MailboxFolder.ReadWrite.All & MailboxItem.ImportExport.All — Detailed technical justification required for backup operat

[sven.madai@switch.ch]

Hello Veeam Forum

I've already tried contacting Veeam Support, but unfortunately they couldn't provide me with any further information.
Maybe you can help. Thanks

We manage multiple enterprise customers using Veeam Backup for Microsoft 365 (v8.5.x) and are currently configuring the required Microsoft Graph permissions in the context of the EWS deprecation (October 1, 2026).

Our customers must formally justify every Graph permission to their CISO and data protection authority. Two permissions are being questioned for pure backup operations -> https://helpcenter.veeam.com/docs/vbo36 ... html?ver=8

1. MailboxFolder.ReadWrite.All — Why is write access needed for backup? Would MailboxFolder.Read.All not be sufficient?

2. MailboxItem.ImportExport.All — Why is the import capability needed for backup? Would MailboxItem.Export.All not be sufficient?

We kindly ask for a detailed technical explanation for both permissions, and suggest that Veeam adds these justifications directly to the official documentation.

Thxs
Sven

[Polina]

Hi Sven,

During backup write and import are not used, and technically only read and export abilities are used. ReadWrite and ImportExport permissions are requested to cover both backup and restore scenarios.

Thanks

[sven.madai@switch.ch]

Hi Polina

Thank you for your response. However, for our customers' compliance requirements, this explanation is unfortunately not sufficient.

Saying that "write and import are not used during backup" actually raises more questions than it answers:

1. If write and import are not used during backup — why are these permissions requested at all for the backup application registration? From a security and least-privilege perspective, an application should only request permissions it actually needs.

2. Can Veeam officially confirm that granting MailboxFolder.ReadWrite.All and MailboxItem.ImportExport.All to the backup app registration does NOT allow the application to write data into mailboxes during backup jobs — and that this is enforced technically, not just by convention?

3. Would it be possible to separate the permissions — using a restricted set for backup and elevated permissions only for the restore app registration?

Our customers need a formal, documented statement from Veeam that can be presented to their CISO and data protection authority. A forum reply is a good start, but ideally this should be reflected in the official documentation at:
https://helpcenter.veeam.com/docs/vbo36 ... html?ver=8

Thank you for your support.

Best regards
Sven