How to create Azure blob for Microsoft 365 backup

[lastsamurai]

Hello Folks

I am new here, and trying to setup Microsoft 365 backup, i need help to create Azure blob for that, with best security possibilities, I am more concern about Public Network Access.
what option i should pick, are there any certain IPs Veeam use to communicate with Azure blob etc. I just don't want to expose blob to public unintentionally.

[lastsamurai]

65 Views but no help

[Mildur]

Hi Last Samurai

I assume you have installed VB365 in your on-Premise Environment?
You may use storage account network access rules to configure which public IP can access your storage accounts.
https://learn.microsoft.com/en-us/azure ... ure-portal

You need to allow the public ip address from your backup server and all proxy servers to access the storage account.

Azure also has another feature to protect the access. "Azure Private Link" and "Azure Private Endpoint".
But we have not tested this services together with VB365.

Thanks
Fabian

[lastsamurai]

thank you for your reply

actually we are small company with almost 300 users. i have not installed server yet at this point but still looking Best practice.

i still have couple question, if you

• in house server or on cloud (F - D type) on cloud almost $558/month which maybe too much for non-profit org.
  
  Repositories type snapshot or item level.
  
  how many job 1. (Exchange) 2. (team, Sharepoint, OneDrive)
  
  User membership (on prim group or Azure dynamic security group)
  
  is there any way/tool to tell how much objects and how much data we will backup using Veeam.
  
  how many repositories should have. is that 1 to 1 or we can have Mail on 1 and Team, sharepoint, Onedrive on 2nd.

want to under stand how backup works like Data Flow, let say if i install backup server in house then are we download all Micosoft 365 data first and then backing up on Azure blob ? and is that all the time or its first time etc. i found below info from Veeam site.

• Veeam Backup for M365 downloads the data from Microsoft M365
  Veeam Backup for M365 create the objects, and calculates a MD5 hash on the objects
  Veeam Backup for M365 then sends the objects to the object storage (AWS/ Azure/ S3-compatible)
  The object storage itself calculates also a MD5 hash and returns it to us.
  If that matches our calculated hash, the data is written away correct

[Mildur]

Hello

in house server or on cloud (F - D type) on cloud almost $558/month which maybe too much for non-profit org.

Depends mostly on your available budget. We support both implementations.
You can also call a Veeam service provider if you don't want to host and manage the backup server yourself.
https://www.veeam.com/find-partner.html ... Office+365

Repositories type snapshot or item level.

I recommend snapshot, if you want to have "backups" of the entire current state of a mailbox or SharePoint side. Item Level only protects single items within the retention period. Snapshot protects the entire mailbox, OneDrive or SharePoint side with all items.

how many job 1. (Exchange) 2. (team, Sharepoint, OneDrive)

I would do 1 for Exchange, 1 for OneDrive and 1 for SharePoint and Teams.
Please use different repositories if you have different retention requirements.

User membership (on prim group or Azure dynamic security group)

300 User in a single Exchange Online job will not be an issue. I would add "Organization - Mailboxes" to the backup job. And you don't need to care about editing a mailbox job when a new user joins your company.

is there any way/tool to tell how much objects and how much data we will backup using Veeam.

You can use the following calculator:
https://calculator.veeam.com/vb365
We also provide a PowerShell scripts to collect the required data. Please read the description before using it:
https://github.com/VeeamHub/veeam-calcu ... -VB365Data

how many repositories should have. is that 1 to 1 or we can have Mail on 1 and Team, sharepoint, Onedrive on 2nd.

Teams and SharePoint should be in the same repository, because they share a lot of source data.
How many SharePoint and Teams sites do you need to protect? Our configuration maximums may need an additional proxy which means a new repository:
https://bp.veeam.com/vb365/guide/design/maxconfig.html

want to under stand how backup works like Data Flow, let say if i install backup server in house then are we download all Micosoft 365 data first and then backing up on Azure blob ? and is that all the time or its first time etc.

Correct. Data flow will always be like this:
- M365 tenant > VB365 proxy Server > Azure Blob Storage

Our VB365 proxy server converts the source data into backup data objects and stores it to the Azure Blob Storage. The first backup will be a full backup. All subsequent backups to the same repository will be forever incremental.
The cache is required for VB365 to know which data is already protected in the Azure Blob Storage.
When the backup job runs, VB365 will check every new item against the cache. If it was already protected in the same repository by the same or another job, it won't be copied to azure blob again.

Best,
Fabian

[lastsamurai]

Thank you Fabian, this detail answer helped me a lot. really appreciate it.

[Mildur]

You're welcome.
Please let me know if you have any further question about this topic

Best,
Fabian

[lastsamurai]

i made one test backup for only one user mailbox, but when try to restore i am getting error

Failed to open mailbox
abc@xyz.com
failed to access mailbox.
the specified object was not found in the store. Default folder root not found.

do i need to setup some permission, i am using global admin account to create and restore.

[Mildur]

Hello

How are you doing the restore? With Modern Authentication or with Basic Authentication?
If you do it with Modern authentication, please also check if your app registration has all the required restore permissions:
https://helpcenter.veeam.com/docs/vbo36 ... or-restore

Note: You should only use Modern Authentication because Microsoft is already basic auth in all tenants since October 2022. On January 1st 2023, basic auth won't be possible anymore.

Best,
Fabian

[lastsamurai]

Hello

I am using Modern Authentication, it seems i have all permission, but i cant confirm this "ApplicationImpersonation" role

"ApplicationImpersonation and Global Administrator or Exchange Administrator — required for data restore with Veeam Explorer for Microsoft Exchange."

these are the permission i have.

Microsoft Graph (10)

Directory.Read.All Delegated Read directory data Yes Granted for
Directory.Read.All Application Read directory data Yes Granted for
Directory.ReadWrite.All Delegated Read and write directory data Yes Granted for
Group.Read.All Application Read all groups Yes Granted for
Group.ReadWrite.All Delegated Read and write all groups Yes Granted for
Group.ReadWrite.All Application Read and write all groups Yes Granted for
offline_access Delegated Maintain access to data you have given it access to No Granted for
Sites.Read.All Delegated Read items in all site collections No Granted for
Sites.Read.All Application Read items in all site collections Yes Granted for
TeamSettings.ReadWrite.All Application Read and change all teams' settings Yes Granted for

Office 365 Exchange Online (2)

EWS.AccessAsUser.All Delegated Access mailboxes as the signed-in user via Exchange Web Services No Granted for
full_access_as_app Application Use Exchange Web Services with full access to all mailboxes Yes Granted for

SharePoint (4)

AllSites.FullControl Delegated Have full control of all site collections Yes Granted for
Sites.FullControl.All Application Have full control of all site collections Yes Granted for
User.Read.All Delegated Read user profiles Yes Granted for
User.Read.All Application Read user profiles Yes Granted for

[lastsamurai]

Actually i am able to restore.

I had to add my account in Exchange Admin Center --> Roles ---> Admin Roles ---> then "Application Impersonation" Role.

after that I am able to restore from backup.

[Mildur]

Hello

Thanks for the update.
It's documented in our user guide in this chapter:
https://helpcenter.veeam.com/docs/vbo36 ... tml?ver=60

Best,
Fabian

[lastsamurai]

i am now doing my Second job where i am doing Backup for OneDrive for same group as email ones, but Veeam just found 6 Object for OneDirve, that user group have almost 230 user, i had no issue while i was making making backup for email, all user have same type of MS license.

[Mildur]

OneDrive gets provisioned for a user account when the the user the first time has connected to his OneDrive. Before there won’t be any OneDrive data for this user. Could you please check if OneDrive was provisioned for all expected users? You may check it in the M365 admin center in the user properties if all the users already have OneDrive assigned.

Thanks,
Fabian

[reddygs]

To create an Azure blob for Microsoft 365 backup, you can use the following steps:

• Create an Azure storage account.
  Create a container in the storage account.
  Configure Veeam Backup for Microsoft 365 to use the Azure blob as a repository.
  Steps to configure Veeam Backup for Microsoft 365 to use the Azure blob as a repository:

Open the Veeam Backup for Microsoft 365 console.

• Click the Repositories tab.
  Click the Add button.
  Select Azure Blob Storage from the list of repository types.
  Enter the following information:
  Storage account name: The name of your Azure storage account.
  Container name: The name of the container in your storage account.
  Access key: The access key for your storage account.
  Click the OK button.

Once you have configured Veeam Backup for Microsoft 365 to use the Azure blob as a repository, you can start backing up your Microsoft 365 data to the Azure blob.

Additional information:

You can use the Veeam Backup for Microsoft 365 calculator to estimate the amount of storage space required for your Microsoft 365 backup.
Veeam Backup for Microsoft 365 supports both snapshot and item-level backups.

You can use Veeam Backup for Microsoft 365 to restore your Microsoft 365 data to the Azure blob, or to an on-premises environment.
Note: Microsoft is deprecating basic authentication in Microsoft 365. You should use modern authentication when configuring Veeam Backup for Microsoft 365.

If you are using modern authentication and are still getting an error when restoring your Microsoft 365 data, you can try the following:

Make sure that your app registration has the ApplicationImpersonation role.
Make sure that you are using the correct user name and password when restoring your Microsoft 365 data.
If you are still having problems, you can contact Veeam support for assistance.

Medha Cloud:

Medha Cloud is a Microsoft Gold Partner and Veeam Cloud & Service Provider (VCSP) that offers a range of Microsoft 365 backup solutions, Microsoft 365 Migration Services including on-premises backup, cloud backup, and hybrid backup