Public Folder Backup required permission

[agrob]

Good Day

VBO365 V2, Exchange Online (all Mailboxes and Public Folder). I can backup all User mailboxes.
I can also see the Root Public Folder Mailbox but backup is not able to protector the Public Folder. The error i get:

Processing mailbox PF-MBX-Root_58e125fa@xxxxxxxx.onmicrosoft.com failed with error: Failed to synchronize item changes in folder: FOLDERNAME.. Access is denied. Check credentials and try again., ICS synchronization failed. :

-> Does the account need ab mailbox (mail enabled) which is used for Backup to protect Public Folder Date? If not, any other special permissions beside the one described in the manual?

Thanks

[Polina]

Hi Andre,

All the required permissions are covered in the user guide.
Can you check if this specific folder from the error message has any custom access rights? And also ensure that this folder is located under IPM_SUBTREE (if not, it cannot be processed).

[agrob]

Hi Polina
Thanks for your answer. Public Folder is located under the IPM_SUBTREE. But we have different permissions set on different Publicfolders. So not all User have access on all PublicFolder
-> I Guess in that case i have to assign at least reader rights to the account which is backing up the PF database right? In that case, i need to mail enalbe this user to grant the required permissions because without Mailbox, i cant set permission for this user on the public folder.

Regards

[Polina]

Right, give VBO at least Reviewer access to this folder.
Thanks!

[agrob]

configured reviewer rights for all public folders for the backup account. still get an "access denied" message.
if i configure outlook with the backup account, i can access and browse all public folder successfully. also the "access denied" message is not always reported on the same folder... i have opened a case

[Polina]

Thanks for letting me know, Andre. And please post your case ID here, so that I could track the investigation.

[agrob]

Sure, the Case ID is 03131049
Thanks

[agrob]

Solution:
Veeam Uses inpersonation, so in fact the default "user" is issued to access PF Data. Because Default has not required rights, impersonation needs to be disabled.

1. Stop Veeam Backup for O365 Services
2. Edit proxy.xml file located in c:\programdata\veeam\backup365
3. Add the following line under <Archiver>
<Source EwsImpersonatePublics="False" />
4. Restart Veeam Backup for O365 Services

Now the backup should run successful.
(Note: User configured for Backup in Veeam O365 needs reviewer rights on all Public folders)

Many Thanks to Veeam Support for solving this!

Best Regards

[Mike Resseler]

Andre,

Thanks for coming back to us with the solution! I am sure others will benefit from this also. I will also put this up as a candidate for a KB!

[final]

Note that EwsImpersonatePublics is only available in v2. However, Veeam has a patch for 1.5 which provides this funcionality. I was given this patch about 8 months ago when I had the same problem.

[Mike Resseler]

Final,

Thanks also for this! Again something which can help other people here on the forums!
Good stuff
M/

[danc]

Solution:
Veeam Uses inpersonation, so in fact the default "user" is issued to access PF Data. Because Default has not required rights, impersonation needs to be disabled.

1. Stop Veeam Backup for O365 Services
2. Edit proxy.xml file located in c:\programdata\veeam\backup365
3. Add the following line under <Archiver>
<Source EwsImpersonatePublics="False" />
4. Restart Veeam Backup for O365 Services

Now the backup should run successful.
(Note: User configured for Backup in Veeam O365 needs reviewer rights on all Public folders)

Many Thanks to Veeam Support for solving this!

Best Regards

I have tried the above fix and still getting the same error:
20/06/2019 11:38:33 AM :: Processing mailbox Mailbox1_8360xxxxxx@ABC.onmicrosoft.com failed with error: Failed to synchronize item changes in folder: XXXXXX.. Access is denied. Check credentials and try again., ICS synchronization failed. :: 0:10:32

I am running VBO365 version 3

Thanks
Dan

[Polina]

Dan,

Which type of authentication are you using? how is your service account configured? are there any specific permissions configured for your public folders?

[Regnor]

With "<Source EwsImpersonatePublics="False" />" is it necessary for the backup user to have a mailbox? And what permission does the user need on the PFs?

[Polina]

Hi Max,

Yes, having a mailbox and the Reviewer access rights are required.

Thanks!

[Regnor]

Hi Polina,
thanks for confirming.
We've also had the problem that the permissions wern't applied to all publicfolders, when set via the Exchange Admin Center; we had to apply them via powershell.

[Polina]

When working via the Admin Center it happens quite often - it needs some time for synchronization; so you might have had to wait a bit longer for those changes to be applied.

[Regnor]

This is the case for anything you do in Office365