Case #08071333 - Disaster Recovery Point in Time Restore for Mailbox

[troll]

Hi.
I opened a case for clarify how to do Disaster Recovery restores.

I did some tests and noted that not all mails were recovered after doing an Express restore.
Steps I did:
3:30PM Removed all mails from folder calls (oldest mail = 2 years old (so mails between 04.2024-04.2026) around 11000 mails.
Waited for total deletion (in Outlook Web you can see the number of items which are already deleted).
3:40PM Removed all mails from „deleted items“, same procedure. Waiting for the progress bar to be sure all are gone.
4:06PM Started Express job (Same date / timestamp 2:00 PM)

The result was that only the mails between 04.2024 - 11.2024 were back again, the other mails were still not restored.

Simple question:
How do I get a state in time restore for the mailbox which would fulfil my expectations for a disaster recovery (the loss of 1 or 2 hours incoming mail would be ok)

Thanks!

[bill.weidenborner]

So for clarification, you choose a restore point that was approximately a couple of hours before you actually deleted the emails?

[troll]

Correct.
And also removed all items from deleted items.

[bill.weidenborner]

I believe the reason it is not working is the choice of Restore Point being two hours before the actual mass deletion event. If you choose a restore point that is nearest one preceding the deletion event, it should restore all the emails that were deleted.

From the description, it appears the emails from 04.2024 - 11.2024 had already been deleted at the time of the backup of the restore point you chose.

[troll]

Hi Bill,

thanks for your reply, but when the restore point is from 2PM and I deleted all items in the folder at 3.30PM, I assume the items should be in the 2PM restore point, otherwise the restore time Veeam shows is not correct and should be fixed.
And no, the mails between 04.2024-11.2024 were not removed earlier than 3.30PM.

In case of DR I will of course use the nearest restore point to the Desaster time, and in my understanding the Microsoft Backup (Rapid Recovery) (which should be Veeam Express) is able to do this, according to the information I get about:
Microsoft 365 Backup (Rapid Recovery)
For comprehensive data recovery against ransomware or mass deletion, Microsoft offers a dedicated backup service.
Frequency: Backups for Exchange, SharePoint, and OneDrive are captured as frequently as every 10 minutes.

https://techcommunity.microsoft.com/blo ... ry/4456639

So the question is still. How can I get a state in time restore with Veeam in case of DR (ransomware or any other worse-case-scenario)?
When I select 2PM, I want the exact mailbox content of 2PM and not run any additional Flex jobs afterwards.

BR
Sascha

[bill.weidenborner]

Hello Sascha,
I'm afraid there is an aspect of how Express (and MBS) Exchange backup works that is different than Sharepoint and OneDrive that makes your assumption not fully accurate. The restore points and their related backups only contain items that have been modified/deleted items from a prior point in time. It is an append-only architecture. It does not restore the full state of the mailbox at that point in time. So by choosing the 2pm restore point, it actually does not contain those later-deleted emails, as they hadn't been altered or deleted yet. This is not particular to Veeam's solution.

Exchange Online item modification protection

Exchange Online Backup technology creates point-in-time copies of modified and deleted mailbox items. These backup copies, once created, aren't modifiable by the service. A new copy is taken based on changes to the primary data at scheduled restore point frequency targets.

See the Restore options row in this M365 documentation:
https://learn.microsoft.com/en-us/micro ... -worldwide

[troll]

Hello Bill

"Full and item level mailbox restores only modified/deleted items from prior point in time"
https://learn.microsoft.com/en-us/micro ... -worldwide

For my understanding this is how I assume it.
"Restore deleted items from prior point in time" means "Items I modified or deleted after the point in time will be restored."
Otherwise it would not make any sense.

If am wrong or right, doesnt matter. The question is still how can I achieve a Desaster Recovery for my Premium licenses mailboxes.

Thanks
Sascha

[bill.weidenborner]

Hello Sascha,

To recover all the deleted contents, you should choose the restore point that is considered 'Last Known Good' state of the inbox. So in this instance 2 hours before hand is too far in the past, so you should choose the restore point that is right before the deletion event as that is where there the deleted and modified items will be backed up. This along with the existing items in you mailbox should give you a complete recovery. I understand that the logic being different from Flex makes this solution less intuitive.

Please let us know if the above approach works as described.

Bill W.