Backblaze Business Backup administration can grant direct access to employee backup data, so it should be designed like a privileged data role. In a managed group, an administrator may browse backups, create restores, and change member account settings. In an unmanaged group, administrators handle billing without that member-data authority. Enterprise Control can add organization-wide file-management restrictions and administrator restore capabilities. Each level changes who can reach data and who can delete or restore a backup.
Authentication is only one part of the model. Backblaze Enterprise Control supports OpenID Connect SSO for a group, with issuer discovery and approved domains, but SSO does not replace group membership review, administrator-role approval, endpoint account ownership, or recovery procedures. The operating record should identify the identity provider, verified domains, group administrators, members, computers, account model, restore approvers, encryption setting, and evidence owner.
Offboarding must also account for the fact that removing someone from a Business Group does not necessarily delete the person’s Backblaze account. Backblaze notifies a removed member that a payment method is needed for uninterrupted service. Before that event, the organization should decide what business data must be restored, whether the endpoint backup remains company-owned, which license or payment relationship changes, and which private encryption passphrase custodian can support a required restore.
Key decisions at a glance
- Document whether administrators may browse and restore member backups because managed-group authority changes the privacy and insider-risk model.
- Treat Enterprise Control file-management options as an approval checkpoint because those settings cannot be changed after configuration.
- Use OpenID Connect SSO for authentication where appropriate, but govern group membership, administrator roles, account recovery, and endpoint ownership as distinct lifecycle controls.
- If a private encryption passphrase is enabled, maintain tested dual custody because Backblaze cannot recover forgotten material or restore the affected backup without it.
- Offboard in a deliberate order that preserves required business data, transfers restore responsibility, removes group access, resolves licenses and payment, and verifies remaining endpoint coverage.
Define managed-group and Enterprise Control authority before configuration
Start with a role matrix that separates group billing, member approval, administrator management, backup-status review, account impersonation, file browsing, restore creation, backup deletion, user deletion, SSO configuration, and encryption custody. Backblaze says group administrators have equal rights and can add or remove other administrators, which makes every administrator assignment material. Require an accountable business owner, security approval, periodic recertification, and at least two trained but narrowly selected administrators for continuity.
Record the managed-group privacy decision. Managed administrators can enter a member’s account through Users/Computers, inspect backups, create restores, and update certain account details. Users must acknowledge administrator access when they join a managed group. An unmanaged design limits administrators to payment and group administration without file access. The consent notice, employment policy, support procedure, and legal basis should agree with the chosen design before invitations are issued.
Treat Enterprise Control file-management settings as an irreversible change gate. Current Backblaze guidance includes choices for administrator deletion of member backups, member deletion of their own backups, and administrator restore on behalf of members, and says those settings cannot be changed after configuration. Advanced options such as locked group membership, hard-drive purchase restrictions, client update control, and hidden menu icons can be edited later. Capture a screenshot-free decision record, approval, test plan, and recovery impact for every setting.
- Separate billing, membership, account management, restore, deletion, SSO, and encryption duties in the administrator matrix.
- Keep the administrator population small and review it regularly because administrators can grant equivalent rights to others.
- Align managed access with employee notice, privacy expectations, legal authority, support need, and independent review.
- Approve and test immutable Enterprise Control file-management options before submitting the configuration wizard.
Connect OpenID SSO while keeping membership and restore control separate
Configure SSO as an authentication control for the approved group. Backblaze Enterprise Control supports OpenID Connect by using the issuer or metadata URL, auto-discovered endpoints, authentication, and one or more organization domains. Older group guidance also references selected Google and Microsoft authentication domains. Use the current option presented in the account, record the issuer and verified domains, and test with a normal member, administrator, excluded identity, and recovery identity before broad enforcement.
Do not treat an accepted SSO login as proof of correct group membership or backup ownership. Reconcile identities from the authoritative directory against Backblaze group members, group administrators, computer records, centralized accounts, and decentralized user accounts. A person can authenticate correctly while the wrong computer remains attached to an old account or group. Every joiner and mover event should specify the intended account model, group, region, endpoint name, restore route, and member-data access outcome.
Give the help desk a tested sign-in and restore escalation path. A managed administrator can act on a member’s account, while a decentralized user may restore independently and a centralized user may need the account manager. Require an approval record for administrator-created restores, minimize the selected files, protect the delivery destination, and tell the employee when policy requires. SSO does not remove the need to validate a restore requester’s identity or protect restored data after download.
- Validate the current OpenID Connect configuration, issuer discovery, domains, member login, administrator login, and recovery path.
- Reconcile directory identities with group members, administrators, computers, account model, region, and restore ownership.
- Test joiner and mover scenarios that change groups, endpoints, departments, or restore authority without exposing backup data.
- Require authorization, minimum file selection, secure delivery, and retained evidence for every administrator-created member restore.
Protect private encryption passphrases and prove restore authority
Backblaze encrypts Computer Backup data, and an account can add a private encryption passphrase for another layer of control. Backblaze states that it never stores the passphrase and cannot decrypt or restore the backup without it. If the organization forgets the passphrase, Backblaze cannot recover the data or remove the passphrase. That consequence makes the choice a governance decision involving security, continuity, legal, and recovery owners rather than a personal setting on one employee’s computer.
Design custody before enabling the passphrase. Use an approved secrets vault with dual control or another resilient mechanism, grant access only to named recovery authorities, log retrieval, prohibit copies in tickets or deployment scripts, and keep a secondary recovery path independent of the endpoint and normal identity provider. Record which backups use a passphrase without recording the value. A quarterly custodian review should confirm that multiple authorized people can locate the material under an approved scenario.
Test the complete restore path with the passphrase, not merely retrieval from the secrets vault. Select a small non-sensitive file set, obtain approval, reach the correct member backup, supply the passphrase through the supported interface, download to a controlled device, verify integrity and permissions, and dispose of the test copy. The evidence should prove that the correct custodians can cooperate without disclosing the passphrase to observers, work tickets, or screenshots.
- Approve the continuity consequence before enabling a private encryption passphrase on any production backup.
- Maintain dual custody, logged retrieval, independent storage, named backups, and a tested emergency access route.
- Keep the passphrase out of endpoint scripts, support tickets, chat, email, screenshots, and ordinary administrator notes.
- Run a controlled restore exercise that proves both passphrase availability and successful protected-data recovery.
Offboard members without losing required business data or ownership evidence
Begin offboarding with an inventory of the departing person’s accounts, computers, external drives, group memberships, administrator roles, centralized or decentralized ownership, region, encryption setting, alerts, and last successful backup. Confirm which business records need preservation and whether they remain on a company-controlled endpoint. If a restore is required, create and verify it while authority, passphrase custody, and the appropriate account are still available. Do not delete a backup as a shortcut for removing access.
Remove privileged roles and identity access in a controlled order. Revoke Backblaze administrator rights, update SSO and organization directory access, collect or isolate company endpoints, and confirm who will manage any centralized account. When the person is removed from a group, Backblaze says the member is notified and must add a payment method for uninterrupted service. Document whether the account is personal or company-owned, who receives that notice, how the license and billing obligation change, and whether a replacement device inherits or starts a new backup.
Close the event with coverage and data-access evidence. Verify that no departed administrator remains, no orphaned computer is silently excluded from the group’s denominator, required restores are protected, company passphrases remain recoverable, and the active fleet still reports expected status. Preserve the approval, timeline, account and device disposition, restore evidence, group removal, license action, identity change, endpoint action, exceptions, and independent reviewer. Never place recovered file contents or encryption values in the offboarding ticket.
- Inventory accounts, devices, drives, group roles, ownership model, encryption, last backup, and business-record needs before removal.
- Create and verify any authorized business-data restore before deleting a backup or losing required passphrase custody.
- Remove administrator, SSO, group, device, license, and billing relationships with explicit ownership decisions for each account.
- Reconcile the remaining fleet after offboarding so a removed or orphaned computer cannot disappear from coverage reporting.
Vendor documentation and ALLMSP resources
- Backblaze Business Groups
- Backblaze create a group
- Backblaze manage groups and member accounts
- Backblaze Enterprise Control
- Backblaze group account administration
- Backblaze Computer Backup encryption
- Backblaze data encryption and passphrases
- Backblaze private encryption key for restore
- ALLMSP cybersecurity services
- ALLMSP data backup and recovery
- ALLMSP managed IT services
- ALLMSP IT consulting
- ALLMSP software support
Frequently Asked Questions
Can a Backblaze managed-group administrator see employee backup data?
Yes. Backblaze says managed administrators can manage a member account, including browsing backed-up data and creating restores. Treat that capability as privileged data access, restrict administrators, align it with employee notice and policy, review it regularly, and retain approval evidence for administrator-created restores.
Do all Backblaze group administrators have the same rights?
Backblaze’s current group guidance says administrators have equal rights and can add or remove other administrators. Keep the administrator set small, require business and security approval, protect each identity, review membership on a schedule, and investigate any unapproved role change as a privileged-access event.
Which Backblaze Enterprise Control settings cannot be changed later?
Backblaze states that configured file-management choices cannot be edited later. These include whether administrators may delete member backups, whether members may delete their own backups, and whether administrators may restore for members. Approve the privacy, continuity, and recovery effects before submitting the configuration.
Does Backblaze Business Backup support OpenID Connect SSO?
Yes. Current Enterprise Control guidance provides an OpenID Connect group configuration using an issuer or metadata URL, endpoint discovery, authentication, and approved domains. Test member, administrator, excluded, and recovery identities, and confirm the current options visible in the tenant before broad rollout.
Does SSO automatically prove a Backblaze computer is in the correct group?
No. Authentication success does not prove correct group membership, administrator assignment, computer ownership, region, or restore route. Reconcile the authoritative identity directory with Backblaze members, administrators, accounts, and endpoint records, then test each joiner and mover scenario through an actual backup and restore.
Can Backblaze recover a forgotten private encryption passphrase?
No. Backblaze states that it does not store the private passphrase and cannot decrypt or restore the backup without it. Before enabling the option, establish durable dual custody, independent storage, logged retrieval, multiple authorized recovery personnel, and a recurring restore exercise that proves the material works.
Should a private encryption passphrase be stored in an endpoint deployment script?
No. Keep it out of scripts, logs, tickets, email, chat, screenshots, and endpoint-local notes. Store it in an approved secrets system with limited recovery authorities, dual control where appropriate, audit logging, an independent contingency path, and a record of which backups use it without the value itself.
What must be approved before an administrator restores a member's files?
Require a documented requester, business purpose, scope, information owner, privacy or legal authority where applicable, approving administrator, secure destination, and disposal plan. Select the minimum necessary files, preserve the operational audit evidence, verify integrity, and never attach recovered sensitive content to the service ticket.
What happens when someone is removed from a Backblaze Business Group?
Backblaze says the removed member receives notice that they must add a payment method for service to continue without interruption. Removal is not the same as account deletion. Decide account ownership, required business-data recovery, license and billing action, endpoint disposition, and ongoing coverage before completing the event.
What evidence should close a Backblaze employee offboarding?
Retain the trigger, administrator and SSO removal, group action, account ownership decision, device and external-drive disposition, authorized restores, encryption custody check, license and payment change, fleet reconciliation, exceptions, and independent approval. Exclude private passphrases, file contents, tokens, and other secrets from the record.
