Set up a Veeam connector

Capabilities
Gather Veeam credentials
Configure the Veeam connector

Capabilities

The Veeam connector syncs the following resources from Veeam Backup Enterprise Manager (REST API on port 9398):

Resource	Sync	Provision
Accounts
Roles

Accounts: Users and groups in Enterprise Manager. Provisioning: create accounts, delete accounts.
Roles: Security roles (Portal Administrator, Portal User, VM/File/Exchange/Oracle/SQL Restore Operator). Provisioning: grant and revoke role assignments to accounts.

Gather Veeam credentials

To configure the Veeam connector, you need an account with the Portal Administrator role in Veeam Backup Enterprise Manager.

Ensure Veeam Backup Enterprise Manager is installed and the REST API service is running (default port 9398).

Obtain credentials for C1:

Veeam URL: The base URL of your Enterprise Manager instance (e.g., https://veeam-server:9398).
Username: A Windows domain or local account that has been added to Enterprise Manager (e.g., DOMAIN\Administrator or hostname\username).
Password: The password for that account.
The account must have the Portal Administrator role in Enterprise Manager (required for both sync and provisioning).
Save the URL, username, and password securely for use in the connector configuration.

Configure the Veeam connector

Cloud-hosted
Self-hosted

Follow these instructions to use a built-in, no-code connector hosted by C1.

In C1, navigate to Integrations > Connectors and click Add connector.

Search for Veeam and click Add.

Choose how to set up the new Veeam connector:

Add the connector to a currently unmanaged app
Add the connector to a managed app
Create a new managed app

Set the owner for this connector.

Click Next.

Find the Settings area of the page and click Edit.

Enter the required configuration:

Veeam URL: Base URL of your Veeam Backup Enterprise Manager instance (e.g., https://veeam-server:9398).
Veeam Username: Username for authentication (e.g., DOMAIN\Administrator).
Veeam Password: Password for that account.

Click Save.

The connector’s label changes to Syncing, followed by Connected. You can view the logs to ensure that information is syncing.

Done. Your Veeam connector is now pulling access data into C1.

Follow these instructions to use the Veeam connector, hosted and run in your own environment.When running in service mode on Kubernetes, a self-hosted connector maintains an ongoing connection with C1, automatically syncing and uploading data at regular intervals.

Step 1: Set up a new Veeam connector

In C1, navigate to Integrations > Connectors > Add connector.

Search for Baton and click Add.

Choose how to set up the new Veeam connector:

Add the connector to a currently unmanaged app
Add the connector to a managed app
Create a new managed app

Set the owner for this connector.

Click Next.

In the Settings area of the page, click Edit.

Click Rotate to generate a new Client ID and Secret.Carefully copy and save these credentials.

Step 2: Create Kubernetes configuration files

Create two Kubernetes manifest files for your Veeam connector deployment:

Secrets configuration

# baton-veeam-secrets.yaml
apiVersion: v1
kind: Secret
metadata:
  name: baton-veeam-secrets
type: Opaque
stringData:
  # C1 credentials
  BATON_CLIENT_ID: <C1 client ID>
  BATON_CLIENT_SECRET: <C1 client secret>

  # Veeam Backup Enterprise Manager credentials
  VEEAM_URL: <Veeam Enterprise Manager base URL, e.g. https://veeam-server:9398>
  VEEAM_USERNAME: <Username, e.g. DOMAIN\Administrator>
  VEEAM_PASSWORD: <Password>

  # Optional: include if you want C1 to provision access using this connector
  BATON_PROVISIONING: true

See the connector’s README or run ./baton-veeam --help to confirm environment variable names (they may be derived from the config schema).

Deployment configuration

# baton-veeam.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: baton-veeam
  labels:
    app: baton-veeam
spec:
  selector:
    matchLabels:
      app: baton-veeam
  template:
    metadata:
      labels:
        app: baton-veeam
        baton: "true"
        baton-app: veeam
    spec:
      containers:
      - name: baton-veeam
        image: public.ecr.aws/conductorone/baton-veeam:latest
        imagePullPolicy: IfNotPresent
        env:
        - name: BATON_HOST_ID
          value: baton-veeam
        envFrom:
        - secretRef:
            name: baton-veeam-secrets

Step 3: Deploy the connector

Create a namespace in which to run C1 connectors (if desired), then apply the secret config and deployment config files.

Check that the connector data uploaded correctly. In C1, click Apps. On the Managed apps tab, locate and click the name of the application you added the Veeam connector to. Veeam data should be found on the Entitlements and Accounts tabs.

Done. Your Veeam connector is now pulling access data into C1.

All versions of this connector are available at dist.conductorone.com.

Set up a Valimail connector

Set up a Verkada connector

⌘I

Welcome

Manage connectors

Deploy connectors

Upload connector data

Configurable connectors

Pre-built connectors

Set up a Veeam connector

Capabilities

Gather Veeam credentials

Configure the Veeam connector

Step 1: Set up a new Veeam connector

Step 2: Create Kubernetes configuration files

Secrets configuration

Deployment configuration

Step 3: Deploy the connector

Welcome

Manage connectors

Deploy connectors

Upload connector data

Configurable connectors

Pre-built connectors

Documentation Index

​Capabilities

​Gather Veeam credentials

​Configure the Veeam connector

​Step 1: Set up a new Veeam connector

​Step 2: Create Kubernetes configuration files

​Secrets configuration

​Deployment configuration

​Step 3: Deploy the connector

Capabilities

Gather Veeam credentials

Configure the Veeam connector

Step 1: Set up a new Veeam connector

Step 2: Create Kubernetes configuration files

Secrets configuration

Deployment configuration

Step 3: Deploy the connector