Veeam Cloud Connect Backup deletion failed

Recently I’ve come across an issue where a customer wasn’t able to delete one of it’s VMs from the backups on our Veeam Cloud Connect environment.

When the customer tries this by going to the specified VM in the Veeam GUI -> Selecting it and pressing -> Remove (both options that pop up are ticked). The customer would receive the following error message:

Now looking at the configuration for this customer in the Veeam Cloud Connect configuration on the tenant, the tenant does have “Insiders Protection” enabled. This feature ensures that tenant backups do not get deleted by accident or intentional, and places the deleted backups inside a Recycle bin folder on the Service Provider side. The deleted items stay there for the configured amount of time before they are permanently deleted by Veeam. This ensures that customers can still ask the Service Providers to restore this data.

This customer had the Insiders Protection enabled for 7 days. The error message has already been more than 7 days ago, so something is wrong on this end. After carefully reading the documentation I mentioned earlier on Insiders Protection and after talking to Veeam Support, we concluded that this page is not specific on what should happen when you delete only a VM from the backup chain. It seems like this will not work. The reason behind this is that the backup chain (if not using a Per-VM backup file repository) contains backups from multiple VM’s. So one “.vib” file contains multiple VM backups. If there was possible, it would delete blocks from a backup file, without a backup container like a “.vib/.vbk” file to the recycle bin. But since it’s not inside a backup container, it wouldn’t even be possible to inject these erased blocks back into the backup container.

Because of this it’s not possible to delete a single VM when we are using the Insiders Protection feature within Veeam. There are exceptions to this scenario:

1. When a repository has the Per-VM backup chain enabled. This is a feature you can enable on the Backup Repository. This would mean that each VM has it’s own backup containers that can be deleted and moved to the Recycle bin we’ve talked about.
2. When there is only one VM in the entire backup chain. This would mean there is no other data present in one of the backup file containers.So the entire chain would be placed inside the Recycle bin.

So how do we fix this issue (now that the customer is receiving this message)? We’ll the solution is a temporary one and it means that we need to disable Insider Protection for this tenant. Once you do this the customer can delete the VM like it did earlier and Veeam processes the deletion like it is supposed to. Once this is done you should however re-enable the Insiders Protection.

So to conclude this issue; If you are using Insiders Protection on a Veeam Cloud Connect tenant, please tell them they cannot delete a single VM from the backup. A better solution here would be to use the Per-VM Backup files option as a default on all repositories that are being used.