Effective Backups with Veeam Office 365

Published:7 June 2022 - 14 min. read

Michael Soule Image

Michael Soule

Read more tutorials by Michael Soule!

The data you store in your Office 365 (O365) services, such as Microsoft Teams, Exchange Online, SharePoint Online, and OneDrive, is undoubtedly valuable. And backup copies are necessary to protect your valuable data, even in the cloud. So, save yourself the headache and let Veeam Office 365 secure your data.

In this tutorial, you’ll learn to secure a comprehensive backup of your data with Veeam Office 365.

Read on and start protecting your data today!

Prerequisites

This tutorial will be a hands-on demonstration. If you’d like to follow along, be sure you have the following:

Installing Veeam Backup for Office 365 (Now Microsoft 365)

Veeam Backup for Microsoft 365 gives you the sense of security you won’t lose access and control over your data anytime soon. You get to keep your data protected and accessible anywhere at any time.

But before you can backup your data, you’ll first have to install Veeam Backup for Microsoft 365 on your machine.

1. Open PowerShell as an administrator, and run the below command to mount the ISO file (Veeam Backup for Microsoft 365 installation media). This command provides access to the files stored within the disk image, though no output is given when running the command.

  • Veeam.Backup365_6.0.0.367.iso - The exact name of the Veeam ISO file you downloaded in the “Prerequisites” section, the version number will change depending on the version you downloaded.
  • C:\Users\Administrator\Downloads\ – The Veeam ISO file’s location.
$iso = Mount-DiskImage -ImagePath 'C:\Users\Administrator\Downloads\Veeam.Backup365_6.0.0.367.iso'

2. Next, run the following command, which doesn’t provide output but defines the Veeam’s disk image (ISO) location to the $path variable. The Get-Volume cmdlet obtains the drive letter of the mounted disk image from the DriveLetter property.

$path = "$(($iso | Get-Volume).DriveLetter):\Backup\Veeam.Backup365.msi"

3. Run the below Start-Process command to start the msiexec.exe file, which installs Veeam Backup for Microsoft 365 server and console without a restart (/norestart). The installer will run in the background until it completes.

Start-Process "msiexec.exe" -Wait -NoNewWindow -ArgumentList "/i $path /qn ADDLOCAL=BR_OFFICE365,CONSOLE_OFFICE365 ACCEPT_THIRDPARTY_LICENSES=1 ACCEPT_EULA=1 /norestart"

4. Now, run the Get-CimInstance command below to confirm you’ve successfully installed Veeam. This command lists the products installed by Windows Installer with names starting with Veeam. Below we will use the ?, an alias for the Where-Object cmdlet.

Get-CimInstance Win32_Product|?{$_.Name -like "Veeam*"}
Viewing Product Information from the Win32_Product Class for Veeam
Viewing Product Information from the Win32_Product Class for Veeam

5. Run the below command to get Veeam’s service information (Get-Service). This command lists the services on the local system, where the service names begin with Veeam.

Get-Service|?{$_.Name -like "Veeam*"}
Viewing Service Information for Veeam
Viewing Service Information for Veeam

6. Lastly, run the below command to dismount the Veeam disk image (Dismount-DiskImage).

Dismount-DiskImage $iso.ImagePath
Dismounting Veeam Disk Image

Creating an Object Storage Repository

Before you can protect your data, Veeam needs a location to store your backup data. You’ll need the necessary dependencies in place. Doing so provides your backup data, at least the primary production copy, and a backup copy in object storage.

You can then add another object storage location to align with the 3-2-1 backup rule. The 3-2-1 backup rule encourages keeping three (3) copies of important data, with those copies in two (2) different storage types. And at least one (1) in a different physical location from the others.

To create the backup storage repositories, you first have to connect to the Veeam service on your local machines:

1. Launch your Veeam Backup for Microsoft 365 console from your Windows Start menu.

Keep the default IP address and port shown below and click on the Connect button to connect to the Veeam service on your localhost.

If you installed your Veeam services on a different operating system, you must update the server address and port. You may also use a privileged account to access the Veeam install and other credentials for the Veeam console session.

Connecting to the Service Running on the Local System
Connecting to the Service Running on the Local System

2. Next, click on Yes to load a trial or purchased license file. But if you prefer the community edition, click on No instead.

When you first log in, Veeam prompt you with this confirmation to set up a license.

Loading a License
Loading a License

3. Click on Install to locate your license (LIC) file Veeam emailed you.

Installing a License
Installing a License

4. Now, click on Backup Infrastructure (bottom-left) → Object Storage Repositories (left panel) → Add Object Storage (top-left) to begin adding your object storage repository.

As you can see below, there are no object storage repositories by default.

Cloud providers commonly provide object storage as a cheaper option than block storage. You can read more about AWS’ S3 Glacier and Azure’s Blob Storage as options to use.

Adding an Object Storage
Adding an Object Storage

5. In the pop-up window below, provide a unique Name for the object storage, and click Next. This tutorial uses the S3-West1-Veeam-AccountId format for the name, where:

  • S3 – A reference to the repository service provider, AWS’ Simple Storage Service (S3).
  • West1 – The provider region the repository exists.
  • Veeam – The use case for the repository.
  • 495… – The Account ID within the provider where the repository exists, here the number is truncated as they are globally unique. Yours will differ.
Naming the New Object Storage Repository
Naming the New Object Storage Repository

6. Choose Amazon S3 as the object storage type.

Setting Amazon S3 as the Object Storage Type
Setting Amazon S3 as the Object Storage Type

7. Choose the regular Amazon S3 for this tutorial, and click Next. But note that other tiers may provide better cost optimization for your use case.

Choosing Amazon Storage Type
Choosing Amazon Storage Type

8. Next, click on Add to provide your dedicated AWS Identity and Access Management (IAM) credentials to manage the backups.

Setting an Amazon AWS Account Credentials
Setting an Amazon AWS Account Credentials

9. Enter the AWS IAM user’s API credentials (Access key and Secret key) on the Add Credential window, and click OK.

Adding the AWS IAM User’s API Credentials
Adding the AWS IAM User’s API Credentials

10. Now, click Next to confirm the Amazon AWS account to connect to the S3 bucket.

Now, click Next to confirm the Amazon AWS account to connect to the S3 bucket.
Now, click Next to confirm the Amazon AWS account to connect to the S3 bucket.

11. Set your Amazon S3 bucket’s region (Data center location) and bucket name (Bucket). Click on Browse and choose a folder within the repository, and click Finish to complete creating your backup storage repository.

Veeam will use this information to enumerate the available storage resources you can use.

Specifying Amazon S3 Bucket Region and Name
Specifying Amazon S3 Bucket Region and Name

12. Click on New Folder to create a new folder with your preferred name.

Creating a Folder Within the Repository
Creating a Folder Within the Repository

13. Name the folder as you like, and click OK. This tutorial uses the same name as the repository (accountid-veeamrepository).

accountid-veeamrepository
accountid-veeamrepository

14. Lastly, click on Finish to confirm the Amazon S3 bucket settings for the object storage repository.

Confirming Amazon S3 Bucket Settings for the Object Storage Repository
Confirming Amazon S3 Bucket Settings for the Object Storage Repository

Once you finish the repository configuration, you’ll see the repository listed within the console like the one below.

Viewing Newly-created Repository
Viewing Newly-created Repository

Creating a Backup Storage Repository

Veeam creates a local backup repository on the system drive by default. But you’d typically want to use a dedicated drive specifically for your backups. Doing so ensures if the system volume ever has an issue, you can still access your backup data. And to create a backup storage repository, you’ll need a drive that can store the backups.

1. Run the following code to perform the following:

  • Get any disks attached to the system with raw partition format, not a system drive, and not a boot drive.
  • Initialize the disks for GUID Partition Table (GPT) layout, with a single partition for the total available space
  • Format the disks for NTFS, which will present you with a configured disk.
# List all physical disks attached to the system
Get-Disk|
# Where partition format is raw and is not a system or boot drive
Where-Object {$_.PartitionStyle -eq "RAW" -and $_.IsSystem -eq $false -and $_.IsBoot -eq $false}|
# For each disk, initialize it and create a new partition
ForEach-Object {Initialize-Disk -Number $_.Number -PartitionStyle GPT;New-Partition -DiskNumber $_.Number -AssignDriveLetter -UseMaximumSize|
  # For each partition, format as NTFS
  ForEach-Object {Format-Volume -DriveLetter $_.DriveLetter -FileSystem NTFS -Confirm:$false}}

Note down the drive letter to use for the new backup repository. You’ll specify it later to store your local cache.

Formatting Disks for NTFS
Formatting Disks for NTFS

If you don’t have an available disk, you can attach an empty one. Depending on the provider you’re using, the procedure will be different.

2. Next, click on Backup Repositories (left panel) → Add Repository (top-left) to initialize adding a new backup repository.

Initializing Adding a New Backup Repository
Initializing Adding a New Backup Repository

3. Name the backup repository as you like, and click Next. But the backup repository is named Local-Cache in this tutorial.

Naming the New Backup Repository
Naming the New Backup Repository

4. Keep the default backup proxy, specify the drive you noted in step one, and a folder to store the local cache.

This cache is on your local block storage. You’ll configure this cache to offload to the object storage later.

Specifying Backup Repository Location
Specifying Backup Repository Location

Click on Yes to confirm creating the folder if it doesn’t exist.

Confirming Creating the Backup Repository Folder
Confirming Creating the Backup Repository Folder

5. Tick the Offload backup data to object storage option, select your S3 repository, and click Next. Using the backup offload will only give you one backup copy of data.

Specifying Backup Offload
Specifying Backup Offload

6. Finally, specify your retention policy settings with the following, and click Next:

  • Choose the 3 years option for your Retention policy, as shown below.

Your retention requirements vary by your regulatory or organization’s legal requirements. Generally, three years is sufficient, but make sure you don’t need to lower or increase the retention.

  • Choose the Snapshot-based retention option. Veeam won’t delete an item until the entire backup exceeds the retention period so that items can be retained beyond the period set.

The decision between Item-level and Snapshot-based depends on your scenario. Item-level retention functions more similarly to an archive than a backup.

Specifying Retention Policy Settings
Specifying Retention Policy Settings

As shown below, the new backup repository will be added to your console, and you’re ready to start protecting your data!

Verifying Newly-created Backup Repository
Verifying Newly-created Backup Repository

Creating an Organization and an Azure AD Application

Now that you have a location to store your backup data, you need to tell Veeam how to get the source data. How? Start by connecting Veeam with your Microsoft 365 organization or tenant.

Veeam uses an Azure Active Directory Application as a service principal and authenticates with a certificate.

1. Click on the Organizations tab (bottom-left) → Organizations (left panel) → Add Org (top-left) to initialize adding a new organization.

Organizations Tab
Organizations Tab

2. Next, select organization deployment type and services to protect, and click Next. But this tutorial’s choice is to use Microsoft 365 and protect all supported services.

Selecting Organization Deployment Type and Services to Protect
Selecting Organization Deployment Type and Services to Protect

3. Select the Default option for the Region, choose Modern authentication for your Microsoft 365 connection, which is the best approach, and click Next.

Setting Microsoft 365 Connection Settings
Setting Microsoft 365 Connection Settings

4. Now, choose the Register a new Azure AD application automatically option to let Veeam create the Azure AD Applications.

Letting Veeam Create the Azure AD Applications
Letting Veeam Create the Azure AD Applications

5. Name the Azure AD application as you like, and click on Install to select a certificate for the application. For this tutorial, the application’s name is App-Veeam.

Remember that the name will not show up in your Azure AD tenant.

Naming the Azure AD Application
Naming the Azure AD Application

6. Next, choose the Generate a new self-signed certificate option, and click Next. This option tells Veeam to create an appropriate self-signed certificate.

Selecting Certificate Type
Selecting Certificate Type

7. Name the certificate after the Azure AD Application associated with it, and click on Finish.

Veeam will install the certificate in your local machine store and register the public key with the Azure AD Application for you.

Naming the Certificate
Naming the Certificate

8. After adding a certificate, click Next to start authenticating with Azure AD.

Confirming Added Certificate
Confirming Added Certificate

9. Click on the Copy code, and click on the device login hyperlink, as shown below. A login page opens on your web browser where you’ll be asked for authentication (step nine).

Initializing Authorizing Veeam’s Connection Request
Initializing Authorizing Veeam’s Connection Request

10. Click Continue on the access login page, like the one below, to authorize Veeam’s connection request with the Azure CLI.

Authorizing Veeam’s Connection Request
Authorizing Veeam’s Connection Request

11. Once authorized, click on Next after seeing the authentication success message, as shown below.

Confirming Authentication
Confirming Authentication

12. Lastly, click on Finish once Veeam completes performing multiple checks on your tenant, configure the Azure AD Application, and test access.

Veeam will create the certificate with 10-year validity. Keep in mind that your certificate will require renewal and backup of the private key!

Finalizing Creating New Organization
Finalizing Creating New Organization

After all verifications, the organization will now be available to create backup jobs.

Verifying the Newly-created Organization
Verifying the Newly-created Organization

Creating a Backup Job in Veeam for Office 365

A new organization is up to support and manage your backup jobs. Why not start creating one now? A backup job in Veeam lets you automate backup events, so you don’t have to worry about securing your data.

To create a backup job on Veeam Backup for Microsoft 365:

1. Select your organization, and click on Backup to initialize creating a new backup job.

Initializing Creating a New Backup Job
Initializing Creating a New Backup Job

2. Name the backup job as you like, and click Next. This tutorial’s name choice is Nightly.

Naming the New Backup Job
Naming the New Backup Job

3. Choose the Back up entire organization option to capture all the data, then click Next.

Note that only one backup job can backup the entire organization.

Selecting Objects to Backup
Selecting Objects to Backup

4. Skip excluding any objects since you’re backing up the entire organization, and click Next.

Skipping Excluding Objects on the Backup Job
Skipping Excluding Objects on the Backup Job

5. Now, set the backup proxy and repository with the following, and click Next:

  • Keep the default Backup proxy.
  • Select the Backup repository (Local-Cache) you created in step three of the “Creating a Backup Storage Repository” section that includes offloading to object storage.
Specifying Backup Proxy and Repository
Specifying Backup Proxy and Repository

6. Next, leave the default settings for this tutorial, and click Create to save the backup job.

Customizing Backup Job Settings
Customizing Backup Job Settings

7. Lastly, select your newly-created backup job from the list, and click on Start (top-left) to run and test the backup job.

Running the Backup Job
Running the Backup Job

Once your job completes, you’ll see a summary of the backup process. Depending on the amount of data you have on your tenant, the process can take a while to complete.

If you get the Success status, you’ve now successfully backed up your organization’s Office 365 data with Veeam Backup for Microsoft 365!

Verifying Backup Job Process Completion
Verifying Backup Job Process Completion

Restoring Data with Veeam Explorers

Suppose someone called and let you know they completely lost a document and need help to get it back. Well, nothing to worry about. So long as you have a backup, you can get the document back.

To restore data, you’ll need the Veeam Explorers installed, and there are Veeam Explorers included in the same disk image you used to install Veeam. You can install just one of the Veeam Explorers or multiple; they have no dependency on one another.

The Veeam Explorer for SharePoint Online also provides the client to restore files for OneDrive for Business.

1. Run the code below to mount the Veeam disk image again. The code doesn’t provide output but silently installs all three Veeam Explorers.

# If you need to, you can mount the disk image again.
$iso = Mount-DiskImage -ImagePath C:\Users\Administrator\Downloads\Veeam.Backup365_6.0.0.367.iso
# Capture three file names for the Veeam Explorers to install in an array.
$files = @("VeeamExplorerForExchange.msi","VeeamExplorerForSharePoint.msi","VeeamExplorerForTeams.msi")
# For each of the Veeam Explorer files to install.
foreach ($file in $files)
{
	# Set the path for the install file.
  $path = "$(($iso|Get-Volume).DriveLetter):\Explorers\$file"
  # Start a process to install that Windows Installer.
  Start-Process "msiexec.exe" -Wait -NoNewWindow -ArgumentList "/i $path /qn ACCEPT_THIRDPARTY_LICENSES=1 ACCEPT_EULA=1 /norestart"
}

2. Open Veeam Explorer for Microsoft OneDrive for Business from your Windows Start menu.

Click OK when the warning prompt below tells you about possible data egress costs. Be cautious of this warning, especially if you’re using infrequent access or archive tier of object storage.

Getting Warning Message About Possible Data Egress Costs
Getting Warning Message About Possible Data Egress Costs

3. Expand the organization and select one of your users’ OneDrive.

Accessing User’s One Drive
Accessing User’s One Drive

4. Select one document, and click on Restore Document (top-left) to restore that selected document.

Restoring a Document
Restoring a Document

5. Choose the Modern authentication method and click Next to authenticate the tenant.

The Azure AD Application ID is auto-completed if you’re on a Windows machine. You may have to manually get the application ID if you’re on a different system.

Setting Authentication Method
Setting Authentication Method

6. Finally, authorize the Azure AD application as you did in step eight of the “Creating an Organization and an Azure AD Application.” Doing so tells Veeam to perform the work on your behalf.

Authorizing Azure AD Application
Authorizing Azure AD Application

Once authenticated, the restoration begins, and you’ll see your restoration results, as shown below.

Verifying Successful Restoration
Verifying Successful Restoration

Conclusion

Through this tutorial, you’ve learned to configure Veeam Backup for Microsoft 365 to backup your data with backup jobs, store data in object storage, and successfully restore a file.

But although Veeam is automatically backing up your data, don’t forget to set some reminders to rotate your certificate. Always verify your backups were successful, and test your backups regularly!

You can do even more with Veeam Backup for Microsoft 365. Why not set up a backup job to backup important data multiple times a day? Or exclude different data from backups entirely?

Hate ads? Want to support the writer? Get many of our tutorials packaged as an ATA Guidebook.

Explore ATA Guidebooks

Looks like you're offline!