Azure tenant onboarding

Datto Backup for Microsoft Azure protects assets by adding the Azure tenant for protection.

Environment

• Datto Backup for Microsoft Azure: Azure Files
• Datto Backup for Microsoft Azure: Azure Blob Storage

Description

The onboarding wizard of a new Azure tenant may be stopped and resumed at any time. If interrupted, the system saves it as a draft; resume it from the Microsoft Azure – Tenants page.

Product-Created Artifacts in the Customer Azure Tenant

During onboarding, the product creates several artifacts in the customer’s Microsoft Azure tenant to enable access to and management of protected resources.

Adding a new tenant

1. Log into the UniView portal using your UniView or KaseyaOne credentials.

2. Follow the steps to launch the Add Tenant wizard from either page:

   Dashboard

   • In the left-hand menu, navigate to the Datto Backup Portal – Dashboard.

   • If you have Datto Backup for Microsoft Azure: Azure Files & Azure Blob Storage, but not Datto Endpoint Backup v2, on the right-hand side of the asset list select + Azure Tenant.

   • If you have Datto Backup for Microsoft Azure: Azure Files & Azure Blob Storage and Datto Endpoint Backup v2, on the right-hand side of the asset list select + Backup, then + Azure Tenant from the menu.

   Tenants page

   • In the left-hand menu, expand Microsoft Azure and select Tenants to open the page.

   • Select + Azure Tenant in the top right of the screen. This will open the Add Tenant wizard.

3. On the Sign In page of the wizard, select Sign in to Microsoft Azure. Once the pop-up appears, enter the credentials for your Microsoft Azure account and accept the agreement.
   

   The account used to login must be a Global Administrator at the Tenant Root Management Group level to authorize access, and you will need to input these credentials twice for the different permissions. If there is a permissions or validation issue, there will be a notification detailing it in the Activity Center.

   Multi-factor authentication (MFA) must also be enabled so the product can be granted the permissions it needs to protect your Azure resources. For setup instruction, see Secure user sign-in events with Microsoft Entra multifactor authentication (external link).

4. Once you are signed in, click Next to continue.

5. From the Organization Mapping page, select the organization this tenant will be added to from the drop-down menu. If the needed organization is not present, it can be imported through an enabled integration or added as a new organization. For more information on importing an organization using an integration from another product, refer to: Importing an organization .
   

   Import

   • This option will only be available if an integration is enabled in the portal.

   • Select + Import to import the organization from the enabled integration.

   New organization

   • This option will only be available if an integration is not enabled in the portal.

   • Select + New to create a new organization.

   • Fill out the Name and Group fields, then click Save.

6. Once the organization has been selected, click Next.

7. For each workload confirm or exclude protection using the Active Protection toggle. Currently the workloads available are Azure Files and Azure Blob Storage.

8. Select the Assignment Level for each of the Azure workloads, depending on which protection type was selected.

   NOTE  Azure File shares and Azure Blob containers that are located in a Storage Account configured with network rules set to deny all public access, will not be able to be backed up.

   Assignment Level	Description
   Tenant	All resources of the workload in the added Azure tenant will be included for backups. In addition, every newly added resource of this workload will be included automatically.
   Subscription	All resources of the workload in the selected Subscription(s) will be included for backups. In addition, every newly added resource of this workload, in the selected Subscription(s), will be included automatically.
   Resource Group	All resources of the workload in the selected Resource Group(s) will be included for backups. In addition, every newly added resource of this workload, in the selected Resource Group(s), will be included automatically.
   Storage Account	All resources of the workload in the selected Storage Account(s) will be included for backups. In addition, every newly added resource of this workload, in the selected Storage Account(s), will be included automatically.
   Individual Resource (File Share / Blob Container)	The most granular level, each selected asset will be included for backups. Higher levels may be selected to include multiple resources at once. Any future resources that would need to be protected would need to be included manually. If selecting this level, then at least one resource must be selected for protection to proceed.

   For more information on Assignment Levels, exclusions, and automatic inclusion of new resources, refer to: Automatic Inclusion .

   NOTE  If the storage account cannot be accessed, it will display a lock icon next to the name. No resources will be displayed beneath it. For more information on accessing the storage account, refer to the Inaccessible storage account section below.

9. After selecting the assignment level and confirming the resources to protect on the Azure tenant, click Next.

10. From the Policy Assignment page, select a policy from the drop-down menu to use a previously configured backup policy. This will need to be done for each protected workload. Once selected, Preview Policy can be used to view the current settings of the policy selected before confirming your choice.

    If you need to create a new policy, select + New Policy to open the policy creation pane. For more information on creating a policy, refer to: Add a new policy.
    

11. Click Next, once the policy has been selected.

12. From the Confirm page, review all the selected options up to this point and confirm the selections. Once ready, select Confirm & Add.

    Once confirmed, the draft will be saved, and the onboarding will be triggered. You will receive an Activity Center message once the onboarding process completes. The onboarding process will not take more than 45 minutes.

    NOTE  After the onboarding, updating Backup Level Assignment or Policy Assignment requires an Admin account or a Superuser account; updating Organization Mapping requires a Superuser account.

Resuming Azure tenant onboarding

If the onboarding was interrupted or paused, it appears as a Draft in the Status column. Select the icon in the far right of the row to Resume Onboarding.

If onboarding is resumed after the Backup Level Assignment step and the query of resources is different from what was previously available, it will be resumed from that point, regardless of where it was left off. Make the selection(s) again to confirm your choices with the updated resource list.

Resume the Azure tenant onboarding process from the step displayed to complete the onboarding.

Updating existing configurations

To adjust the configuration of a previously onboarded tenant, refer to: Protection modification.

Additional resources

• Azure Storage firewall rules (external link)