From 450d7ea7b6bb015eb452d374105cb26585263221 Mon Sep 17 00:00:00 2001 From: nd0001 Date: Wed, 2 Sep 2026 10:20:30 +1000 Subject: [PATCH] docs: name the M365 account Veeam needs when adding an organisation The app-only auth rewrite dropped the backup service account prerequisite outright. Adding an organisation with an existing Entra ID application still asks for a username: an account in the customer tenant that Veeam uses for Exchange impersonation. The organisation name field only replaces it when SharePoint Online and OneDrive are the only services protected, and AUCyber backs up Exchange and Teams as well, so the customer does have to supply an account. Public folder mailboxes need that account to have an active mailbox, an Exchange Online licence and Owner permission on the folders. The four admin roles from the old page stay out. They apply to restores through the device code flow, and restores here use the application certificate. Raised by COS-4132. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_0183f9SrbggbtXU6SD962By6 Signed-off-by: nd0001 --- .../M365_Backup/configuration.md | 25 ++++++++++++++++--- docs/Platform_Services/M365_Backup/index.md | 2 +- 2 files changed, 22 insertions(+), 5 deletions(-) diff --git a/docs/Platform_Services/M365_Backup/configuration.md b/docs/Platform_Services/M365_Backup/configuration.md index d4a1cd64..98ec5195 100644 --- a/docs/Platform_Services/M365_Backup/configuration.md +++ b/docs/Platform_Services/M365_Backup/configuration.md @@ -11,13 +11,16 @@ tags: This guide outlines the steps required to configure and implement your Microsoft 365 Backup with AUCyber using the modern app-only authentication method. Backup and restore both authenticate with a certificate -against a Microsoft Entra ID application registered in your tenant, so no backup service account is -required. You will be allocated a Customer Success Manager (CSM) who will assist you with the -on-boarding process, provide advice and act as a conduit to deeper technical support when required. +against a Microsoft Entra ID application registered in your tenant, so you never share a password or +an app password with AUCyber. Veeam Backup for Microsoft 365 does still need the username of one +account in your tenant when your organisation is added. You will be allocated a Customer Success +Manager (CSM) who will assist you with the on-boarding process, provide advice and act as a conduit +to deeper technical support when required. ## Prerequisites - Customers must have a Microsoft 365 account that has an active subscription. +- One Microsoft 365 user account in your tenant. Veeam Backup for Microsoft 365 asks for its username when your organisation is added, and uses the account for Exchange impersonation. Any account in the tenant will do, and you give AUCyber the username only, never a password. If your backup includes public folder mailboxes, the account also needs an active mailbox, an Exchange Online licence and Owner permission on the public folders. - The account used for configuration must have permission to manage applications in Microsoft Entra ID (formerly Azure Active Directory). Any of the following Entra ID roles include the required permissions: * [Application administrator](https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference#application-administrator) @@ -28,6 +31,15 @@ on-boarding process, provide advice and act as a conduit to deeper technical sup - AUCyber will provide you with a certificate (public key) to be used during application registration. This certificate is used to authenticate both backup and restore operations. - Configuration is performed in the [Microsoft Entra admin center](https://entra.microsoft.com). +!!! note "Public folder mailboxes" + + Grant the Owner permission from Exchange Online PowerShell: + + ``` + $folders = Get-PublicFolder "\" -Recurse + foreach ($folder in $folders) { Add-PublicFolderClientPermission -Identity $folder.Identity -User -AccessRights Owner } + ``` + ## Microsoft Entra ID application permissions ### Register an application @@ -123,7 +135,12 @@ finalise the configuration of the Veeam Backup for Microsoft 365 application. Th Webex, Zoom, Teams chat or face-to-face meeting. Please advise your CSM on what suits best. - Application (client) ID of the registered application -- Your Microsoft 365 organization name (for example contoso.onmicrosoft.com) +- The username of the Microsoft 365 account from the prerequisites (for example backup@contoso.com) + + !!! note + + If your backup covers SharePoint Online and OneDrive only, Veeam asks for your Microsoft 365 + organisation name (for example contoso.onmicrosoft.com) instead of the username. ![Edit Organisation](./assets/edit_organisation.png) diff --git a/docs/Platform_Services/M365_Backup/index.md b/docs/Platform_Services/M365_Backup/index.md index 00c42e06..d20d8ec4 100644 --- a/docs/Platform_Services/M365_Backup/index.md +++ b/docs/Platform_Services/M365_Backup/index.md @@ -37,7 +37,7 @@ You will need to register an application in Microsoft Entra ID, grant it the req ## Provide details to AUCyber -The Application (client) ID of the registered application and your Microsoft 365 organization name need to be provided to AUCyber to complete the setup of your account. These details can be entered via Webex, Zoom, Teams chat or by coming to our office and entering them manually. +You provide AUCyber with the Application (client) ID of the registered application and the username of the Microsoft 365 account Veeam uses to connect to your tenant. These details can be entered via Webex, Zoom, Teams chat or by coming to our office and entering them manually. ## Restore records through the Self-Service portal