Best Practice for Backups Using O365 Groups in Hybrid Environment

[gberkshier-smi]

We have a hybrid Exchange environment with onsite Exchange (for service accounts, external contractors and shared mailboxes that we don't want to consume a full O365 license on) and EOL (for the employees). I'm struggling to find a way to setup a backup job that backs up Exchange and OneDrive data. I want to use an O365 group that will grab anyone that has an O355 license and back their mailbox and OneDrive data up in Veeam O365. The internal Exchange mailboxes will get backed up in regular Veeam on the other backup server. I've tried to utilize an "All Employees" O365 group that is fairly well managed by our IT staff when people come and go from our organization. But using that group doesn't get the miscellaneous room and resource Exchange accounts in EOL, so I would have to manually add/remove mailboxes to the groups when needed. We created a new dynamic group that backs up anyone with the @-----.org domain on our login domains, but doing this makes the backup job look for mailboxes that aren't located in EOL, so that generates a lot of warnings that the mailbox doesn't exist.

Do any of you have any helpful tips on how to manage a group that can be tied to our backups (preferably a dynamic group) that will always ensure that any account EOL will get backed up, and we don't get warnings when the job tries to backup a mailbox that doesn't exist in EOL? I'm fully aware that there are one-off situations where I'll still need add/exclude a mailbox from time to time, but I just don't want to have to worry about manually maintaining a group tied to the backups, because someone will forget to add or remove a mailbox at some point. I just want this whole process to be as automated and as fluid as I can make it - like what we do in regular Veeam with VM tags and folders - as long as we ensure a VM is tagged or in particular folder, it's always going to get backed up.

Now before any of you say to "just backup the entire organization in one job", I want to keep the Mail/OneDrive data in one job, the Personal Site data in a second job, and the Group Teams/SharePoint data in a third job. Even if I had the entire organization in one job, I think I would still have the issues with the local internal Exchange mailboxes trying to get backed up.

Anyone have a tip or workaround that might be easy to implement? I'm probably missing something easy and obvious.

[c2nathan]

There's a thread already open with people dealing with (what seem like) similar issues, including one where @nielsengelen has provided link to a PowerShell script he has written that looks like it should fit your needs. The OneDrive sites should be https://{initialdomain}-my.sharepoint.com, so if you filter for "-my.sharepoint.com" you would hopefully hit all the OneDrive data.

https://github.com/nielsengelen/veeam-p ... Filter.ps1

[gberkshier-smi]

Yeah, that looks like it may be helpful. Thanks for directing me to that. I'll give it a test and see how it works for us. How exactly is that $Filter = "BE" variable used? What is that for?

[nielsengelen]

The script should be able to be modified to reflect what u want. The $Filter tag will match against SharePoint sites starting with a parameter (in this example BE from BElgium )

Am I also correct in understanding you want to make a job with all the licensed O365 users? As it would also be possible to read these via PowerShell (MSOnline module) and afterward populate the backup job. Do you also need those Exchange accounts in EOL in VBO? Since these are being backed up by VBR from what I understand?

However, I think it also works if u add the whole organization to a job and only select Exchange/Archive to be backed up and in another job, you add OneDrive only.

If u could give me a bit more clearance on it, I can look into building a custom script for it.

[Polina]

Hi Glenn,

My 2 cents: if currently, resource mailboxes are the missing part not included in the "All Employees" group, why not create a separate dynamic distribution group that will only include this type of mailboxes?

[gberkshier-smi]

Here is how I have my backup jobs configured:

Job 1 - Member Mail/OneDrive data - this job points to an O365 group that is comprised of all employees
Job 2 - Member Site data - this job points to the same O365 group as job 1
Job 3 - Organization Sites Data - This job is pointed to the O365 organization and only backs up Sites data

My issue happens in Job 1 and Job 2. We are using a hybrid Exchange environment, so we have the majority of our users in EOL, but there are a bunch of mailboxes in our internal on-site Exchange that we don't want to use an O365 license for (service accounts, some shared mailboxes that forward out, etc). The O365 group we use is supposed to be maintained by our O365 admin, and employees get added/removed to/from the group when someone comes/leaves our organization. As what typically happens, people forgot to make these changes, so we get alerts when Veeam is trying to backup an EOL maiibox/OneDrive data that doesn't exist, so I get warnings. Rather than having to manually maintain this group, we created a new dynamic group that automatically adds any accounts from our domain (using the UPN). This works fine, except that the group now contains all of the internal accounts from our on-prem Exchange server, and I get even more warnings that those mailboxes don't exist.

I just wanted a way to dynamically have whatever is active in our O365 licensing get backed up when they start, and stop when they leave.

Polina, what parameters would I use to create that dynamic group? I'm not the one that typically deals with O365 groups.

[gberkshier-smi]

I was searching some articles online, and found this:
https://toastit.dev/2019/02/26/veeam-365-selective/

Is this a solution that would work for what I'm doing? From what is explained in the article, this will only add users to these dynamic groups if they are mailbox users in EOL, and if they have ever logged in to OneDrive.

If this works, this would be exactly what I need.

[nielsengelen]

If I quickly go over the blog post, it will use groups like u do right now and I think you will get the warnings as well.

The solution would be to update your dynamic group based upon active SKU’s in O365 and back up that group.

[gberkshier-smi]

How do I create dynamic groups for that? What parameters do I use? I know where to create the groups, but the settings to filter on don’t seem to have much to pick from that are very helpful.

[gberkshier-smi]

Anyone? Hello?

[nielsengelen]

The idea of a dynamic group is that you have a group which dynamically changes as you have new users in O365.

I will try to come up with a script but that may take some days.