Standalone Backups for M365 Groups (Case #08104563)

[Customer369]

Hello,
Veeam Support referred me here. At first, I thought it was a joke—that if someone pays nearly half a million dollars for a product, they wouldn’t be directed to a forum.

It’s not possible to set up a separate job in the product that would back up all current and future M365 groups. Support said this isn’t a bug, but a request for a new feature, which I’m supposed to post here.

Case #08104563

[AlexL]

Can't you create a dynamic group in MS365 and use that group as a selection?

[Customer369]

As far as I know, M365 group cannot be a member of another group.

[AlexL]

Not an MS365 expert myself, but Claude seems to think you can for dynamic groups, but only for security groups, so that is not all groups, apparently you have to use the rule builder.
Otherwise, perhaps you could make a catch all job (entire organisation, select exchange/mail only) and use exclusions for all stuff you backup in other jobs, a bit of a clutch but if it works for you it works.
Our way is using scripts to daily set selections for specific jobs, but that is not for everybody.
Job selections are not always easy when dealing with larger organisations (eg, more 5k users in a single tenant).
If possible keep with a single job for the entire org or a single job per data type (eg 1 job for exchange, 1 for onedrive etc), but that also has it's upper limits before you need to carve it up further.

[Customer369]

Thank you for trying, but it's not possible. We have more than 35,000 groups alone.

[Customer369]

This is terrible—everyone at Veeam has been deliberately ignoring my forum post for 11 days now. Is this how you treat what is probably your biggest customer in Europe?

[Polina]

Hi @Customer369,

Apologies for missing your post.
Within groups there're multiple different objects that can be protected - group mailbox and/or site, as well as group member's data - mailboxes, OneDrives, sites. Could you please clarify what exactly are looking to protect via automatic groups detection/addition?

Thanks!

[Customer369]

Hello,
We’re talking about channel calendars in MS Teams. I wrote a script that should handle this until this feature is added to the product. There should be an internal development request for this. But I haven’t yet tested whether it’s possible to fully restore a deleted MS Teams team; I’d like to try that tomorrow.

I was surprised that, as a customer, I have to do everything myself.

[jig1]

sounds to me Veeam has great software to give people flexibility to do things that you cannot do in the GUI

[Polina]

@Customer369

It's technically not possible today to protect calendars as part of teams backup. Existing Graph APIs for calendars work only with Delegated permissions, while for all backup operations we need permissions of Application type.

[Customer369]

That's not true; an application account can also be granted delegated permissions. I develop such applications myself.

[Polina]

Hi Customer 369,

Fair point — to clarify: our backup service requires Application permissions and cannot operate with Delegated ones. We only use Delegated permissions for restore scenarios. Since the calendar Graph APIs currently only support Delegated permissions, backing up calendars as part of Teams backup is not possible until Microsoft adds Application-type support.

Thanks!

[Customer369]

Hello,
Wouldn't it be better to change the way the APP communicates rather than wait for Microsoft to make a change?

How should I post on the forum so that a potential attacker can't read the information I provide? If I write that something isn't working or isn't optimal, an attacker might target it...

[Mildur]

Hi Customer369

Using delegated permissions would mean that a user has to log in every time a backup job runs.

That’s not very useful for backup purposes, since no backup admin wants to sit in front of the backup application and authenticate themselves every day.
I understand that there might be ways to automate that, but from what I found, Microsoft recommends strongly against it, and it would also mean that multifactor authentication can not be used.
Therefore, we will have to wait until Microsoft supports it with application permissions.

How should I post on the forum so that a potential attacker can't read the information I provide? If I write that something isn't working or isn't optimal, an attacker might target it...

For technical issues, discuss your case with our Support team only. For feature requests, you can always ask for a meeting with a Veeam SE from your region to discuss requests in a more private manner.

Best,
Fabian