Permissions for Forest Recovery in Cayosoft Guardian

Cayosoft Guardian uses multiple identities such as connection accounts and Microsoft Entra applications to access and manage your environment.

When you add an Azure subscription under Forest Recovery > Cloud Services, the Add Azure subscription wizard supports two paths, with different prerequisites:

• Create a new application — Cayosoft Guardian creates the Microsoft Entra application automatically. The signed-in account must be able to create app registrations and grant the required API permissions in the tenant; this typically requires the Global Administrator role (or an equivalent privileged role).
• Use an existing application — the customer pre-creates the Entra application, service principal, and certificate, then provides the Subscription ID, Application ID, Tenant ID, and certificate during registration. No Global Administrator role is required in the tenant for this path. The pre-created service principal only needs the Azure RBAC roles listed in the tables below.

Microsoft Azure permissions

Create resources

NOTE: Cayosoft Guardian does not modify existing virtual networks, subnets, or network security groups supplied by the customer. Inbound rules required by Cayosoft Guardian (WinRM and agent ports — see Required Ports for Cayosoft Guardian) must be configured on the customer-managed NSG before deployment.

Manage backups

Manage storage

AWS permissions

To back up to S3 storage and create resources in AWS, Cayosoft Guardian requires an account with the following permissions:

Create resources

Manage backups

NOTE: Cayosoft recommends creating a separate organization and accounts for instant forest recovery, so the service accounts can only access resources required for forest recovery, and do not have access to production workloads.