Administrator, Plan Author and Plan Operator in Veeam Recovery Orchestrator

Orchestrator has exactly three roles, and only the Administrator role contains the others: an Administrator can act as a Plan Author and a Plan Operator, but a Plan Author is not a superset of a Plan Operator. The role table in the User Guide is the reference for what each role can do in the Orchestrator UI.

• Administrator can perform all administration actions and can also act as a Plan Author and Plan Operator.
• Plan Author can enable, disable, reset, create, edit, test and scan plans.
• Plan Operator can perform readiness checks, and can test, scan, schedule and run plans that are enabled.

Reading the table as decision rules

The table is easier to apply as a set of rules than as a grid.

• Building versus executing. The Plan Author role builds and maintains plans but has no right to schedule or run them. The Plan Operator role executes plans but cannot create or edit them. A person who must both edit and run plans needs either both roles in the scope or the Administrator role.
• The enabled state is the gate for Operators. A Plan Operator can test, scan, schedule and run only plans that are enabled. Plan Authors control that gate, because they can enable and disable plans. A plan that is still being built can therefore be left disabled so that Operators cannot run or test it.
• Reset is the one change an Operator can make. Reset clears a plan’s current state so that it can be run again; the Plan Operator has this right but no other plan-management right. Plan states, modes and reset are covered in Chapter 7: Running plans: failover, failback, restore and permanent failover.
• Readiness checks are open to all three roles. Any user who can see a plan can check it.
• Only Administrators reach the Administration page. Connecting infrastructure, managing credentials, creating scopes and recovery locations, adding custom script steps under Recovery Steps, importing YARA rules, setting report retention and enabling MFA are all done on the Administration page, so none of them is available to a Plan Author or Plan Operator.
• Report templates. Plan Authors have full access to reports and templates, so they can clone and customise report templates; Plan Operators can only read reports.

Common trap: Giving the Plan Author role to the team that will press the button during a disaster - Plan Authors have no right to schedule or run plans. Running and scheduling plans needs the Plan Operator (or Administrator) role.

Common trap: Expecting a Plan Operator to test a plan that is still being built - Plan Operators can test, scan, schedule and run only enabled plans. A Plan Author must enable the plan first, or test it themselves.

Get the whole book

This note is one section of Ultra Transcenders VRO-13: Veeam Recovery Orchestrator 13, an independent study guide that explains every topic the course covers by technology, with comparison tables, diagrams and the common traps, plus a glossary linked to the Veeam Help Center.

About the book · VRO-13 terms in the glossary · All VRO-13 study notes