v3 - LegacyAuthProtocolIsEnabled still required?

[Mildur]

Thank You Mike

[m.novelli]

WOHA!

[Mildur]

Veeam has released the Update for Support with disabled Basic Auth

What's New

• Support for Office 365 tenants using modern app-only authentication with disabled legacy protocols. In the new mode, VBO performs all its backup and restore operations using an Azure AD application instead of user credentials. This new mode addresses the needs of customers using Microsoft Security Defaults in their Office 365 tenant organizations.
• Support for leveraging auxiliary backup applications to enable faster SharePoint Online and OneDrive for Business backups for Office 365 tenants using modern app-only authentication.

https://www.veeam.com/kb3145

These are the restrictions:

When protecting Office 365 tenants using modern app-only authentication, consider the following:
• Discovery Search and Public Folder mailboxes are not supported.
• Dynamic Distribution groups are not supported.
• The type property for shared and resource/equipment mailboxes cannot be resolved. Such mailboxes will be available for backup with a general ‘User’ type.
• SharePoint Web Parts can only backed up if their ‘exportmode’ property is enabled. Non exportable Web Parts are not supported.
• OneNote restore is not supported.
• SharePoint Web Part customized template cannot be preserved upon a restore. All Web Parts will be restored with the default template.
• The ‘Allow multiple responses’ setting in survey lists within team modern sites is not preserved upon a restore.
• The ‘Measure-VBOOrganizationFullBackupSize’ cmdlet is not supported.

[Mike Resseler]

@Mildur Yep, you are faster than we can add the information in the various topics

[Mildur]

haha, That's good

[nicolascirnigliaro]

I can confirm that is working now on our side. Also, the new wizard to register the App into Azure AD is fast and simple! Good job!

[mnordstr]

Can confirm working here also, and excellent work on the wizard, no need to rtfm

[HDClown]

• The type property for shared and resource/equipment mailboxes cannot be resolved. Such mailboxes will be available for backup with a general ‘User’ type.

This doesn't cause shared/resource/equipment mailboxes to get counted as a regular licensed user, does it?

[Mike Resseler]

@HDClown No, our team has found a way to figure this out. But we hope that in the future we have a better way to query this

[Hoi]

Hi,

For modern authentication with "Allow for using legacy authentication protocol", we can either use Application secret or Application Certificate to finish the authentication.

However, for modern app-only authentication with disabled legacy protocols, we can only use Application Certificate to finish the authentication.

I would like to know that why we can only use Application Certificate to finish the modern authentication with disabled legacy protocol and is it a compulsory item for the authentication?

Thank you

[Polina]

Hi Ernest and welcome to Veeam Forums!

Using a certificate is compulsory in this case because only in this way VBO can access all of the required APIs. With app secret, some of the APIs we need for backup are not available and VBO has to combine app authentication with user credentials (and hence the usage of legacy protocols).

Thanks!