Secondary Target for Office 365 Backups

[rscurrah]

We would like to see the option to save backups to a secondary location (e.g. tape) in Veeam Backup for Microsoft Office 365.

Rich

[Polina]

Hi Rich,

Your request is noted.
You may also be interested to review this thread.

Thanks!

[kyle.manel]

Hi,

As a security professional myself, I have really appreciated Veeam software until I began using Office 365 Backups provided by Veeam.

This product is badly designed;
Any security implementer worth his wage will require both onsite and offsite backups for valuable information. This will require copying the backup files from a local store provided on the server operating Veeam backup for Office 365 AS WELL AS at least one remote site.

I can't believe this has not been identified by a company that creates backup software, though I can acknowledge it may have had a lower priority for development.

With that in mind, how can I find any worth in my backups if they are not capable of being replicated to prevent a loss due to failure.

[kyle.manel]

In any case here is the deal, I need to be able to copy the backup files so that contents can be recovered with appropriate system keys.
Can this be done (in a recoverable way) by;
Stopping the Veeam Backup for Office 365, and then copying the files (through a vpn/secure transport) to a remote site?
In cases of failure;
In such a way that I can activate these backups through a re-installed application?
In cases of remote access;
By activating the copied file when it is returned to a local directory on the Veeam Office 365 server itself?

[kyle.manel]

I have Veeam B&R is there any way to use its repositories with Veeam Office 365 Backup?

[robjohnston]

Hi everyone, There is a bit of a long winded response to this based on the way we store our Backups for O365 as we store these backups in a live running JetBlue DB format, i.e a living breathing DB vs in VBK,VIB format that we do in VBR, but just a heads up, for Offsite copies of VBO 365, we can co-exist Veeam backup for O365 and Veeam Backup and Replication for customers looking for offsite copies of their O365 backups to help meet the 3-2-1 rule. With Veeam backup and Replication we can protect the Virtualized or Physical instances of VBO O365 on Prem with VBR or via Veeam Agents, replicate them to a secondary location using Veeam replication and or schedule/backup these VM's to another Disk stage and then either off to tape, Cloud Connect Repo's etc even Object (9.5 U4 functionality due Q4 this year) Using the Explorers for Exch, SP we can then recover these from any tier. You will need to license per VM for the Servers in VBR However if you are not using VBR in your production environment. Alternatively If you are housing your O365 backups in AWS EC2 with EBS, we can leverage Cloud Protection manager as a part of our Veeam Availability for AWS and also protect these via N2W for application aware snapshots and Geo redundancy across AWS, and off to S3. Please reach out to your friendly neighbourhood Veeam Systems Engineer, who can architect the best solution for your requirements. We cannot point VBO365 primary backups to Existing Veeam Repositories at this stage, but using the above scenario we can send secondary copies via Backup Copy jobs to any Veeam Repository. Hopefully this helps.

[realsuperskye]

Rob, I am also wondering for this suggestion, if a separate VBO Repository server is used, should this also be included in backup using Veeam B&R or VAW (With AAP or VSS used for JetBlue live DB)?

I am guessing this would also be needed for full redundancy, but not sure how to best handle this as well in this sort of scenario.

I am working with an active case (03179491) who is looking for the best way to handle this as well, and just making sure to cover any bases here and that the restore scenario for this from tape makes sense and would actually work as intended.

[Mike Resseler]

Let me clarify some things with the above responses.

VBO can indeed be protected by our agents or by Veeam Backup & Replication. The advantage is:
* You can recover the entire service when it goes down
* You can indeed apply the 3-2-1 rule
* From VBR, you can still do item-level recovery since VBR will recognize the backup as a VBO instance and give you the possibility to use the Veeam explorers on it, without the need of recovering the entire VM or physical server.

So from my point of view best practices, you will protect the VBO service with VBR and then do a copy backup job to another location (tape/ secondary datacenter/ soon cloud...). It gives you still ILR (so rather fast recoveries from the second copy) and a good way to restore the entire service in case it breaks.

[kyle.manel]

Sorry, I am a little unclear still;
ENVIRONMENT: VBO and VBR are co-located on the same server.
I have a backup copy of Office 365, provided by the VBO app.
This app has been configured with the proxy provided by VBO.
This app completes successfully.

~ I am now, still, stuck on how to get this off-site.

I have tried:
Creating a copy of the files within VBR, by creating a server backup job to the Veeam server itself;
Source: VBO backup repo BASE-DIR // Destination VBR backup repo BASE-DIR
Reviewed [BACKUP INRFASTRUCTURE > Managed Servers > Microsoft Windows > Veeam Server] to rescan.
Started backup of the Office 365 directory.
~This returns the following report items;
Waiting for rescan job Rescan of AGENT] veeam.* - O365 - complete
Unable to process veeam.*: host rescan is required
Nothing to process

[Mike Resseler]

Kyle,

I'm afraid if the VBO and VBR are installed on the same server, the method doesn't work. If they are at the same server, you can't backup VBO with VBR. I will ask someone (give me some time to find the answer) if you can do it with the agents on such a server

[kyle.manel]

I'm not set to any specific solution, provided that I can automate the replication of Office 365 backups to an external location.

Though it would be necessary for this method to provide encryption for the transmittal.

[Mike Resseler]

Then I would move the VBO server separate from the VBR server and use VBR to replicate the VM. encryption will be delivered through VBR

[kyle.manel]

That's the last-case solution I will employ if an agent is not applicable, as Veeam software, excluding agents, doesn't run on Linux, and Windows provides a fair amount of needless pampering, I would prefer to utilize as few Windows machines as possible in my infrastructure.
TLDR; I would like to know if an agent can be used to resolve this issue, before moving forward.

[Polina]

Kyle,

With Agent Backup job, it's possible to back up an either entire VBO server or its repository folder specifically. To have an application-item restore from such backup, you can use FLR and a manual mount of the database.

[n2v]

Hello friends,

Carrying on when you guys left off... I have a similar issue and new to VBO.

I have created three Backup Repositories: Mailbox_Repo, OneDrive_Repo, Sharepoint_Repo

I want the following retention polices:

Daily for 31 Days
Monthly for 12 Months
Yearly for 7 Years

How can i implement these when VBO has limited Retention schemes please? Or even better, what would you recommend?

Should I use VBR to make a backup of the Repositories for the above retentions? (But then, how can you import these back into VBO and view them using the explorer?)

Your help and advice is greatly appreciated .

Thank you

[Mike Resseler]

Andrew,

Please see your other thread with ideas

Mike

[WolfgangK]

Hi!
Having the same issue that I need the VBO backups stored to secondary target/tape. Setup is B&R and VBO installed on one server, following test was successful:
1. Backuped the VBO-Repo Folder via B&R Tapejob to File.
2. For testing I deleted the original VBO-Repo.
3. "Explore" option in VBO is now inactive.
3. Restored the folders "2018" and "2019" from tape into a new created folder names "Testrestore VBO".
4. Added a new Backup repo in VBO and choosed the "Testrestore VBO" folder.
5. VBO recognizes that it's VBO backupdata in the folders 2018/2019 (even checked automatically that it's snapshot-based with retention of 1 year) and the "explore" option is active again and restore of single mailbox item worked.

BR

[Mike Resseler]

Hey WolfgangK,

First: Welcome to the forums!
Second: thanks a lot for your procedure, I am sure many will find this useful!

Cheers
Mike

[jsmeyer777]

We currently backup our O365 data into Azure storage. We are considering the approach WolfgangK suggested to make a copy of the backup repository into Azure WORM storage as our solution for an air gapped backup with a retention period of N. The WORM storage cannot be modified or deleted before N and hence we think this provides a strong control against ransomware or losing administrative control to a hacker. While it is not truly air gapped, we see no practical way to export 15 Tbs of backup set to on-premise to write to tape to stick in a vault. Seems like Azure WORM storage should function a lot like AWS WORM VTL. Thoughts or alternative ideas welcome.

Jon

[Mike Resseler]

Hi Jon,

I assume you talk about immutable blob storage? We haven't tested that scenario and copying data from blob to another blob is also something which I think won't work at this moment. That said, how would you approach this? Would you want backup of data and at the same time to a secondary (immutable in this case) location, or do you prefer a different approach?

Thanks
Mike

[jsmeyer777]

Mike, yes we are looking at immutable blob storage (see below). We would like to periodically copy a backup vault into immutable blob storage on a monthly basis (monthlies) and set the retention for something like 13 months. It's our answer to air-gapped which nobody seems to have figured out if you are backing-up cloud (O365) into cloud (Azure). Too slow and expensive to bring back to on-prem (for large data sets like 10 Tb+). Need to keep it in the Azure cloud and replicate air-gap. Immutable blob storage seems to meet this use case for ransomware protection / hacker take over.

Thanks,
Jon

Immutable storage for Azure Blob storage enables users to store business-critical data objects in a WORM (Write Once, Read Many) state. This state makes the data non-erasable and non-modifiable for a user-specified interval. For the duration of the retention interval, blobs can be created and read, but cannot be modified or deleted. Immutable storage is available for general-purpose v1, general-purpose v2, BlobStorage, and BlockBlobStorage accounts in all Azure regions.

[Mike Resseler]

@jsmeyer777 Got it. Thanks for that additional information.

No promises, but having some sort of 3-2-1 rule is a discussion point, and reviewing many options at this point in time so everyone's view on it is always interesting to hear for us

[jveerd1]

For some time we are looking for a solution to lower our Azure costs. We currently run Office 365 Backup on Azure VM's with managed disks as repositories. We backup the Azure VM's with the Veeam Agent to enable item level restores even when the Azure VM's are unavailable and to protect against human error / malicious users.
We would like to move to Azure Blob for object storage repository, but we have not yet figured out how to protect the object storage repository against human error or malicious users.
We just learned about mounting Azure Blob storage using BlobFuse. That would enable us to use Veeam NAS Backup to backup the object storage repository.
What's your opinion on this solution?

[Polina]

Hi Joeri,

I moved your topic to a similar discussion, so please take a minute to review the above responses.
As for the NAS backup for protecting VBO blob repositories, we didn't test it yet.

[dasfliege]

May someone can help me with the following problem?

We have a physical B&R server and a virtual VBO365/Cloud Connect server. As we're a service provider, we have one separate vdisk attached to the VBO VM for every customers repository. We use mount points instead of drive letters, to make sure we dont run out of drive letters.

Some time ago, i've backed up the entire VBO VM and all of its attached vdisks with B&R and was able to do application item restores for exchange, onedrive etc. directly out of B&R. As we now just have too much data to backup the entire VM, i've split it into several Jobs. Meaning i have one B&R backupjob for each VBO customer, backing up only the specific vDisk where it's repository sits.
The problem now is, that i can open a application item restore explorer from these backups, but there is no content listed. So for exchange restore, there are just no mailboxes visible in the explorer.

So my question is: Does B&R only support direct restore out of VBO365 backups if the entire VBO VM (all vDisks) have been backed up? Or what else am i doing wrong?

[nielsengelen]

Did you just split it in multiple jobs or also multiple servers/repositories ?

[dasfliege]

Multiple Jobs on the same B&R server, all pointing to the same SOBR

[pesos]

Subscribe. We are also trying to sort out the best approach now that so much of our data has moved to o365. What is the most straightforward approach to getting a secondary instance of VBO backup data into an immutable state to protect against ransomware?

[Mike Resseler]

@pesos How are you running your setup? Is it on-prem with Jet DB's? Is it in a cloud with object storage?

[pesos]

Hi Mike, currently we have an onprem repository (jet/refs).

Thanks!