Public folder backup after October 1st 2022 still possible?

[steffennw]

Ok, so do I understand this right?
We need a "Exchange Online Plan 1" M365-license in all tenants of our customers for the Veeam-Backup-User, to backup their public folders.
Right?

[DDIT]

@steffennw, Yes, that is what I understand. The accurate wording is highlighted here https://helpcenter.veeam.com/docs/vbo36 ... ganization

[Mildur]

@DDIT
Veeam backup accounts are not used when you add an organization with "Modern app-only authentication". Therefore no licenses are required for any backup account. Are you still connecting to your organization with "modern authentication and legacy protocols"?

If so, you should switch to "Modern app-only authentication" as soon as possible, because Microsoft is already disabling legacy protocols in every tenant.

Best,
Fabian

[DDIT]

@Mildur

This is how our Org connects...


So it seems we using Modern-only auth, correct? If that's the case, why does assigning an EXO license to the service account make it possible to backup the mailboxes, which didn't work when no license was assigned? And also the service account needs owner permissions on the PF mailboxes, otherwise it couldn't find the PF server, which was the original error on my support case [06181594]

PS: how do I @Mention someone on these forums? My @'s are just appearing as normal text.

[Mildur]

Mention works only for Veeam employees.

Let me check the case. There is no service account (backup user) involved with "Modern app-only authentication" only. There is only a username for the impersonation. But it just has to be a mail address from your tenant. Mine is a mail address from a shared mailbox without any license attached:




Thanks,
Fabian

[steffennw]

Thanks for this solution!
Using a SharedMailbox is working.

But it smells like a workaround, because you cannot set the impersonation email adress when adding a organisation.
You need to edit the organisation after it is created.

[FAlter]

I upgraded to 7.0.0 now, reset the authorizations and re-enabled the backup of the public folders. After manually starting the job it was running for several inutes, no fail yet - I will see more tomorrow.

I hope I will be able to post good news

[mdxyz]

Are you able to see and back up the primary and secondary hierarchy mailboxes? Using a shared mailbox without a license we can only see and back up the primary hierarchy PF mailbox, which doesn't actually contain any data.

[darcon]

We're having that issue @mdxyz. I see the primary hierarchy mailbox in Veeam, but not the secondary. It's not a huge issue for us since the secondary isn't in use currently, but still something I would like to see resolved. Other than that, we're having no issues backing up our Public Folders with Modern Auth enabled.

[Polina]

Hi All,

VB365 by design protects only the primary hierarchy mailboxes, as secondary ones are basically a read-only copy of the primary.

[mdxyz]

Hi Polina, thanks for that, it explains what we're seeing. Are you sure about the secondary mailboxes being *only* read only copies? I'm not sure that's correct. MS docs state "Secondary hierarchy mailboxes: Secondary hierarchy mailboxes contain public folder content as well and a read-only copy of the public folder hierarchy." (https://learn.microsoft.com/en-us/excha ... chitecture). My understanding is that there can only be one primary which holds the writable hierarchy, and the secondaries contain read-only copies of this hierarchy, but both are able to store data, otherwise your entire public folder infrastructure would be limited to what the single primary can store.

This is for Exchange 2016 but I believe it applies to 365:

Primary hierarchy mailbox: When a first public folder mailbox is created, it will become Primary hierarchy mailbox (Public Folder Master Hierarchy Mailbox) and this will be the only writable copy of the Public Folder Hierarchy.

Secondary hierarchy mailboxes: Any Public Folder mailboxes created later called as Secondary hierarchy mailboxes, these mailboxes will be read-only copy of the Hierarchy. When any changes with PF Hierarchy will redirect to the Master Hierarchy PF Mailbox and then it replicates to all other PF Mailboxes. This avoids the conflicts.

From: https://msexchangeguru.com/2016/07/15/e ... icfolders/

[mdxyz]

Is there any feedback on this? We have customers that store data in secondary PF mailboxes which don't appear to be backed up by design. I haven't been able to find any Microsoft documentation that supports the idea that secondary mailboxes don't store unique data.

[DDIT]

@Mildur, am waiting for you to confirm the details on my support case and why only when assigning a license to my service account it is able to complete the backup successfully. Any also why this same account needs owner rights across all PF folders. Thanks.

[Mildur]

Hello Michael

I was informed last week that the license is required and owner permissions must be set. We have updated the user guide to reflect this requirement.
https://helpcenter.veeam.com/docs/vbo36 ... tml?ver=70

The license and permission must be provided to the user account which registers the azure ad application.

Best,
Fabian

[ian0x0r]

If not seen already, the release of V7 CP4 with Public Folder support was pulled for download https://www.veeam.com/kb4425. Here's hoping it is fixed soon

[dasfliege]

Catching up on this, since i haven't to setup PF backup for quite some time now, but just got a request to do so.
I'm a little lost in finding the EXACT requirements that must be met in order to be able to have full PF backup.

- Can i use "Modern Auth" without legacy? If yes, why does the setup wizard still states that only legacy enables support for PF backup?
- Do i need to assign a license to the user that was used for setting up the organization in veeam?
- Do i have to manually assign additional permissions?

Thx!

[mjr.epicfail]

I can answer some:

1) thats a bug, i already reported it and got confirmation that it will be fixed.
2) Yes, and that user needs to be owner of the PF
3) Yes, see https://helpcenter.veeam.com/docs/vbo36 ... tml?ver=70

[dasfliege]

3) Yes, see https://helpcenter.veeam.com/docs/vbo36 ... tml?ver=70

This article actually only states that the user must have a license and an active mailbox. But i can't read anywhere that i manually have to grant additional permissions. Thought that the necessary additional permissions have been added to the wizard. So it should be enough to just click through "edit organization" wizard again and let veeam set the permissions for me?