MS Teams and Private Channels

[habibalby]

Hello Guys,
I've just started backing up MS Teams with Veeam o365 and since Veeam doesn't support private channels, you may need to get the private group URL in order to backup the contents in private channels of teams.

Code: Select all

#This script will get you the entire UnifiedGroup in your tenant.
$Sites = Get-SPOSite -Template "TeamChannel#0"
ForEach ($Site in $Sites) {
$SPOSite = Get-SPOSite -Identity $Site.url -detail
$Group = Get-UnifiedGroup -Identity $SPOSite.RelatedGroupID.Guid
Write-Host "Team" $Group.DisplayName "owns private channel site" $Site.URL}

Code: Select all

#This script will give you the SharePoint url of each private channel in single Team only. 
$sites = get-sposite -template "teamchannel#0"
$GroupID =  "defMS-TeamGroupId70a2cb3db" #or $GroupId = Get-Team | Where {$_.DisplayName -eq "BAH-Test"} | Select GroupId
foreach ($site in $sites) {$x= Get-SpoSite -Identity $site.url -Detail; if ($x.RelatedGroupId -eq $groupID) {$x.RelatedGroupId;$x.url}} 

Once you have all the URLs, then you can populate them in an existing job;

Code: Select all

#Have a text file contains the site URLs and a header name called Site. 
$Org = Get-VBOOrganization -Name "cxcxcxc.onmicrosoft.com"
$Job = Get-VBOJob -Name "Test"
Import-Csv -Path C:\Scripts\SitesURL.txt | ForEach-Object{
$st = Get-VBOOrganizationSite -Organization $Org -Url $_.'Site' 
$newSite = New-VBOBackupItem -site  $st
Add-VBOBackupItem -Job $Job -BackupItem $newSite
} 

Hope it helps.

Thanks,

[Mike Resseler]

Nice one!

Thanks for sharing it with the community!

[habibalby]

Sharing is caring...

[Keith.Gregory]

I got a bit lost in the three steps above, but using that knowledge I created this script that adds all the secured channels in "YourTenant" to a job called "SecureSites" when run from the VEEAM Console PowerShell. This appears to backup all the content, but as a SharePoint backup not a Teams backup. It took me a bit of trial and error, so if it helps save some time

$credential = get-credential
Connect-SPOService –url https://YourTenant-admin.sharepoint.com -Credential $credential
#This script will get you all the secure channels in your tenant.
Set-Content -Path "c:\scripts\SitesURL.txt" "Site"
$Sites = Get-SPOSite -Template "TeamChannel#0"
ForEach ($Site in $Sites) {
$SPOSite = Get-SPOSite -Identity $Site.url -detail
Add-Content -Path "c:\scripts\SitesURL.txt" $Site.URL }

$Org = Get-VBOOrganization -Name "YourTenant.onmicrosoft.com"
$Job = Get-VBOJob -Name "SecureSites"
Import-Csv -Path C:\Scripts\SitesURL.txt | ForEach-Object{
$st = Get-VBOOrganizationSite -Organization $Org -Url $_.'Site'
$newSite = New-VBOBackupItem -site $st
Add-VBOBackupItem -Job $Job -BackupItem $newSite
}

[Mike Resseler]

Thanks for the sharing! Really appreciated

I hope we will have better solutions to backup those soon, without the need of enumerating them through these methods. Fingers crossed we get the needed API's

[habibalby]

Glad to see people are happily using the scripts to get their job run efficiently.

[andreas.karl@sws.de]

@Mike Resseler:
is there planed to restore privat channels in tehams?
Please have a look at this site: AvePoint have the API to backup private channels
https://afi.ai/blog/microsoft-teams-backup#final

[Mike Resseler]

It is planned but I can't give an ETA yet.

[dasfliege]

Is this a drawback since the official teams support for VBO365 has been introduced or have private channels (files) never been backed up, even with the sharepoint backup prior to teams integration? We actually weren't aware that this is a limitation and that's quite a big issue if you provide baas for customers.

[Mike Resseler]

They are actually protected. Imagine that you and I have a conversation privately, then those chats will be protected in my and your inbox. But today we can't restore them as an HTML, they will need to be restored as separate messages

[dasfliege]

Well chats are one thing, but we're talking about private channels, which contains files. I guess those aren't protected? At least im unable to find private channels in teams or sharepoint backup explorers.

[Mike Resseler]

Correct, that is still a work in progress. The issue with those is the rights model behind it

[dasfliege]

So back to my original question. Is this just a problem since teams backup has been natively included in VBO365, or was this data also not included back in the days, when we had to backup sharepoint in order to backup files located in teams?

[Mike Resseler]

Sorry, missed your reply.

Yes, those files are included if you have selected the proper sharepoint site as a sharepoint backup. You will see in your list that you will have the name of the sharepoint site for the team, and another sharepoint site called TeamName - Private_Channel or similar. You will need to protect that to be able to get the files inside

[dasfliege]

We backup the whole organisation, so everything in sharepoint should be included. But i don't see private channels when browsing the restore points. Any explanation for that?
Also if i go through the "Add Object to Backupjob" wizard, i don't see any sites named "TeamName - Private_Channel".

[Mike Resseler]

Can you see TeamName - Name of the channel?

[dasfliege]

No i don't. Only way to get them seems to be the script above.
However, i set up the scripts for our organization and did a backup of all the private channels. I am now able to see them in sharepoint explorer for restores, but there aren't any files inside.
Has anyone been able to successfully restore files located in private channels by using the scripts above?

[Polina]

I did a quick test of the script and it works for me without any issues. Files can be found under Content->Documents->%channel name folder%

[dasfliege]

I could not find the files in this channel due to the kb4182 bug. In other channels that were correctly backed up, i can now find the included files.

Unfortunately, the workaround via the script is not a viable alternative for us as a baas service provider. In order to capture all the new private channels created by our customers, we would have to run the script on a scheduled daily basis. However, we cannot fix the necessary credentials in the script for security reasons. Furthermore, all accounts have MFA, which makes it even more difficult. Is there a workaround for this as well?

Since many of our customers have their important data exclusively in private channels, this function is absolutely essential for us. If veeam does not provide a fully integrated and working solution for this in the foreseeable future, we will have to look for alternatives.

[Polina]

To select sites explicitly with the script, you still need to connect to an organization, and there's hardly any workaround to do it without credentials.

In VBO itself, creating a job for an entire organization (or Organization -> processing options -> sites) should do the job and capture all sites, including these new team sites. If it doesn't work for you, I'd suggest troubleshooting it with our support team.

[dasfliege]

I really don't think that your statement is correct!
Backing up an entire organization does NOT include any private channels! If this would be case, there wouldn't be any need for the workaround with the script to explicitly include them??

Please correct me if i'm wrong. I would then open a case to check why they are not in included in any of our 20 different backupjobs even though we're backing up entire organizations.

[habibalby]

I could not find the files in this channel due to the kb4182 bug. In other channels that were correctly backed up, i can now find the included files.

Unfortunately, the workaround via the script is not a viable alternative for us as a baas service provider. In order to capture all the new private channels created by our customers, we would have to run the script on a scheduled daily basis. However, we cannot fix the necessary credentials in the script for security reasons. Furthermore, all accounts have MFA, which makes it even more difficult. Is there a workaround for this as well?

Since many of our customers have their important data exclusively in private channels, this function is absolutely essential for us. If veeam does not provide a fully integrated and working solution for this in the foreseeable future, we will have to look for alternatives.

You can use the SharePoint functionality to get the private channel of each Team's;

Connect-SPOService
Get-SPOSite -Filter {Url -like https://Tenant.SharePoint.Com/Sites/TeamsSite*}

This would give all the private URLs are associated with the team's site provided.

Hope it helps.

Thanks,

[Mike Resseler]

Great addition @habibalby

Thanks for sharing!

[habibalby]

The correct syntex to get the private URL must be with small letter (L);
Get-SPOSite : Syntax error in the filter expression 'Url -Like'
Get-SPOSite -Filter {Url -like https://Tenant.SharePoint.Com/Sites/TeamsSite*}

Another trick to get the private URLs, if you already know for sure the private channels name or you want to get find them. Get-TeamChannel -GroupID | Fl it will fetch all the channels, then you can select the names. And since you already know the master team name.(URL) Then, you can use Excel to populate the URLs;

TeamName,PrivateChannel,SiteCollection,TeamSite,GroupID
ABS-DD1,Group-1,https://tenantname.sharepoint.com/sites/
Use =concatenant to merge the columns you need; and you will have the result as full Urls;
https://tenantname.sharepoint.com/sites/ABS-DD1
https://tenantname.sharepoint.com/sites/ABS-DD1-Group-1 (The private URL)

Hope it helps;

[habibalby]

Great addition @habibalby

Thanks for sharing!

No problem Mike, we are all here to help each other.

[dasfliege]

@habibalby
Thanks for your effort, but i actually don't understand how that should help with the problem i've explained above.
We do backups for >20 different customers/organizations. Each of them could potentially create new private-channels every day, which we have to include in our backupjobs via the script workaround. So what we would have to do is: Execute the script for the first customer, login with it's global admin and MFA, Execute the script for the second customer, login with it's global admin and MFS, and so on...

[nielsengelen]

As Polina stated, if you back up an entire organization or via Organization -> processing options -> sites, it should capture all the sites (even new ones) and it should solve your initial question/issue. If you don't see this then please open a support case as it sounds like another issue may cause this.

[dasfliege]

@nielsengelen
Are you sure that your statement is still true when you backup an entire organization AND have "Microsoft Teams" backup option enabled for that organization?
I think it was only true until Teams backup has been natively integrated into VBO365.

[habibalby]

@habibalby
Thanks for your effort, but i actually don't understand how that should help with the problem i've explained above.
We do backups for >20 different customers/organizations. Each of them could potentially create new private-channels every day, which we have to include in our backupjobs via the script workaround. So what we would have to do is: Execute the script for the first customer, login with it's global admin and MFA, Execute the script for the second customer, login with it's global admin and MFS, and so on...

Hi There,
well, in this case, you will have to create your own custom script for each customer;
Connect to their tenant.
Fetch their private sites and store it in a csv/txt file.
Run Veeam script to update the backup jobs with the new sites from the new csv/txt file.

All of this can be automated in a single script.

Thanks,

[dasfliege]

I'm aware that this "can be done" in a single script. I also wouldn't be scared of doing that for our own organisation.
But as a service provider, you aren't allowed to store the global admin credentials of your customers in a script!! I don't know how the rest of the world is treating it's customers privacy and security concerns, but here in Switzerland, we definately care about such stuff and therefor we will never ever store our customers credentials in an automated script! And even if we would do, there is still an MFA requirement, which isn't that easy to script without violating security requirements.

Seems i'm talking to a wall. The product, as it is right now, is just not suited for service provider needs in many aspects and we may have to look for an alternative if this does not change pretty soon.