Permissions for Forest Recovery in Cayosoft Guardian

Cayosoft Guardian uses multiple identities such as connection accounts and Microsoft Entra applications to access and manage your environment.

When you add an Azure subscription under Forest Recovery > Cloud Services, the Add Azure subscription wizard supports two paths, with different prerequisites:

• Create a new application — Cayosoft Guardian creates the Microsoft Entra application automatically. The signed-in account must be able to create app registrations and grant the required API permissions in the tenant; this typically requires the Global Administrator role (or an equivalent privileged role).
• Use an existing application — the customer pre-creates the Entra application, service principal, and certificate, then provides the Subscription ID, Application ID, Tenant ID, and certificate during registration. No Global Administrator role is required in the tenant for this path. The pre-created service principal only needs the Azure RBAC roles listed in the tables below.

Microsoft Azure permissions

The roles that Cayosoft Guardian needs depend on how the recovery site is deployed:

• Cayosoft Guardian creates the Azure resources (default). Use the roles in the Create resources and Manage backups tables. These requirements are unchanged from earlier versions.
• You provide the Azure resources (7.4 and later). When Use precreated resources is selected in the recovery site settings, Cayosoft Guardian never creates a resource group, virtual network, storage account, or Relay namespace. Grant the service principal the roles in the Customer-provided Azure resources table instead of the Contributor role.

Create resources

Customer-provided Azure resources

Assign the following roles to the service principal when the recovery site uses precreated resources. Scope each role to the resource that it applies to, or to the resource group that contains the precreated resources.

NOTE: Cayosoft Guardian does not change the configuration of resource groups, virtual networks, subnets, network security groups, storage accounts, or Relay namespaces supplied by the customer. It creates only the recovery site virtual machines and their disks and network interfaces, blobs in the storage account, and a hybrid connection in the Relay namespace. Inbound rules required by Cayosoft Guardian (WinRM and agent ports — see Planning and preparation: Required ports for Cayosoft Guardian) must be configured on the customer-managed network security group before deployment.

Manage backups

Manage storage

NOTE: Cayosoft Guardian does not modify existing virtual networks, subnets, or network security groups supplied by the customer. Inbound rules required by Cayosoft Guardian (WinRM and agent ports — see Required Ports for Cayosoft Guardian) must be configured on the customer-managed NSG before deployment.

Manage backups

Manage storage

AWS permissions

To back up to S3 storage and create resources in AWS, Cayosoft Guardian requires an account with the following permissions:

Create resources

Manage backups

NOTE: Cayosoft recommends creating a separate organization and accounts for instant forest recovery, so the service accounts can only access resources required for forest recovery, and do not have access to production workloads.