Restrict Backup Job Access by BackupUser in Proxmox GUI + ConsoleAccess for Specific VMs or Host

[drashtijaviya96]

Hi all,

I'm working on a Proxmox setup involving delegated backup responsibilities across different users/teams and have encountered a few limitations around permissions and access control. I’d appreciate any insights on the following:

1. Backup Job Restrictions:
I want users to be able to set up scheduled backup jobs for their assigned VMs—similar to how it's done via Datacenter → Backup → Add, where they select VMs and set the schedule.
Currently, this seems to require granting Sys.Modify at the datacenter level, which also allows users to view and edit all backup jobs, including those created by other teams.
For now, users can perform manual backups by going to VM → Backup → Backup Now, but I want to enable scheduled jobs limited to their own VMs.
Question: Is there a way to allow users to create and manage backup jobs only for their own VMs, without giving broad access at the datacenter level?

2. Console Access:
I also want to give certain users access to the console and GUI of specific VMs and possibly the host level, without giving them broad permissions.
Question: What's the recommended way to grant console access for individual VMs and nodes?
I'm following the official docs here: https://pve.proxmox.com/wiki/User_Management#Permission_Management_and_Privileges

Any guidance is appreciated. Thanks in Advance!

 

[dakralex]

Hi!

Question: Is there a way to allow users to create and manage backup jobs only for their own VMs, without giving broad access at the datacenter level?

There are no granular privileges and ACL paths to manage these on a guest-level basis. There is a similar feature request for this in our Bugzilla [0], where you can subscribe to the ticket. I would also recommend you to chime in and explain your use case in detail there, so that it can be incorporated into the design by the person who picks up the feature request, because it seems the current use case was more about having a separate permission for a backup team for all backup jobs rather than on a per-guest granularity.

Question: What's the recommended way to grant console access for individual VMs and nodes?

There is the VM.Console privilege, which can be put on the /vms ACL path to allow console access to all virtual machines, but can also be applied more granular by applying them on individual /vms/{vmid} ACL paths, which allows console access only to the guest with the vmid. AFAICS there is currently no possibility to set this permission for a node.

[0] https://bugzilla.proxmox.com/show_bug.cgi?id=6139