Veeam Backup for Microsoft 365

Veeam Backup for Microsoft 365 (formerly Office 365) enables backing up of Microsoft 365 data including Exchange Online, SharePoint Online, OneDrive for Business, and Microsoft Teams. With Veeam Backup for Microsoft 365, data can be directly backed up to S3-compatible storage to store primary copy, or a secondary copy. ARTESCA is compatible as a primary S3-compatible storage for Veeam Backup for Microsoft 365.

Veeam Backup for Microsoft 365 allows creation of two types of backup jobs:

• Backup job: This job creates a backup of the Microsoft 365 data and stores directly in the configured backup repository.

• Backup copy: This job creates a copy of the data from Backup job i.e. an secondary copy of the backup data to enhance data protection and long-term storage.

Prerequisites

• Windows server 2012 is not supported. Windows server 2022 or later is supported.

• Veeam Backup for Microsoft 365. Current version of Veeam Backup for Microsoft 365 is v7.0.0.

Limitations

• If immutability is enabled in Veeam, a bucket with object lock enabled, and default retention disabled is required. Veeam handles the lock settings on objects.

• Veeam 365 does not allow using Immutable repositories for primary backup of Microsoft 365 data (i.e. Data backup option in Veeam 365). Backup copy feature is supported when the immutable option is checked.

Storage Profile

Veeam Backup for Microsoft 365 uploads objects to ARTESCA buckets with the following average object sizes:

Application	Block size	Average object size (after achieving 40-50% compression)
Exchange data	5 MB	2.5 MB
SharePoint and OneDrive data	256 MB	128 MB

Veeam Backup for Microsoft 365 stores metadata in small objects of size 100 KB or less, which can make up to 50% of all objects in a repository.

Performance

Due to throttled bandwidth from Microsoft, the maximum throughput of the backup ranges from 60 to 100 MB/s.

Best Practices

Microsoft can throttle the bandwidth during backups leading to many retries, or sometimes failed backups. To identify and mitigate if your backup is being throttled, refer to Veeam provided best practices for more information.

	Bucket Configuration	Backup Job	Backup Copy
Immutable Repository	Object lock enabled	Not supported	Supported
Non-immutable Repository	Object lock not enabled versioning not enabled	Supported	Supported

Configure ARTESCA for Veeam

There are two ways to configure ARTESCA for Veeam.

Veeam Application Impact on Immutability and Veeam Features

Veeam Application	Immutable Backup	Max Veeam Repo Capacity
Veeam Backup & Replication	Yes	Yes
Veeam Backup for Microsoft 365 (v8+)	Yes	No
Veeam Backup for Microsoft 365 (v6, V7)	No	No

Using the Veeam Backup for Microsoft 365 Assistant

1. Access the connector page:

   • On first login, as no account exists, the connector page displays.

   • Click Start ISV Connector.

     • From the Accounts page.

       

     • From the Data Browser page.

       

       Note

       This option is only available if you have already created an account.

2. On the connector page, select the Veeam Backup for Microsoft 365 partner application and click Continue to assistant.

   

   The startup assistant dialog box displays.

3. Fill in the required fields.

   

   Field	Description
   Account	Create a new account: Select this option if you want to create a new account. Use an existing account: Select this option if you want to use an existing account. This option is only available if you have already created an account. Note If starting the configuration from the Data Browser page, this field is automatically pre-filled and locked.
   Account Name	Enter the name of the account you want to create or choose an already existing account from the drop-down list.
   Advanced settings	This field is only available if selecting the Use an existing account option. By default, the system checks if an IAM user already exists for the given account and partner application. If a matching user is found, the system will preselect it and extend its permissions without creating new AK/SK credentials. Create a new IAM user: Select this option if you want to create a new IAM user within your existing account. In that case, you must provide an IAM user name. Use an existing IAM User: Select this option if you want to use an existing IAM user. In that case, choose the user from the drop-down list. You can also choose to generate a new set of AK/SK credentials.
   Veeam application	Choose the application version you want to integrate with ARTESCA: Veeam Backup for Microsoft 365 (v6, v7) Veeam Backup for Microsoft 365 (v8+)
   Number of buckets	Choose the number of buckets you want to create. The limit is 20 buckets.
   Bucket name	Enter a unique name for the bucket. The name must conform to AWS naming conventions. Tip For more information, refer to Bucket naming rules.

4. Click Continue.

   The assistant displays all the automated configuration steps and the status for each step. The list of steps differs depending on the options chosen.

   

   If a step fails, click Retry next to the corresponding step. If the step fails again, refer to Veeam Startup Assistant Fails for more information.

   Note

   If you decide to exit the assistant during a step failure, the resources created remain. If an account has been created and you want to restart the configuration, you must trigger the assistant manually from the Accounts page by clicking Start ISV Connector.

5. Click Continue once all the steps have succeeded.

   The assistant displays the summary of the configuration.

   Important

   You need the information displayed in this page to complete the configuration in the Veeam Backup for Microsoft 365 application, so do not click Finish yet.

   

6. From the summary page, copy the different information one by one, or click Copy all to copy all the information at once.

   Note

   Scality recommends retrieving the information at this point as it is all grouped in one place. You can still retrieve some of the information later in the UI, but it will have to be done individually.

   Besides, the secret key (if generated at this moment) is only available here. If you have not copied it, you will need to generate a new one later. Refer to Create IAM User Access Keys for more information.

7. Click Finish to close the assistant.

   The resources created by the assistant (account, buckets, users, and policies) are available in the respective UI pages.

   Note

   The bucket created with the Veeam Backup for Microsoft 365 assistant is set for a specific use-case.

Configuring manually

1. Create an Account for the Veeam application.

2. Create a Bucket to be used with the Veeam application.

3. Create an IAM user for the Veeam application.

4. Create an IAM policy to grant the Veeam application access to the S3 repository and manage data from an object repository.

   Immutable buckets

   {
      "Version": "2012-10-17",
      "Statement": [
          {
              "Sid": "VisualEditor0",
              "Effect": "Allow",
              "Action": [
                  "s3:GetBucketLocation",
                  "s3:GetObject",
                  "s3:PutObject",
                  "s3:DeleteObject",
                  "s3:GetBucketVersioning",
                  "s3:GetBucketObjectLockConfiguration",
                  "s3:ListBucketVersions",
                  "s3:GetObjectVersion",
                  "s3:GetObjectRetention",
                  "s3:GetObjectLegalHold",
                  "s3:PutObjectRetention",
                  "s3:PutObjectLegalHold",
                  "s3:DeleteObjectVersion"
              ],
              "Resource": [
                  "arn:aws:s3:::bucketname/*",
                  "arn:aws:s3:::bucketname"
              ]
          },
          {
              "Sid": "VisualEditor1",
              "Effect": "Allow",
              "Action": [
                  "s3:ListAllMyBuckets",
                  "s3:ListBucket"
              ],
              "Resource": "*"
          }
                     ]
   }
   

   Note

   Replace bucketname with your bucket’s name.

   Non-immutable buckets

   {
      "Version": "2012-10-17",
      "Statement": [
          {
              "Sid": "SecureBucketPolicy0",
              "Effect": "Allow",
              "Action": [
                  "s3:PutObject",
                  "s3:GetObject",
                  "s3:DeleteObject",
                  "s3:GetBucketLocation",
                  "s3:GetBucketVersioning",
                  "s3:GetBucketObjectLockConfiguration"
              ],
              "Resource": [
                  "arn:aws:s3:::bucketname/*",
                  "arn:aws:s3:::bucketname"
              ]
          },
          {
              "Sid": "SecureBucketPolicy1",
              "Effect": "Allow",
              "Action": [
                  "s3:ListAllMyBuckets",
                  "s3:ListBucket"
              ],
              "Resource": "*"
          }
                    ]
   }
   

   Note

   Replace bucketname with your bucket’s name.

5. Attach the IAM policy to the IAM user previously created.

Integration

Configure Backup Infrastructure

Create Object Storage Repository

1. On the Veeam Backup for Microsoft 365 application, under Backup Repositories > Object Storage, select Add Object Storage, provide a repository name, and click Next.

   

2. Select S3 Compatible as the storage type, and click Next.

   

3. Enter the S3 endpoint exposed by ARTESCA and provide the Veeam IAM user’s credentials created while configuring ARTESCA for Veeam.

   

4. Configure Veeam to copy the backup into a dedicated folder belonging to the bucket previously created, and click Next.

   

5. Select immutable backup option (optional).

   

   Warning

   • Immutability is optional and requires Object Lock enabled buckets. If you enable this option, you cannot modify or delete your backup during the time period set.

   • Immutable repositories cannot be used for primary backup of Veeam 365 data (i.e. Data backup option in Veeam 365). Only Backup copy feature is supported when immutable option is checked.

6. Click Finish in the Summary dialog box to validate the creation of the repository. The newly created object storage repository displays in the list under the Object Storage section in Backup Infrastructure view.

   

Configure a Backup Repository to Use ARTESCA as Storage

1. On the Veeam Backup for Microsoft 365 application, under Backup Repositories > Backup Repositories, select Add Repository, provide a repository name, and click Next.

   

2. Select Back up to object storage as the storage type, and click Next.

   

3. Select Backup proxy and browse to the folder for local cache, and click Next.

   

4. Choose the ARTESCA repository that was created in the previous section, and click Next.

   

5. Specify a retention policy.

   • Choose Snapshot-based retention to retain/restore points for the specified amount of time in the retention policy, and click Next.

   

   • Choose Item-level retention to retain the item if their creation or last modification date is within the specified amount of time in the retention policy.

   

6. Click Advanced to customize the frequency at which retention policy will be applied (optional), and click Next..

   

   Note

   There are no egress charges when using ARTESCA as object storage for Veeam 365.

7. Click Finish to create the backup repository. The new repository will be available under the Backup Repositories section in the Backup Infrastructure view.

Configure Backup Jobs

Create Data Backup Job

This step uses a non-immutable repository to store backups directly in an ARTESCA bucket without object lock option enabled.

Warning

Object storage repositories created with Immutability option enabled (bucket with object lock enabled) cannot be used as target for direct backups.

Prerequisites

• Object storage repository created without enabling immutability: Create Object Storage Repository.

• Backup repository created using the non-immutable object storage repository: Configure a Backup Repository to Use ARTESCA as Storage.

1. On the Veeam Backup for Microsoft 365 application, under Backup Infrastructure > Backup Jobs, select Add Job, give a job name and provide a description.

   

2. Select Microsoft 365 as the back up job type and click Next.

3. Select the Microsoft 365 objects to backup and click Next.

   

4. Select any objects to be excluded from the backup. Click Next.

   

5. Specify the ARTESCA backup repository for storing the backups, and click Next.

   

6. Select the options to schedule a backup job and click Next.

   

7. Click Create to create the backup job. The new job will appear under the backup job listing of the Microsoft 365 organization.

Create a Backup Copy Job

Veeam 365 allows extending a backup repository to store additional copies of the primary backup data for data protection purposes and long-term storage. This example uses a non-immutable object storage repository for primary backup storage and immutable repository for storing backup copies.

Prerequisites

• Non-immutable Backup repository Create a backup repo with an object storage repository, with the immutability option not enabled object storage repo to use as primary backup storage.

• Immutable Backup repository Create a backup repo with an object storage repository, with the immutability option enabled object storage repo to use as backup copy storage.

• Create a Data Backup Job with the non-immutable backup repository.

Extend the Backup Job

The following steps show how to extend the backup job with a backup copy using the immutable backup repository on the same ARTESCA. For production, to conform to the 3-2-1 backup rule [1], it is recommended to have copies on two different ARTESCA clusters, one as immutable storage, and the other non-immutable storage.

1. Navigate to the Organizations section, select the previously created backup job and click Backup Copy option in the navigation menu.

2. Create a new Backup Copy Job.

   

3. Select scheduling options that fit your backup copy needs.

   

4. Click Save. This will create a new job of the job type Copy under the list of backup jobs.

Footnotes

[1]

The 3-2-1 backup strategy states that you should have 3 copies of your data (your production data, and 2 backup copies) on two different media.