Roles & Approvals
Self-service recognizes exactly two roles: End User and Restore Files Approver. There is no operator-side approval path — the only person who can ever approve a restore request is someone at the client company holding this role for their own tenant.
Two roles, not a permissions system
Every signed-in person in the self-service portal is an End User. A subset of End Users additionally hold the Restore Files Approver role.
Holding the Approver role does not remove a person’s own End User capability: an approver can still browse their own Exchange mailbox and OneDrive drive and submit their own requests exactly like anyone else, in addition to acting on the tenant’s approval queue.
What a Restore Files Approver can do
- See every pending Exchange/OneDrive restore request and every pending SharePoint/file-server request for their own tenant, plus a history of requests already decided.
- Approve or reject an Exchange/OneDrive request that already names a specific, known item.
- For a SharePoint or file-server request — submitted as a description rather than a known item — search the tenant’s real backup catalog, attach the exact file or folder found, and resolve the request. A written note explaining how the item was matched is required for every resolution.
- Reject a SharePoint/file-server request outright if no matching backed-up item can be found or the request should not proceed.
Approving or resolving a request executes the restore immediately — in-place restore for Exchange/OneDrive/SharePoint, or a queued job picked up by the on-prem agent for file servers. See Restore Overview and File Servers.
What the role cannot do
- An approver can only see and act on requests belonging to their own tenant. Tenant data isolation is strictly enforced.
- An approver cannot browse a tenant’s backup catalog freely. The search step used to resolve a SharePoint/file-server request only operates in the context of one specific, already-submitted, pending request — it is a resolution tool, not a general browse endpoint.
- An approver cannot act on an Exchange mailbox or OneDrive drive other than through a request an End User has already submitted; there is no route for an approver to initiate a restore of someone else’s item on their own initiative.
- Being a Restore Files Approver at one tenant carries no privilege at any other tenant. The role is specific to each tenant, not an account-wide grant.
How the role is granted
Restore Files Approver is granted in one of two ways, both configured by a BYOVault operator from that tenant’s Self-Service tab — never by the client company directly, and never automatically from anything Microsoft-side alone:
- Manually, per person. An operator picks a specific person from the list of employees who have signed into that tenant’s portal at least once, and flips the role on or off for them individually. This is the only way to grant the role to someone at a client with no dedicated approver group.
It is also the only option available for a tenant’s very first approver — a person must already have signed in at least once before they can be designated, since there is no way to reference someone by identity before that. - Group-based, per Entra security group. An operator sees which Entra security groups the client has already assigned to BYOVault’s enterprise application (the ordinary Microsoft mechanism that grants portal sign-in to a group of employees) and toggles individual groups on as an approver source.
A person removed from an approver-designated group loses the role once membership changes are next synced, even if they never sign in again — this is what makes the group toggle meaningful for someone who has left the group, rather than only affecting future sign-ins.
Group sync only ever revokes a role it itself granted through group membership. A person granted the role manually by an operator keeps it regardless of their group membership, and only an operator’s own manual toggle can remove that grant.
No approver, no self-service
A tenant with no active Restore Files Approver has no self-service available at all, for any workload. A person can still sign in, but every browse and new-request action is refused until an approver is in place.
- Browsing an Exchange mailbox or OneDrive drive requires at least one active approver to exist for that tenant first.
- Submitting a new SharePoint or file-server request requires the same.
This is deliberate: a request sitting in a queue nobody can see or act on is worse than the feature being unavailable outright.
Signing in itself is never gated on this, since designating a tenant’s first approver requires that person to have already signed in — requiring an approver before sign-in would make it impossible to ever grant the role at all.
An End User’s own past request history also remains visible to them even if their tenant’s sole approver is later removed, so a person never loses visibility into a request they already submitted.