connect to the TERRA CLOUD cloud gateways via port 6180; see Network configuration
4. The "Backup agents management" option must be enabled for the company in the Protection Portal. In the current version (31.0) of the TERRA CLOUD Technical Center, this configuration does not yet happen automatically. In a future version, agent management will be automatically enabled when linking end customers in the Technical Center.

"Backup agents management" option for the respective company:

Management Agent

The Protection Portal Management Agent is the link between your Veeam software components (Veeam Backup Agents, Veeam Backup & Replication, Veeam Backup for Microsoft, etc.) and the Protection Portal.
The Management Agent must be installed on each system to be managed. It is available in three versions for the Windows and Linux operating systems and for macOS.
A list of all supported operating systems and system requirements can be found here.

Tip:
If you want to manage existing Veeam Backup & Replication servers, manual installation of the agent is not required.
The Management Agent is installed automatically if Wortmann AG is specified as the service provider for this server.

Features:

1. Transfer of metadata, e.g., operating system version, product version, hostname, etc.
2. Update management through the installation of upgrades and patches
3. Remote installation of Veeam software (Veeam Agents, Backup & Replication, or Veeam One)
4. Enables configuration of Veeam components via the Protection Portal (e.g., creating backup jobs, adjusting schedules, etc.)

Installation for Windows systems

Step 1: Download
You can download the Management Agent for Windows pre-configured for each of your end customers via the 'Discovery' section.
Optionally, the validity period of the connection token can be extended to, for example, five years.

Step 2: Installation
Run the setup on the system to be managed and follow the installation process.
The setup will install any necessary software packages (Microsoft ASP.NET Core 8.0.21 Shared Framework, Microsoft .NET Core Runtime 8.0.21, and Microsoft Windows Desktop Runtime 8.0.21).

In the next step, accept the license agreements.

Start the installation by clicking "Install"

Step 3: Adding the Agent to the Protection Portal
After successful installation, a new computer should appear in the Protection Portal under "Discovery --> Discovered Computers".
The Protection Portal is configured to automatically verify and authorize this new agent. This process may take a few minutes.

Once the Management Agent has been verified, you can, for example, begin installing a product (Veeam Agent, Backup Server, or Veeam One).

Add Wortmann AG as a service provider

Windows Veeam Backup & Replication Server

First, log in to the Veeam Backup & Replication Server via the Backup & Replication Console or the WebUI.
Please note that the Protection Portal Management Agent will be installed automatically during this process.
In the Backup Infrastructure, navigate to the Service Provider menu item and click Add Service Provider.
Note: We recommend using Veeam Backup & Replication version '12.3.2.4465 or higher. Older versions exhibit connectivity issues and contain security vulnerabilities; see Veeam KB4830.

Please enter the following configuration:
DNS name or IP address:

   protection-gateway.terracloud.de

Port:

   6180

Allow this Veeam Backup & Replication installation to be managed by the service provider --> Please enable
Next, enter new access credentials via Add or Manage accounts.
When a company is provisioned in the Protection Portal, a Cloud Connect user is also automatically provisioned. The username is an eight-digit ID (example in screenshot 966c77b6)
Username: = The username is displayed in the Technical Center in your end customer's service settings under TERRA CLOUD Veeam Data Protection (please copy only the eight-digit ID)
Password = The password is displayed in the Technical Center in your end customer's service settings under TERRA CLOUD Veeam Data Protection

After successful completion, a new entry should appear in the Service Providers section.