I was installing Veeam Backup for Office 365, at a customer, and we used the White Paper for Modern Authentication to set the permission, in Office 365 on the user.
We did not want to make en the user “Global Administrator” but only administrator on SharePoint and, give the ApplicationImpersonation permissions, in the GUI and not thru PowerShell, as stated in the White Paper for modern authentication. https://www.veeam.com/wp-modern-authentication-microsoft-office-v3.html
This permissions are not enough, there is some additional permissions that is required.
- “View-Only Configuration”
- “View-Only Recipients”
- “Mailbox Search”
- There may be more that is required, see the https://helpcenter.veeam.com/docs/vbo365/guide/vbo_required_permissions.html?ver=30
And the user also need to be Administrator on Teams. Teams is also a service that uses SharePoint, as one of the components.
If the user is not at Teams Administrator, you will see an error message like “Check LegacyAuthProtocolsEnabled: Legacy authentication”.
UPDATED June 26th 2019:
Veeam has created a new KB on the permissions for office 365, and it can be found here, here they don’t uses SharePoint administrator role. See the KB here: https://www.veeam.com/kb2969