Protecting Office 365 mailboxes

Why back up Office 365 mailboxes?

Even though Microsoft Office 365 is a cloud service, regular backups provide an additional layer of protection from user errors and intentional malicious actions. You can recover deleted items from a backup even after the Office 365 retention period has expired. Also, you can keep a local copy of the Office 365 mailboxes if it is required by a regulatory compliance.

What do I need to back up the mailboxes?

To back up and recover Office 365 mailboxes, you must be assigned the global administrator role in Microsoft Office 365.

To add a Microsoft Office 365 organization

1. Install Agent for Office 365 on a Windows machine that is connected to the Internet. There must be only one Agent for Office 365 in an organization.

2. Depending on the authentication method that you use:

   1. If you use basic authentication: On the Microsoft Office 365 page of the web interface, enter the Office 365 global administrator credentials, and then click OK.

      The agent will log in to Office 365 by using this account. To enable the agent to access the contents of all mailboxes, this account will be assigned the ApplicationImpersonation management role.

   2. If you use modern authentication: On the Microsoft Office 365 page of the web interface, enter your application ID, application secret, and Microsoft 365 tenant ID, and then click Sign in. For more information on how to find these, refer to Obtaining application ID and application secret.

As a result, your organization data items appear in the backup console on the Microsoft Office 365 page.

Recovery

The following items can be recovered from a mailbox backup:

• Mailboxes
• Email folders
• Email messages
• Calendar events
• Tasks
• Contacts
• Journal entries
• Notes

You can use search to locate the items.

Recovery can be performed to Microsoft Office 365 or to a live Exchange Server.

When a mailbox is recovered to an existing Office 365 mailbox, the existing items with matching IDs are overwritten. When a mailbox is recovered to an existing Exchange Server mailbox, the existing items are kept intact. The recovered items are placed next to them.

Recovery of mailbox items does not overwrite anything. Instead, the full path to a mailbox item is recreated in the target folder.

Limitations

• Applying a protection plan to more than 500 mailboxes may cause backup performance degradation. To protect a large number of mailboxes, create several protection plans and schedule them to run at different times.
• Archive mailboxes (In-Place Archive) cannot be backed up.
• A mailbox backup includes only folders visible to users. The Recoverable items folder and its subfolders (Deletions, Versions, Purges, Audits, DiscoveryHold, Calendar Logging) are not included in a mailbox backup.
• Recovery to a new Office 365 mailbox is not possible. You must first create a new Office 365 user manually, and then recover items to this user's mailbox.
• Recovery to a different Microsoft Office 365 organization is not supported.
• Some item types or properties supported by Office 365 may not be supported by Exchange Server. They will be skipped during recovery to Exchange Server.