Restore-VEXItem fails to restore a mailbox to another MS 365 Organization

[i.stajcic]

Hi,

I'm trying to automate mailbox restores from Veeam for MS365 backups to another MS365 Organization using PowerShell.
Here is my code:

Code: Select all

$StartSession = Start-VBOExchangeItemRestoreSession -LatestState -Organization $ProdOrg
$session = Get-VBOExchangeItemRestoreSession | where {$_.Id -eq $StartSession.id}
$database = Get-VEXDatabase -Session $session
$TestMailbox = Get-VEXMailbox -Database $database -Name $TestRestoremailboxName
Restore-VEXItem  -Mailbox $TestMailbox -Credential $DestCreds  -TargetMailbox $TargetMailbox -RestoreChangedItem 

When executing Restore-VEXItem, I get an error: Restore-VEXItem : Failed to open mailbox: mailboxname@mydomain.net
The credentials I use in $DestCreds variable are of the account that owns mailboxname@mydomain.net and has FullAccess over the mailbox. I gave the account Organization Management, ApplicationImpersonation and Global Administrator roles, but the error still persists.

Any ideas, please?

[Mildur]

Hi Igot

I see, that you are using basic AUTH for the restore.
Microsoft has started disabling basic auth. Maybe this other M365 Org has Basic Auth disabled, so you won't be able to access any mailbox with Basic Auth.

Please try the restore again with Modern Auth. You need to use Example 12 for this:
https://helpcenter.veeam.com/docs/backu ... ml?ver=110

Best,
Fabian

[i.stajcic]

Thanks, Fabian,

I tried what you suggested and it worked, but it is interactive, meaning I need to open browser manually and enter the code provided. Then I need to authenticate with user account. Is there a way to do the restores without user intervention? My idea is to create a PowerShell script and to schedule the restores to happen completely automatically.

Best regards,
Igor

[Mildur]

Hi Igor

May I ask what's the use case for this script? Is it to test restores of mailboxes? Or a migration scenario?

Thanks
Fabian

Update:
Scripts can use Example 7. It uses cert based authentication instead of device code login.

[i.stajcic]

Hi Fabian,

Yes, we wanted to created a test restore procedure which would run once a month, restore a certain mailbox to another mailbox in another MS365 Organization and then check if the specific items appear in the restored mailbox and report on the results. It is meant to be fully automated.

Best regards,
Igor

[Mildur]

Hi Igor

Thanks.
I talked to my team and they gave me a hint. If you try Example 7 from the provided user guide page, you don't need to use device code authorization. It works in my lab. You need to store the certificate with the private key somewhere on your disk. Your script will use the Certificate for authentication instead of the device login.

Code: Select all

$session = Get-VBOExchangeItemRestoreSession
$database = Get-VEXDatabase -Session $session -Name abc.onmicrosoft.com
$salessmailbox = Get-VEXMailbox -Database $database -Name "sales"
$securepassword = Read-Host -Prompt "Enter password" -AsSecureString
Enter password: ********
Restore-VEXItem -Mailbox $salessmailbox -ApplicationId c276f9ce-e4f2-4bdf-b9f2-e6c311c2e2a5 -ApplicationCertificatePath "C:\Certificate\Cert.pfx" -ApplicationCertificatePassword $securepassword -ImpersonationAccountName "global2@tech-365.tech" -OrganizationName tech-365.tech -Region Worldwide -RestoreChangedItem

Best,
Fabian

[i.stajcic]

Thanks, Fabian.

That worked.

Best reagrds,
Igor