Cannot restore OneDrive items after upgrading from 5a to 5b

[steveduffy]

Case - 04655843

Hi,

I'm currently using 'modern authentication with legacy protocols allowed' and when on v5a I logged a case (04614912) because I couldn't restore Teams items due to an authentication issue. Apparently, this was due to 'modern authentication with legacy protocols allowed' not being supported. Not good, as I cannot see the point of being able to back it up, but not able to restore it!

Today, I upgraded from 5a to 5b and now I get the same authentication error when trying to restore OneDrive items as well.

Each restore failure of a OneDrive or Teams item is using 'Basic Authentication' with an app password, and the error is 'Federated service at https://autologin.microsoftazureread-sso.com/............. returned error: Authentication Failure'.

Has anyone on 5b tried restoring a OneDrive item?

Thanks,

Steve

[Mike Resseler]

Steve,

Please create a new case.

And just so I understand it, you are using modern authentication with legacy protocols, but when you restore you use basic authentication?

[steveduffy]

Hi Mike,

I originally logged a call (04614912) back when I upgraded to version 5a and had the authentication failure message only with Teams restores. This call was closed as Veeam support said you cannot restore Teams items if you use modern auth with legacy protocols.
I then upgraded to 5b on Friday and found I now have the same authentication failure message when restoring OneDrive items, which worked fine in 5a. This call is 04655843.
Your understanding is correct, the organization is configured with Modern authentication with 'Allow for using legacy authentication protocols'. When I perform a restore, it defaults to Basic authentication, and I have to use an app password as the account is MFA enabled. Is this the correct way to have it set up and restore?

[Mike Resseler]

Please keep working with the support engineers. It looks like they will need the new explorer logs

[rlspeeks]

What ever happened with this issue? This is happening to me as well. Exact same setup. Please and thank you.

[nielsengelen]

Hi Rebecca, please open a support case and let us know the case ID for follow-up. Thanks!

[rlspeeks]

Case # 04652480

[rlspeeks]

My case didn't start out that way since it was opened almost two weeks ago and this issue just popped up, just FYI since that is probably not in the title of the case. However, logs have been uploaded and I'm having the same issue as @steveduffy

[rlspeeks]

Any updates on this? My Case # 04652480 is not moving very much. They want me to attempt to use a cloud only account?

[Mike Resseler]

Rebecca,

I looked into the case and not sure what is going on there or what direction they are letting you go. Did you apply already the latest MSP?

https://www.veeam.com/kb4124

There is a specific fix for what I think might be your issue: "OneDrive and SharePoint items restore with modern auth with allowed legacy protocols may fail with an authentication error."

[Polina]

Hi Rebecca,

Is the account that you're using for restore enabled for MFA or not? cause this is what makes the difference for selecting the right auth method in VBO.
If it's an MFA-enabled account, you should use a username and app password for restore. If it's a regular account, use a username + a regular password.

[rlspeeks]

Thank you Mike, testing the fix now.
Polina, so, Basic Authentication cannot use MFA? I ask b/c the documentation is hazy. All it says is:
“The user account must be provided in either of the following formats: user@domain.com or user@domain.onmicrosoft.com. If you are using an ADFS account, you can only use a non-MFA enabled ADFS account.”
It only mentions if you are using an ADFS account, what if you are not?
We currently have it setup with an MFA enabled account using an app password.

[Polina]

In the wizard, there're two possible options under Basic auth: you either provide a user name + regular password (if the account you use is non-MFA enabled), or a user name + app password (if the account you use is MFA-enabled). And to restore to O365, the account name should be in the user@domain.onmicrosoft.com format. Makes sense?

[rlspeeks]

No, sorry. I only see one option under Basic Auth? https://helpcenter.veeam.com/docs/vbo36 ... tml?ver=50
Am I in the wrong place?

[Polina]

It depends on what issue you try to solve

The initial issue in this thread is about restores (i.e. restores for OneDrive), while you're now looking at the steps for adding an organization to the VBO scope.

[rlspeeks]

Polina, it doesn't matter, why be so vague? Is there or is there NOT two options under Basic Authentication? I only see one.
Yes, my initial issue is resolved now. In case anyone else is having the issue, the KB article Mike mentioned resolved it. https://www.veeam.com/kb4124
Thank you.

[Polina]

Hi Rebecca,

First, I'm glad that your issue is now resolved.

Next, (and I hope it'll be more accurate this time) what you see in the 'Add organization' wizard is absolutely correct. There is only one Basic authentication option, and this option is used to add an O365 tenant with a regular, 'old-fashioned', service account that is not enabled for MFA.

Thanks!