Backup for VMware after Broadcom: what changed for vSphere 9, VCF 9.1, VVF and Veeam

VMware backup after Broadcom: what changed and where

Backup of a VMware estate after the Broadcom licensing change still runs through the vSphere Storage APIs for Data Protection with Changed Block Tracking. Three things around that interface changed: an upgrade to vSphere 9 requires subscription licences, replication and recovery were renamed and merged into one appliance, and the backup software has to be at a version that lists the vSphere release. Veeam's KB2443, last modified on 27 October 2026, lists vSphere 9.0.x from Veeam Backup & Replication 12.3.1, 9.1.0.x from 13.1 and 9.1.1.x from 13.1.2.

Everything below comes from Broadcom's and Veeam's documents as read on 12 November 2026; Broadcom's knowledge-base articles show no date, so we cite them by number. Core counting and editions are in our article on VMware licensing after Broadcom.

the documents named in the third column, read 12 November 2026; wording and details in the sections below.

vSphere 9 backup compatibility: Veeam versions for 9.0, 9.1 and 9.1.1

Veeam publishes the minimum version of Veeam Backup & Replication for each vSphere release in KB2443. The vSphere versions it lists "include all applicable patches for those versions".

Veeam KB2443, "Veeam Backup & Replication support for vSphere", last modified 27 October 2026, read 12 November 2026. The same KB names 12.3.2 as the last Veeam version that supports vSphere 6.0, 6.5 and 6.7.

Broadcom released VCF 9.1.1 on 3 September 2026, and the Veeam build that lists vSphere 9.1.1.x is dated 27 October 2026; per Veeam's KB4738, last modified on 10 November 2026, build 13.1.2.57 adds support for "VMware vCenter Server 9.1.1." From these two dates we take the order of work: Veeam first, to the build KB2443 lists, then vCenter and the hosts. The order is our advice. Veeam states only the minimum versions.

vSphere 9.0 does not need version 13. KB2443 lists 9.0.x from 12.3.1, and the release notes of the first version 13 release of 3 September 2025 already name ESXi 9.0 and vCenter Server 9.0. Version 12 has an end date, though: Veeam's product lifecycle page, as read on 12 November 2026, gives February 2027 as the end of support and security fixes for Veeam Backup & Replication 12.

KB2443 gives minimum versions per vSphere release and does not name VCF 9.1. That statement is in Veeam's What's New for 13.1 (page updated 15 October 2026), which lists "VMware Cloud Foundation (VCF) 9.1 support" and "Full support for VMware Virtual Disk Development Kit (VDDK) version 9". Veeam's user guide says of VCF: "This platform is supported as individual VMware software components." SDDC Manager and NSX Manager have file-based backups of their own, which our guide to vCenter backup and restore describes.

KB4738 allows the step to 13.1.2 from 12.3.1, 12.3.2, 13.0, 13.1 and 13.1.1, by full ISO or the built-in updater, with no patch file. A planned move of the backup server from Windows to the Veeam Software Appliance comes before that step, because KB4738 supports it only on 13.0.x builds. Build 13.1.2.57 also carries the fix for CVE-2026-108142 (CVSS 9.1) from Veeam's KB4948 of 27 October 2026, as does 13.0.3.63.

We supply Veeam backup software and VMware / Broadcom licensing and implement both, as our software page states; send us your vCenter, ESX and Veeam build numbers and we answer within one business day.

What VCF 9.1 and VVF include for snapshots, replication and recovery

vSphere 9.x comes inside VVF and VCF and, since 4 November 2026, as vSphere Express; vSphere Standard and Enterprise Plus are, in the words of Broadcom's vSphere 9.1 FAQ of May 2026, "limited to version 8 Update 3 and earlier". What vSphere Express includes for data protection we have not read, so the table covers VCF and VVF. Image-level backup of VMs through the Data Protection APIs remains the job of a backup product: KB 311197 speaks of "backup vendors" that have released solutions built on these APIs.

Broadcom, "VMware Cloud Foundation 9.1 General FAQs" (undated; one answer names 4 November 2026), the FAQ for VMware vSphere Foundation (undated, covers 9.0 and 9.1), "VMware Cloud Foundation 9.1.1 and VMware vSphere Foundation 9.1.1 Feature Comparison & Upgrade Paths" (undated); read 12 November 2026.

Native snapshots need vSAN with the Express Storage Architecture, and the VCF FAQ answers "Yes." to the question whether a Protection and Recovery appliance is needed for operational recovery. Both FAQs present these snapshots as a means of operational recovery; what counts as a backup copy is covered in our article on the 3-2-1-1-0 backup rule. The VVF FAQ gives up to two hundred snapshots per VM for 9.1. That figure belongs to native vSAN ESA snapshots and is no limit for the snapshots a backup job takes through the Data Protection APIs.

Three product names are easy to mix up, and Broadcom's documents use one of them in two ways. VMware Live Site Recovery is the former Site Recovery Manager, the orchestration of recovery plans. VCF Protection and Recovery is the 9.1 appliance and product; the title of Broadcom's KB 426669 names it "VCF Protection and Recovery (formally VMware Live Recovery)", so there VMware Live Recovery is the earlier name of that product. The VCF 9.1 FAQ uses the same name for a separately licensed product: it writes "VMware Live Recovery (on-premises cyber recovery)" and counts it among the products that "continue to be licensed separately". How the orchestration is licensed is the subject of our article on VMware Live Site Recovery after Broadcom.

Two Broadcom documents state the included replication interval differently. KB 428834, "Purchasing a Subscription for VMware Live Recovery", says that vSphere Replication "with an RPO 5 minutes or higher" is included in the VCF purchase and that an RPO of less than 5 minutes needs an Advanced Cyber Compliance subscription. The VCF 9.1 FAQ lists "On-premises disaster recovery with enhanced vSphere Replication and RPOs as low as one minute" in the core entitlement. If an interval below five minutes matters to you, ask for the entitlement in writing with the quote.

The appliance changed more than the entitlement. From version 9.0.4, Live Site Recovery and vSphere Replication are "a single converged appliance" (KB 445654), and the same KB says standalone replication stays covered by the vSphere or VCF licence. For 9.1, KB 444864 states that the standalone appliances "are deprecated in version 9.1" and that an in-place ISO upgrade from 9.0.2 is not supported: the path leads through convergence to the 9.0.4 appliance or, for minimal setups, a fresh deployment.

Snapshots, Changed Block Tracking and vCLS in vSphere 9.0 and 9.1

Broadcom's release notes for VCF 9.0 and 9.1, both last updated on 9 November 2026, describe changes in the mechanisms a backup job uses, without figures and without naming a backup product.

• vSphere 9.0. ESX 9.0 "enhances virtual snapshot tasks by adding more precise tracking of the progress of consolidation tasks" and can resume snapshot consolidation for offline VMs. vCenter shows the number of snapshots per VM and can delete unnecessary snapshots on a schedule.
• vSphere 9.1. "VCF 9.1 adds an enhancement to CBT enablement that removes the unresponsiveness of VMs during snapshot operations." Consolidation can be resumed for powered-on VMs, new safeguards "detect disk chain mismatches", and a "Max Data to Consolidate" metric can be tracked.
• vCLS. In vCenter 9.1, vSphere Cluster Services "is deactivated by default and you cannot re-activate the capability". Exclusion rules for vCLS VMs written for earlier versions should be reviewed.

The CBT sentence concerns the enabling of Changed Block Tracking, not snapshot removal in general. The requirements of CBT are the same for ESXi 8.x and 9.x in Broadcom's KB 320557: virtual hardware version 7 or later, no RDM in physical compatibility mode, no independent disks, and a full backup after CBT has been disabled and enabled again.

What did not change for VMware backup

The statements below rest on what the documents list, or do not list, on 12 November 2026.

• The interface. KB 311197: "Data Protection APIs are included with all licensed vSphere editions." The product list of that KB ends at vCenter 8.0 and ESXi 8.0.
• No deprecation notices. The Product Support Notes of VCF 9.0 and VCF 9.1.0 contain no deprecation or removal notice for the Data Protection APIs, Changed Block Tracking, VDDK, the NBD, HotAdd or SAN transports, VM snapshots, vSphere Replication as a feature or the protocols of the vCenter file-based backup. We could not open the VDDK 9.0 and 9.1 release notes that day and report nothing from them.
• Transport modes in Veeam. Hot-add, network mode, Direct NFS and Direct SAN all appear in Veeam's 13.1 release notes. How to choose between them is in our Veeam sizing guide for large VMware estates.
• Lockdown mode. The vSphere 9.0 security guide (pages updated 24 August and 19 October 2026) describes normal and strict lockdown mode and the Exception Users list without a note of change, and the 9.0 and 9.1 release notes do not mention lockdown mode.
• vCenter's own backup. Broadcom's comparisons list file-based backup and restore for vSphere Standard, Enterprise Plus, VVF and VCF.
• Standalone hosts. Veeam's version 13 release notes say standalone ESXi hosts "are fully supported"; continuous data protection requires vCenter Server.

After an upgrade to vSphere 9: what to re-check in the backup design

1. The Veeam build on every component. Veeam's upgrade blog of 10 September 2026 puts the backup server before proxies and repositories, which the console then updates; for a hardened repository see our guide to the Veeam Infrastructure Appliance.
2. The service account. The VCF 9.0 Product Support Notes say that vCenter 9.0 "discontinues support for Integrated Windows Authentication" and that VCF 9.0 requires the UPN format and "does not support legacy formats such as domain\username". Check how the backup server signs in to vCenter.
3. The vCenter role. Veeam's permissions guide for build 13.1.2.57 (page updated 1 October 2026) lists, under Virtual Machine, Edit Inventory, the privilege "Create (for VMware 8.x)" and in its place "Create from existing" and "Create new" for "VMware starting from 9.x". A custom role built for 8.x has to be checked against the new names, and vCenter 9.1 can export roles and permissions as a CSV file for that comparison.
4. Proxies and transport modes. Veeam's release notes keep the known limits: a virtual proxy cannot back up itself in hot-add mode, "CBT will be disabled for proxy VMs", and "Direct NFS Access is not supported for VMs with existing snapshots when VMware quiescence is enabled." After the upgrade, look in the job statistics at the mode each disk used.
5. A new vCenter. Veeam tracks VMs by their Managed Object Reference IDs, which change when a vCenter is replaced or re-created; the VM Migrator utility in the Veeam Backup PowerShell module handles that case. No Veeam document we read asks for vCenter or hosts to be added again after an in-place upgrade.
6. vCenter's file-based backup. Take a new one after the upgrade and keep the installer ISO that matches each backup you retain, as the vCenter guide linked above explains.
7. A test restore. Restore one VM of each tier onto a 9.x host and time it. This is our advice: one restore exercises the build, the account, the role and the transport mode together.

Our cyber resilience service includes Veeam-based backup and scheduled test restores; write to us about how your VMs are backed up today and which upgrade is planned, and our team will help.

Veeam licensing next to Broadcom's per-core subscriptions

Broadcom licenses VVF and VCF per physical core. Veeam's Licensing Policy (version 19, published June 2026) counts differently: under the Veeam Universal License one VM is one licence, and the older perpetual licences consume one licence unit "for each occupied motherboard CPU socket as reported by the hypervisor API". The policy has no per-core unit, and the words Broadcom, VCF and VVF do not occur in the text we read. Our conclusion from the two documents: the per-core model on the VMware side leaves the Veeam count as it was.

The policy states that "Perpetual per-CPU Socket licenses have ceased new sales" and still describes support renewals for socket licences and their merging with VUL. For socket licences only source hosts count; target hosts of replication jobs need no licence. One consequence is ours to add: a host consolidation changes the number of occupied sockets and with it a socket-based Veeam count, while a VUL count follows the VMs.

End-of-support dates that fall into the next budget year are the subject of our article on the IT infrastructure review before a budget cycle. An independent IT infrastructure audit covers backups and their restorability, and a tabletop exercise for an IT outage shows whether the team can act when a restore fails.

Our VMware optimisation service audits the estate and its licences and modernises vSphere, vSAN and NSX in agreed maintenance windows, with a rollback plan at every stage; tell us which versions you run and which you plan to reach.

FAQ