High-risk tools in Veeam VBR v13 MCP Server
53 of the 328 tools in Veeam VBR v13 MCP Server are classified as high risk. This page profiles those tools specifically, with recommended policy actions and the attack patterns that target them.
Every operation listed below is an action PolicyLayer recommends controlling at the transport layer. Open any tool to see the full profile, risk score, and YAML policy snippet.
Tools at high risk
-
applyAgentPolicyConfigurationExecuteApply backup policy configuration to all computers managed by the policy (agent jobs only).
-
AzureInstantVMRecoveryMigrateExecuteStart migrating a machine to Azure permanently.
-
AzureInstantVMRecoveryMountExecuteStart Instant Recovery to Microsoft Azure.
-
AzureInstantVMRecoverySwitchoverExecuteStart switchover to Azure.
-
CreateRecoveryMediaForBackupObjectExecuteCreate recovery media for a specific backup object.
-
EnableScaleOutExtentMaintenanceModeExecuteEnable maintenance mode on a SOBR extent.
-
EntireVmRestoreHvExecuteRestore an entire Microsoft Hyper-V VM.
-
EntireVmRestoreVmwareExecuteRestore an entire VMware vSphere VM.
-
InstallAgentOnDiscoveredEntitiesExecuteInstall Veeam Agent on discovered entities.
-
InstantHvVMRecoveryMigrateExecuteStart migrating a Hyper-V instant recovery VM.
-
InstantHvVMRecoveryMountExecuteStart Instant Recovery of a Microsoft Hyper-V VM.
-
InstantRecoveryVmwareFcdMigrateWithSessionExecuteStart FCD disk migration.
-
InstantRecoveryVmwareFcdMountWithSessionExecuteStart instant FCD recovery.
-
InstantUnstructuredDataRecoveryMigrateExecuteStart file share migration to the original or another location.
-
InstantUnstructuredDataShareSwitchoverExecuteStart file share switchover.
-
InstantViVMRecoveryMigrateExecuteStart finalizing/migrating an instant-recovered VMware vSphere VM.
-
InstantViVMRecoveryMountExecuteStart Instant Recovery of a VMware vSphere VM.
-
RequestAppRegistrationByDeviceCodeExecuteGet Microsoft Entra ID device verification code for app registration.
-
RescanAllManagedServersExecuteRescan all managed servers to refresh their configuration.
-
RescanInventoryObjectsExecuteRescan inventory objects on a specific host.
-
RescanManagedServerExecuteRescan a specific managed server.
-
RescanProtectionGroupExecuteRescan a protection group to discover new machines.
-
RescanReplicaExecuteRescan all replicas.
-
RescanRepositoriesExecuteRescan all repositories to refresh their state and capacity.
-
RetryJobExecuteRetry a failed job.
-
StartConfigBackupExecuteStart an immediate configuration backup.
-
StartEntraIDAuditLogMountExecuteStart Microsoft Entra ID audit log restore.
-
StartEntraIDTenantRestoreExecuteMount a Microsoft Entra ID tenant for restore operations.
-
StartEntraIDTenantRestoreFromCopyExecuteStart Microsoft Entra ID tenant restore from a copy backup.
-
StartFlrMountExecuteStart a file restore session (mount backup for file-level restore).
-
StartHealthCheckBackupExecuteRun a health check and repair operation on backups.
-
StartJobExecuteStart/run a specific job immediately. Returns a session ID to track progress.
-
StartMalwareBackupScanExecuteScan backup data with antivirus software or YARA rules.
-
StartSecurityAnalyzerExecuteStart the Security & Compliance Analyzer to check the backup infrastructure against best practices.
-
StartUnstructuredDataFlrMountExecuteStart a file-level restore session from an unstructured data backup.
-
StartVSphereQuickBackupJobExecuteStart a quick backup for VMware vSphere VMs without creating a full job.
-
StopAutomationSessionExecuteStop a running automation session.
-
StopEntraIDAuditLogMountExecuteUnmount Microsoft Entra ID audit log restore session.
-
StopEntraIDTenantRestoreExecuteUnmount a Microsoft Entra ID tenant restore session.
-
StopFlrMountExecuteUnmount a file restore session.
-
StopJobExecuteStop a currently running job.
-
StopSessionExecuteStop a running session.
-
StopUnstructuredDataFLRMountExecuteUnmount unstructured data FLR volumes.
-
UpdateServerComponentsExecuteUpdate managed server components (agents, drivers).
-
UpgradeAgentOnDiscoveredEntitiesExecuteUpgrade Veeam Agent on discovered entities.
-
VerifyEncryptionPasswordExecuteVerify that an encryption password is correct.
-
ViVMSnapshotReplicaCommitFailbackExecuteCommit failback for a VMware vSphere snapshot replica.
-
ViVMSnapshotReplicaFailbackExecuteStart failback for a VMware vSphere snapshot replica.
-
ViVMSnapshotReplicaFailoverExecuteStart failover for a VMware vSphere snapshot replica.
-
ViVMSnapshotReplicaPermanentFailoverExecuteStart permanent failover for a VMware vSphere snapshot replica.
-
ViVMSnapshotReplicaPlannedFailoverExecuteStart planned failover for a VMware vSphere snapshot replica.
-
ViVMSnapshotReplicaSwitchToProductionExecuteSwitch over to production after failback.
-
ViVMSnapshotReplicaUndoFailbackExecuteUndo failback for a VMware vSphere snapshot replica.
Attacks that target this class
High-risk tools in any server share these documented attack patterns. Each links to the full case and the defensive policy.