Veeam O365 backup causing Security Alerts on O365 Security Console

[jmcguigan]

Hi,

I awoke this morning to a huge amount of emails from O365 saying that mass downloading was taking place on our system using our IP address and one of our admin accounts.

We have two tenants, one is an Academic tenancy and the other one is a standard not For Profit tenancy.

The alerts came from the Academic tenancy but nothing on the NFP tenancy.

We are obviously investigating this and have put our data breach mitigation processes into action.

So, my question is - Could the VEEAM backup have triggered this batch of alerts?

We've been backing up these tenancies with VEEAM for over a year without any issues and we are on the current version.

The only changes I made recently which were at the end of last week was to create a backup window, and change the network traffic rules to avoid backups running into the working day.

Am I barking up the wrong tree or is this possible?

[Mike Resseler]

Hmmm, as far as I can think this should not be Veeam, considering that you are using incrementals. Unless a lot has been uploaded yesterday, I don't see any reason. Is the admin account the one that you use to connect with Veeam to O365?

[jmcguigan]

Turns out someone uploaded 30gb of files to their desktop forgetting it lived on Onedrive which in turn caused Veeam to register thousands of files being backed up which in turn triggered Microsofts "mass download" alerts.

[Mike Resseler]

30 gb of files? All small files then I assume because if they are large files it should not be that big of a problem