Update App Permissions

Bacula Enterprise Microsoft 365 Plugin is an application that is under continuous evolution. In consequence it may happen that new features require new permissions to function properly.

If you are using Authorization Method A: Common app model with bacula-m365-plugin (DEPRECATED)

Bacula Systems will add the required new permissions to the central bacula-m365-plugin app registered in Azure AD (or Microsoft Entra ID).

If you are already using the plugin through this central shared application (not recommended, as we recommend to use the Authentication “Standalone app model”), you will need to update the permissions of your own app (usually bacula-m365-plugin app itself, available under ‘enterprise applications’ option in your Azure Active Directory application).

To refresh and allow any new permission to your app, apply the following procedure:

1. Access the Azure Portal with a Tenant admin user

2. Locate your bacula-m365-plugin app under ‘Enterprise applications’ and click on it.

3. In the left menu, click on ‘Permissions’ and then click the big blue button showing ‘Grant admin consent for <yourtenantname>’:

4. Wait for a few minutes

5. Refresh the page

6. See the new permissions in the list

New releases needing any new permissions will properly reflect that information with the specific permissions list.

If you are using Authorization Method B: Standalone app model with bacula-m365-registrator (RECOMMENDED)

You need to rerun the add-app command as explained in the Authentication section B-2.

Example:

Update permissions through add-app command

*.query client=example-client-fd plugin="m365: tenant=********-****-****-****-************" parameter=add-app
console=---- M365 ADD APP ----
info=File /opt/bacula/etc/m365/example/bacula_m365_config.conf already exists. Contents will be just updated
info=Application named: bacula-m365-plugin-standalone already exists in tenant: example ...
info=Updating its permissions ...
info=Permissions updated successfully
info=Service principal already exists
info=Granting admin consent for permissions ...
info=Admin consent granted
info=We don't have any valid token. It's needed to sign in
info=To sign in; use a web browser to open the page https://microsoft.com/devicelogin and enter the code GJL5LGXC8 to authenticate. Please do it with a tenant administrator user
info=Storing access configuration to the new app in file: /opt/bacula/etc/m365/example/bacula_m365_config.conf
info=Access configuration successfully stored
console=---- ADD APP COMPLETED SUCCESSFULLY ----
console=----
info=Use the generated configuration file in your m365 filesets. Just add the property config_file=/your/path/bacula_m365_config.conf to the line Plugin="m365: ..."
info=Sample: Plugin = "m365: config_file=/opt/bacula/etc/m365/example/bacula_m365_config.conf service=drive"
console=----
console=----

Go back to Microsoft 365 (M365) Plugin article.