Backup from the Cloud (Microsoft Office 365)

Publish date: 2024-05-15
Backup from the Cloud (Microsoft Office 365)

Backup from the Cloud (Microsoft Office 365)

Creation Date: May 08, 2014

Revision Date: September 10, 2018

Product: DS‑Client (Windows)

Summary

This article provides important information about Backup from the Cloud (Microsoft Office 365) backup sets.

NOTE:  Microsoft Office 365, Exchange, SharePoint, and Office are all trademarks of Microsoft Corporation. These trademarks, related terminologies, and their accompanying dialog box screenshots (if any) are used solely for the purpose of describing expected configuration and/or behavior to ensure proper use of the software described in this document.

For the remainder of this article, the term “Microsoft Office 365 backup set” will be used as an abbreviation for “Cloud (Microsoft Office 365) backup set (Windows)”.

See also:

Backup and restore functionality for Microsoft Office 365 data

The Microsoft Office 365 data that can be backed up and restored using DS-Client includes Exchange Online data, SharePoint Online data, and OneDrive data (as SharePoint Online data).

NOTE:  In Microsoft Office 365 Small Business domains, only the backup and restore of Exchange Online data is supported by DS-Client; the backup and restore of SharePoint Online data is not.

Exchange Online data:

Supported

DS-Client can back up Exchange data from Exchange Online, or from an on-premises Exchange Server using Exchange Web Services (EWS). It can also restore Exchange data to either of the two.

Exchange data that can be backed up and restored includes the following:

Email messages

Calendars and appointments

Contacts (including Contact Lists, but not Contact Groups)

Tasks

Exchange data needs to be in a user mailbox, shared mailbox, or resource mailbox to be supported. It can be restored to the same mailbox or a different mailbox of the original domain or of a different domain using DS-Client.

NOTE:  Although Exchange data on an on-premises Exchange Server is not Microsoft Office 365 data, the backup and restore of such data will be processed by DS-Client using Microsoft Office 365 backup sets. Therefore, the backup and restore of data for Exchange Online, and for an on-premises Exchange Server using EWS, require mostly the same prerequisites.

Not supported: distribution groups

Exchange distribution groups are not supported in Microsoft Office 365 backup sets. Because of the limitation of APIs provided by Microsoft, distribution groups cannot be automatically excluded in the DS-NOC interface.

SharePoint Online data:

Supported:

DS-Client can back up SharePoint data from SharePoint Online and restore it to SharePoint Online. SharePoint data that can be backed up and restored includes the following:

Site collections

Sites

Lists

Individual list items

Web parts

You can select data for backup at the site collection, site, and list levels. You cannot select list items individually as backup set items; however, the individual list items that are within selected lists will be backed up. You can select individual list items for restore.

SharePoint data can only be restored to the same site collection at the original domain (i.e. Original Location) using DS-Client.

Not supported:

Lookup columns

The backup and restore of lookup columns in SharePoint is not supported. A source list containing one or multiple columns that look up data in the columns of a target list cannot be restored.

Hidden and catalog lists

Restoring hidden or catalog lists is not supported because these lists often contain system files.

OneDrive data (as SharePoint Online data):

Supported

OneDrive data is processed as SharePoint Online data by DS-Client. OneDrive data under personal sites can be backed up and restored using DS-Client.

OneDrive data for each user is backed up as the Documents List of each user’s personal site, e.g.

\\OFFICE.MICROSOFT.COM\VirtualShare:SharePoint Site Collections\https://<tenant>-my.sharepoint.com/personal/<user>_<tenant>_onmicrosoft_com/\Documents\*

DS-NOC on Windows recommended

We recommend using the Cloud Management System in DS-NOC (Windows) rather than DS-User to create, configure, and schedule Microsoft Office 365 backup sets. DS-NOC on Linux does not support Microsoft Office 365 backups.

The Cloud Management System in DS-NOC automates the process for creating and scheduling Backup from the Cloud (Microsoft Office 365) backup sets for multiple users according to your specified settings. It can divide backup sets among multiple DS-Client instances and distribute multiple credentials among many backup sets. It is also a centralized interface for monitoring these backup sets.

After the backup sets have been created and scheduled using the Cloud Management System in DS-NOC, you can use DS-User to initiate on-demand backups or restore the data as necessary.

IMPORTANT:  Do not use DS-User to modify the properties of a Microsoft Office 365 backup set that was created in DS-NOC. In particular, changing the backup set name or the schedule in this manner can adversely affect the operation of the system.

Recommended DS-Client-to-DS-System setup

To optimize the speed of Microsoft Office 365 backups, set up DS-Client and DS-System to communicate within the same local area network (LAN) at the same site location. This setup keeps communication localized between DS-Client and DS-System. After obtaining data from the source, DS-Client can send the backup data to DS-System via a LAN, which is more efficient than transferring over a wide area network (WAN).

This setup differs from the typical recommendation of installing DS-Client on the same LAN with the backup source.

Basic workflow for backup and restore

Backing up data for multiple users:

First, you can configure and edit backup settings for Microsoft Office 365 backup sets using Cloud Management System in DS-NOC (Windows).

DS-NOC (Windows) creates and schedules Microsoft Office 365 backup sets in DS-Client according to your settings and configures DS-Client as necessary. DS-Client then runs Microsoft Office 365 backups according to your settings.

For procedural instructions on using the Cloud Management System in DS-NOC, see the DS-NOC User Guide.

Restoring data for individual users:

1.Before restoring the data of a particular Microsoft Office 365 user, identify the Microsoft Office 365 backup set in the DS‑Client that processed that user’s data. Obtain that information using the Cloud Management System in DS-NOC (Windows).

2.In DS-User, using the Restore Now Wizard, select the data that you want to restore in that backup set.

DS-Client restores the selected data.

Prerequisites for backup and restore

Ensure that the following prerequisites are met before you perform the backup and restore of data on Exchange Online, an on-premises Exchange Server, SharePoint Online, and OneDrive.

DS-NOC on Windows: Recommended tool for Microsoft Office 365 backups

Required network configuration:

Ensure that the following network requirements are met:

The DS-NOC server (if used) and the DS-Client computer are able to access *.office365.com.

That ports 80, 8080, and 443 are open on the DS-NOC server (if used) and the DS-Client computer.

The proxy server settings are configured if the DS-NOC service (if used), the DS-Client service, or both are behind a proxy.

For the DS-NOC service, see instructions on configuring Apache Tomcat to use a proxy server in the Server Software Installation Guide.

DS-Client Installation: Microsoft Office 365 DS-Client plug-in required:

For DS-Client to perform backup and restore for Backup from the Cloud (Microsoft Office 365) backup sets, including Microsoft Exchange Server (using EWS) backup sets, you must install the Microsoft Office 365 DS-Client plug-in on the DS-Client computer or on every node of a Grid DS-Client installation.

The plug-in installation file can be found on the installation DVD in the following folder:

\Software\DS-Client\DS-Client_FullFeatured\Windows_64_bit\plugins\install.exe

DS-Client Service: Windows administrator account required for Exchange Online and SharePoint Online:

Ensure that the DS-Client Service uses a Windows administrator account to log on when it starts. If the DS-Client Service uses a Local System Account, Logon failure errors might occur due to a limitation of the authentication method used by Microsoft when you attempt to create a Backup from the Cloud (Microsoft Office 365) backup set.

NOTE:  This requirement does not apply to the backup and restore of data for an on-premises Exchange Server.

License: Microsoft Office 365 license required:

A Microsoft Office 365 license is required for each user who has Microsoft Office 365 data that will be backed up and restored and for each user who will manage the backup and restore process or whose credentials will be used by DS-Client to access the backup source. For example, to back up and restore a Microsoft Office 365 mailbox or SharePoint site, a corresponding Exchange Online license or SharePoint Online license is required.

Prerequisites for backup and restore of SharePoint Online data

Ensure that the following prerequisites are met before you perform the backup and restore of SharePoint Online data, including OneDrive data.

DS-NOC Server: Windows-specific dependencies required for SharePoint Online:

To create, schedule, configure, or monitor Microsoft Office 365 backup sets for SharePoint Online data (including OneDrive data) via DS‑NOC, ensure that Windows-specific dependencies are installed on the DS-NOC server.

SharePoint Online requires Windows-specific dependencies to allow data access. For details on additional configuration required for SharePoint Online, see the DS-NOC User Guide.

Apache Tomcat Service: Windows administrator account required for SharePoint Online:

To create, schedule, configure, or monitor Microsoft Office 365 backup sets for SharePoint Online data (including OneDrive data) via DS‑NOC, ensure that the Apache Tomcat Service uses a Windows administrator account to log on. Apache Tomcat is the service that runs DS-NOC.

Domain: User permission requirements for SharePoint Online:

To perform the backup and restore of SharePoint Online data, including OneDrive data, you must create for each DS-Client at least one dedicated SharePoint account that is used solely for the purpose of accessing the backup source and restore destination. The dedicated SharePoint account requires the following permissions:

Global admin

In the Office 365 admin center, ensure that the SharePoint account that will be used for accessing the backup source and restore destination is set as a Global administrator.

Site Collection Administrator

In the Office 365 SharePoint admin center, set the same Global administrator as the Site Collection Administrator for each site collection to be backed up and restored. DS-Client applies the Site Collection Administrator role automatically for personal sites.

IMPORTANT:  The SharePoint account that you use to perform the backup and restore of SharePoint Online data will become an owner of the SharePoint items. For more information, see the Microsoft documentation here.

DS-Client buffer: Space requirement

Ensure that the location that is selected as the DS-Client buffer path provides sufficient space for SharePoint Online backup activities. During the backup of SharePoint Online data, DS-Client uses the DS-Client buffer to temporarily store files that are larger than 500 MB. The capacity of the DS-Client buffer must be able to support data storage requirements based on a combination of these three aspects:

Batch size

Number of simultaneous backup sessions allowed

Largest possible size of files to be backed up simultaneously.

Prerequisites for backup and restore of Exchange data

Ensure the following prerequisites are met before you perform the backup and restore of Exchange data on Exchange Online or an on-premises Exchange Server using EWS, unless otherwise specified.

On-premises Exchange Server using EWS: Authentication setup required

Implement the following authentication setup on the DS-Client computer and on the on-premises Exchange Server.

The following procedures prepare your on-premises Exchange Server to be a backup source and restore destination for Backup from the Cloud (Microsoft Office 365) backup sets. They are important for ensuring that DS-Client is able to connect to the Exchange Server using EWS.

Authentication Setup in DS-Client Computer

On the DS-Client computer on which the Microsoft Office 365 plug-in is running, set the following configuration in Local Group Policy Editor:

1.Click Start and then Run.

2.Type gpedit.msc

3.The Group Policy Object Editor appears.

4.Browse to Local Computer Policy > Computer Configuration > Administrative Templates > Windows Components > Windows Remote Management (WinRM) > WinRM Client.

5.Set up authentication as follows:

Allow Basic Authentication : Enabled

Allow CredSSPauthentication : Not configured

Allow unencrypted traffic : Enabled

Disallow Digest authentication : Not configured

Disallow Kerberos authentication : Not configured

Disallow Negotiate authentication : Enabled

Trusted Hosts : Enabled

NOTE:  When you enable Trusted Hosts, be sure to add the computer name of the on-premises Exchange Server (or add *) to the TrustedHostsList.

Authentication Setup in on-premises Exchange Server

1.Enable Windows Authentication for the EWS virtual directory in IIS:

a)On your on-premises Microsoft Exchange Server, open Internet Information Services Manager (IIS).

b)Browse to the Default Web Site/EWS folder.

c)For the folder Windows Authentication, set the status to Enabled.

The authentication setup should appear as follows:

Anonymous Authentication : Disabled

ASP .NET Impersonation : Disabled

Basic Authentication : Enabled

Digest Authentication : Disabled

Forms Authentication : Disabled

Windows Authentication : Enabled

2.Enable Basic Authentication for EWS:

a)To go to the administrative settings for your on-premises Exchange Server, visit https://<server>/ecp

In the URL, <server> can be an IP address, hostname, or FQDN at which the Exchange Server can be accessed.

b)In the Exchange Admin Center, click servers to go to your on-premises Exchange Server.

c)Click virtual directories and double-click EWS.

d)Under Authentication, select Basic authentication.

Exchange domain: Minimum credentials required for Exchange

You must prepare at least the minimum number of credentials to be used for the backup of Exchange data:

1.Identify or create multiple users whose credentials will be used for the backup of Exchange data.

IMPORTANT:  Each user account must be associated with a user mailbox.

IMPORTANT:  The minimum number of credentials required is proportional to the maximum number of concurrent activities (which is configured using the MaxSessions parameter). Each credential that you provide can support no more than 4 concurrent activities. Therefore, when MaxSessions is set at a value of 4 or smaller, provide at least one credential per DS-Client. When MaxSessions is set at a value between 5 and 8, provide at least two credentials per DS-Client. When MaxSessions is set at a value between 9 and 12, provide at least three credentials per DS-Client.

This requirement applies to data backup for Exchange Online and for an on-premises Exchange Server.

Before setting up the backup of Exchange Online data using DS-NOC, prepare to provide at least the required number of credentials. DS-NOC will distribute the credentials among backup sets for DS-Client to use during backup. Backup can fail if DS-Client does not have access to the required number of credentials.

For the data backup of an on-premise Exchange Server using EWS, prepare the required number of credentials that DS-Client can use for backup activities that will run concurrently. However, you must also carefully plan the backup activities to prevent each credential from being used by more than four concurrent backup activities.

Exchange domain: User permission requirements for Exchange

The following procedures are required for the backup and restore of data for Exchange Online and for on‑premises Exchange using EWS. Configure each user that will be used for logging on to the Exchange Server as follows.

1.Add user to Discovery Management:

a)Go to the administrative settings for Exchange:

For Exchange Online: In the Microsoft Office 365 account, on the ADMIN menu, select Exchange.

For Exchange Online in a Microsoft Office 365 Small Business domain, visit https://outlook.office365.com/ecp/

For an on-premises Exchange Server, visit https://<server>/ecp

In the URL, <server> can be an IP address, hostname, or FQDN at which the Exchange Server can be accessed.

b)Go to permissions > admin roles.

c)In the list, select Discovery Management, and then click the Edit button.

d)In the pop-up window, under Members, click +.

e)In a new pop-up window, select the user you need to add, click add, and then click OK.

f)In the first pop-up window, click Save.

g)In the admin roles pane, verify that the user you need to add is listed under Members of the Discovery Management group.

2.Add user to Organization Management:

a)Go to the administrative settings for Exchange:

For Exchange Online: In the Microsoft Office 365 account, on the ADMIN menu, select Exchange.

For Exchange Online in a Microsoft Office 365 Small Business domain, visit: https://outlook.office365.com/ecp/

For an on-premises Exchange Server, visit https://<server>/ecp

In the URL, <server> can be an IP address, hostname, or FQDN at which the Exchange Server can be accessed.

b)Go to permissions > admin roles.

c)In the list, select Organization Management, and then click the Edit button.

d)In the pop-up window, under Members, click +.

e)In a new pop-up window, select the user you need to add, click add, and then click OK.

f)In the first pop-up window, click Save.

g)In the admin roles pane, verify that the user you need to add is listed under Members of the Organization Management group.

3.Add Application Impersonation as an assigned role in Organization Management:

a)Go to the administrative settings for Exchange:

For Exchange Online: In the Microsoft Office 365 account, on the ADMIN menu, select Exchange.

For Exchange Online in a Microsoft Office 365 Small Business domain, visit https://outlook.office365.com/ecp/

For an on-premises Exchange Server, visit https://<server>/ecp

In the URL, <server> can be an IP address, hostname, or FQDN at which the Exchange Server can be accessed.

b)Go to permissions > admin roles.

c)In the list, select Organization Management, and then click the Edit button.

d)In the pop-up window, under Role, click +.

e)In a new pop-up window, select ApplicationImpersonation, click add, and then click OK.

f)In the first pop-up window, click Save.

g)In the admin roles pane, verify that ApplicationImpersonation is listed under Assigned Roles of the Organization Management group.

Exchange Data: Requirements for backup

The following requirements apply to both Exchange Online and an on-premises Exchange Server using EWS unless otherwise specified.

1.Restrict source location:

Ensure that the Exchange data that you need to back up are located in a user mailbox, shared mailbox, or resource mailbox. The backup of Exchange data are only supported at these source locations.

2.Exclude distribution groups from backup sets:

NOTE:  An Exchange backup set that contains distribution groups as backup items or as part of backup set items can result in error during backup.

3.Do the following where applicable:

(Exchange Online) Provide multiple credentials to be used for backups.

Ensure that you have provided multiple credentials when editing backup settings for a domain in DS-NOC. DS-NOC will distribute the credentials among backup sets for DS-Client to use for backup processes.

NOTE:  Backups can fail if DS-Client does not have access to multiple credentials.

(On-premises Exchange) Prevent concurrent backups from using the same credentials:

When creating backup sets in DS-User, make sure that you use different credentials among backups that will run concurrently. Plan backup activities carefully to avoid running concurrent backups using the same credentials.

NOTE:  Backups can fail if concurrent backup activities use the same credentials.

To exclude SMTP addresses not associated with a mailbox via DS-User:

In DS-User, you can enable a feature that automatically makes distribution groups, deleted users, and other email addresses that do not have a mailbox unavailable for selection in the New Backup Set Wizard. This elimination process will delay the wizard as it verifies each item before populating the list of email addresses for selection.

To enable this feature, follow these steps in DS-User:

1.On the Setup menu, click Configuration.

2.Click the Advanced tab.

3.Select the category Miscellaneous.

4.Select the parameter ExchangeOnlineExcludeGroupMailboxes and set its value to Yes.

NOTE:  If this feature is not enabled, you must ensure that distribution groups are not selected alongside mailboxes that you have manually selected for backup in a Microsoft Office 365 backup set.

To exclude Exchange distribution groups via DS-NOC:

Distribution groups will appear in the same list of mailboxes in Cloud Management System in DS-NOC. The DS-NOC interface cannot automatically separate users from groups because of the limitations of the APIs provided by Microsoft.

Therefore, when you configure Microsoft Office 365 backup sets for a domain in Cloud Management System, you must ensure that distribution groups are not selected alongside mailboxes that you have manually selected for backup.

DS-Client system requirements

When backing up and restoring Microsoft Exchange data using Backup from the Cloud (Microsoft Office 365) backup sets, the DS-Client computer minimum system requirements are as follows:

For domains with less than 25,000 items per mailbox:

Processor – Intel Core i5

Memory – 16 GB

For domains with more than 25,000 items per mailbox:

Processor – Intel Core i7

Memory – 32 GB

Archiving restored files to PST

When you have selected to restore only Microsoft Exchange data to the local disk, you can archive the restored files to a PST file.

Before archiving Microsoft Exchange data to a PST file, the following requirements must be met:

Ensure that Microsoft Outlook is installed on the same machine as the DS-Client.

Ensure that the security settings in the Microsoft Outlook Trust Center (Options > Trust Center > Trust Center Settings > Programmatic Access) are configured to never warn you about suspicious activity. For detailed instructions, see the Microsoft documentation.

Ensure that all the stores, such as mailboxes, that have been added to the current Microsoft Outlook profile are accessible (that is, with a legitimate license and not deleted or corrupted). Remove all other stores that are not added to the current profile.

Ensure that all foreground instances of Microsoft Outlook are closed on the DS-Client machine. If multiple restore activities will be running sequentially or simultaneously, ensure that all Microsoft Outlook instances are closed in the foreground before the first restore activity in the series.

NOTE:  During the restore process, DS-Client will access Microsoft Outlook in the background.

Known issues

Backup error in Event Log:

In the backup of Exchange Online data using a Microsoft Office 365 backup set, you can see the following error in the DS-Client Event Log after the backup of some mailboxes:

10110039 : The following exception has occurred. This property was requested, but it wasn't returned by the server.

This error does not affect the successful backup or restore of items from the mailbox.

Restore error when mailbox is deleted and inactive:

When you restore Microsoft Office 365 Exchange data to Original Location using DS-Client within 30 days after the deletion of a mailbox and the required mailbox is inactive at the destination location, the following behavior can occur:

The deleted mailbox remains in deleted status.

Restore attempts fail with this event:

10110039 : The following exception has occurred. The SMTP address has no mailbox associated with it. The mailbox remains in deleted state.

NOTE:  To prevent this error, ensure that the required mailbox already exists and is active in the domain at the destination.

Limitation: Selected objects not supported in local disk restores

Notes, Journal, and Contacts entries are not restored in local disk restores.

In the local disk restore process, Microsoft Office 365 data is converted to other data formats. The following limitations also apply when you restore Microsoft Office 365 data to local disk:

Journal or Notes entries attached to an email message are not restored. The email message itself is restored. Other types of attachments to the email message, such as a PDF document, are also restored.

All attachments to a calendar item are not restored. The calendar item itself is restored.

All attachments to a task are not restored. The task itself is restored.

Limitation: Automatic versioning unavailable for SharePoint Online data

DS-Client does not support automatic versioning for SharePoint Online data even if you have enabled versioning for specific lists in SharePoint. DS-Client will only back up the latest version of the list items, and it will only restore the generation that is selected to be restored for each list item. The restored generation will be added to the SharePoint Online database as the latest version.

Limitation: Backup and restore of Office 365 Group data in Office 365 Business Premium not supported

DS-Client does not support the backup and restore of data generated by Office 365 Group features in Office 365 Business Premium. Office 365 Group features include conversations and email, group calendar, and file sharing of group documents.

Important information

Restoring orphaned Microsoft Office 365 backup sets

Like other kinds of backup sets, a Microsoft Office 365 backup set can become orphaned and can be restored.

To restore an orphaned Microsoft Office 365 backup set to an Alternate Location or to the local disk of the DS-Client computer, perform the following:

1.Recover the backup set.

2.Restore the backup set.

To restore an orphaned Microsoft Office 365 backup set to its Original Location, perform the following:

1.Recover the backup set.

2.Migrate the backup set.

3.Restore the backup set.

In the migration of a backup set, you will re-configure the backup items of the set and provide the credentials that DS-Client requires to access the source of a backup set. Migration is required for restoring an orphaned Microsoft Office 365 backup set specifically to its Original Location or for performing backups for the set.

For procedural instructions:


ncG1vNJzZmirY2Ourq3ZqKWar6NjsLC5jpqqop%2Bilnqlu8KupJ6mpJbBqrvNaH%2BepKBkw3KAjWpmfYtdeLmqsc2tXGtoeJq5sXujjGR8pJmau7Wrp56jqWdylrCswc%2BYnaunnZTBqbG%2BfKOorZSUdY61wqumrKeWqayQssWimp6XY2uCanrHraSl