VDC Express Offboarding and Microsoft 365 Backup Protection Units

[dbr]

Hello guys,

since we migrated from Veeam Backup for Microsoft 365 to VDC, we are also using Express Backup. Unfortunately, since then we have been having issues with our Microsoft 365 offboarding process. Due to reasons, we have a rather complicated offboarding process where mailboxes of former employees are migrated from Exchange Online back to on-premises Exchange for archiving purposes (please don't ask ). As I understand it, VDC Express uses Microsoft 365 Backup in the background. Because of that, mailboxes cannot be migrated back to on-premises Exchange while a Protection Unit is still configured for the mailbox. Until recently, the offboarding process was manual as described in KB4766 - How to Offboard Protected Mailboxes in Microsoft 365 Backup Storage We tried following that process, but even Veeam Support did not really know what to do with it in our case (Case #07988162). In the meantime, there is now an Offboarding button in the VDC UI (see Offboarding Protection Units - Veeam Data Cloud User Guide). However, it does not seem to behave the way I expected. At least it appears that the Protection Unit is still active, even though the user was successfully offboarded using the new feature and is now shown in an Unprotected state. The error message we receive when attempting to migrate the mailbox off Exchange Online to on premises is:

Code: Select all

'<identity>' can't be moved between organizations because it is protected by a Microsoft 365 Backup-based backup solution. Please offboard this mailbox from backup protection to enable this action.

Is there any way to remove the protection early due to GDPR requirements?

To be honest, I still do not fully understand how Express Backup, Microsoft 365 Backup, and Protection Units work together. Maybe someone can shed some light on this and explain what exactly happens in the background.

Thanks in advance!
Daniel

[bill.weidenborner]

Hello Daniel,

So it looks like you are on the right path but the impact won't be immediate with the offboarding process. In the documentation page you linked to about VDC Express Offboarding, you'll see a section for Offboarding Grace Period. I'm afraid you'll need to wait the 90 days that required for the protection to be fully offboarded before the restriction will be removed.

BillW

[dbr]

Hi Bill,

I was afraid that this is the case. For this part we then will investigate with Microsoft directly. But could you also explain what the process is if the users were excluded from scope (we use a dynamic group) and no active backup is taken anymore? What will then be the retention, 1 year? And it seems that the offboarding process (with 90 days grace period) is a manual task. Is there a way to automate this through VDC or directly trough Graph API? Because of the number of offboarded users it’s not really practical to do it manually.

[bill.weidenborner]

Hello Daniel,

Yes, if you remove the user from protection then the retention of the backups is 1-year. Unfortunately, because this is a destructive task, automation or further expedited offboarding is not permitted. This should all be GDPR compliant and is done as a safeguard against malicious or accidental purging of data.

Bill W.

[dbr]

Ok, with that information we can work. Guess we then will have to slightly adjust our offboarding process but that clarification I couldn't find in any forum or blog. Thanks a lot for clarifying.

[dbr]

One last question: In VDC I can see a mailbox that isn't member of the dynamic group configured in express backup policy anymore. The given user is shown as unprotected in Express Restore but the offboard button is greyed out and I also cannot find an unprotected protection unit entry by using Powershell:

Code: Select all

Import-Module Microsoft.Graph.BackupRestore
Connect-MgGraph -Scopes "BackupRestore-Restore.ReadWrite.All"
$PolicyId = Get-MgSolutionBackupRestoreExchangeProtectionPolicy | Select-Object -ExpandProperty Id
Get-MgSolutionBackupRestoreExchangeProtectionPolicyMailboxProtectionUnit -ExchangeProtectionPolicyId $PolicyId -All | where-Object { $_.Status -eq 'unprotected' } | Select-Object Id, DisplayName, Email, Status

Any clues?

Mmh, as we currently also have issues in general with express backup this issue might be related to that and we may have to open another case...