backup onedrive question

[mrshahin]

Hi Guy's,

We did download and install Veeam for office365 and run a test backup of one drive and exchange online mailbox.
Now I come accross a really strange issue, when for example create a word document in the one drive and try to share this document I see my own user name as owner of the document and also the name of the account that we use to run the Veeam with and access our Office 365 organization also as owner of the document!!

Any idea why is this happening? and if we can corrcet this.

[Polina]

Welcome to the community, Pietje!

This looks strange as the VBO backup process doesn't affect any O365 permissions.
To clear things up a bit, have you performed any OneDrive restores yet? or are you just creating and sharing a new .docx file in your OneDrive?

[mrshahin]

Hello Polina,

Thanks for your reply,

we have created a new account for VBO and synced it with our O365 and made this new user the globle admin, after that, we backup my mailbox and 3 other mailboxs.
Now when create a document and safe it in my onedrive and after that open the same document from Word 2016 and click on share this document, there I will see my own name as the owner and also the name of the VBO account as owner of the my doc.
Just to be sure we create a second test account and again run a new backup of my onedrive with this new test account. Now when follow the above steps, I see my own user name and the first VBO account and also the new account for VBO as the owner of the document.

I follow your suggestion and resotre my onedrive to a week before the testing took place but still see both VBO accounts under the owner of a document.

Thanks

[Polina]

Pietje, thank you for this question.

I confirmed the behavior in my environment and also got the confirmation from our QC team: During the backup, VBO account is added as a Site Collection Administrator and hence it appears as an owner for all the corresponding sites and their content (including OneDrive).

[mrshahin]

Thank you for the update,

I have to say that I am disapointed, coz now when the CIO of the company going to share any of his document he will see that othere user is also is the owner of his document and I am sure he will not like it.

As I siad I have now two accounts that we see both VBO accounts as the owner beside mijn, is it possible to remove one of them?

[Polina]

If you remove the unneeded VBO account from Site Collection Administrators, it won't appear in the list of owners anymore.

[mrshahin]

Hello Polina,

Are you sure removing the VBO user from the site collection administrators will remove the VBO user from the onedrive as well? I did remove one of the the VBO users but still see the user when try to share a document in onedrive.

Any suggestion?

Thanks

[Polina]

Hi!

OneDrive is technically part of SharePoint, so the answer is yes.

The following script might be helpful for you to remove the extra account from the site collection (and I believe, it can be modified a bit to apply to all site collections if needed):

Code: Select all

$AdminURL = "https://youradminurl.sharepoint.com/"
$userAcc="name@yourorganization.onmicrosoft.com"
 
#Connect to SharePoint Online
Connect-SPOService -url $AdminURL -credential (Get-Credential)
 
#Get the Site Collection
$Site = Get-SPOSite "https://yoursitecollectionurl"
 
#Remove user from site collection admin
Set-SPOUser -site $Site -LoginName $userAcc -IsSiteCollectionAdmin $False

Hope this helps.

[Polina]

Hi @mrshahin,

Upon a few internal discussions on the matter, it feels that there's more to add to my previous responses:

Site Collection Administrator role is required for the VBO service account to be able to protect your data, including the permissions and versions.
This service account can be removed from Site Collection Administrators (and correspondingly from the list of owners in ODFB), but it will be added again automatically on the next backup job run.

Also, I've got a more convenient way suggested for you to remove your test VBO service account:

Code: Select all

Connect-SPOService -Url https://companyname-admin.sharepoint.com -Credential (Get-Credential)
$Sites=Get-SPOSite -Limit all
foreach($Site in $sites){
    Set-SPOUser -Site $Site.URL -LoginName "name@myoraganization.onmicrosoft.com" -IsSiteCollectionAdmin $False
}

Thanks!

[mrshahin]

Hi Polina,

Thanks for your reply,

One of the test users is my own account and I must be still able to do tasks that I did before running the VBO.
So what we really want is only remove my own account that we see as owner on other users document and still be able to my daily works.

Thanks

[Mike Resseler]

Hey Pietje Puk
(PS: I love that name, those are great books and memories from my childhood )

If I understood it correctly, then that test account is your own account so it should be removed as owner from everything BESIDES your own OneDrive for Business library. Any other sites you need to be removed? If so, you are going to add an additional check in the foreach so it doesn't remove it from that specific list.

Your OneDrive will have something like this:
https://myorganization-my.sharepoint.co ... drive.aspx. You can see it quickly by right-clicking on your OneDrive for Business folder in Windows Explorer, choose go to browser and then you see the URL.

To be really sure, I would advice you to run the script Polina has provided, but export the $sites to a CSV or text file or something (so don't do the foreach), and then you can remove the sites you need and run the Set-SPOUser command in a foreach while reading out line by line in the text file.