How-ToAhsayACB Microsoft 365 Requirements
Microsoft 365 Requirements
AhsayACB Installation Requirements
For agent-based backup and restore, make sure that the latest version of AhsayACB is installed on your computer with Internet access for connection to your Microsoft 365 account.
Users should also stay up to date when newer versions of AhsayACB are released. To get our latest product and company news, please check out the page Announcements on our website.
AhsayACB License Requirements
AhsayACB licenses are calculated on a per device basis:
For Agent-based:
To backup users with one (1) backup client computer
Example: If one AhsayACB is installed then, one AhsayACB license is required.
- To backup users with multiple backup client computers, the number of AhsayACB licenses required is equal to the number of devices.
Add-on Module Requirements
Make sure that the Microsoft 365 Backup feature has been enabled as an add-on module in your AhsayACB user account and there is enough Microsoft 365 Backup license quota to cover the backup of your users.
Below is a sample screen shot of an AhsayACB User with an add-on module of Microsoft 365 with two (2) licenses.
- Please be reminded that a maximum of two modules is allowed for Microsoft 365 Backup on AhsayACB. If you wish to back up more than two Microsoft 365 users, consider using AhsayOBM instead. Please contact your backup service provider for more details.
- Each AhsayACB Microsoft 365 backup set is limited to one Microsoft 365 user account. Therefore, when you back up two Microsoft 365 user accounts, it will require two separate backup sets.
- For more information, refer to Appendix – Example Scenarios for Microsoft 365 License Requirement and Usage.
Access for AhsayCBS User Web Console
It is not possible to perform agentless backup and restore, which can be done via the AhsayCBS User Web Console without using the AhsayACB client agent. In order to access the User Web Console, make sure you have an Internet connection and a web browser installed on your computer or mobile device.
Access to AhsayCBS User Web Console is dependent on the policy set by your administrator. Please contact your administrator if you are having trouble logging into the AhsayCBS User Web Console.
Backup Quota Requirement
Make sure that your AhsayACB user account has sufficient quota assigned to accommodate the storage of the Microsoft 365 users for the new backup set and retention policy. Please contact your backup service provider for more details.
To get an accurate estimate of the backup quota requirement, it is recommended to check the actual usage of the Microsoft 365 Organization in the Microsoft 365 Admin Centre. Please refer to Appendix – How to view item count and Storage used in Microsoft 365 Admin Center.
Public Folder Backup
A licensed Exchange Administrator or a licensed user with Public Folder permission is required, otherwise you will not be able to access the public folder to select items and for backup or restore.
Java Heap Size Requirement
The default Java setting heap 2048M, is sufficient for Microsoft 365 backup.
Microsoft 365 License Requirements
Microsoft 365 Subscription Plan
The following subscription plans with Microsoft 365 email services are supported to run backup and restore on AhsayACB or AhsayCBS User Web Console.
Microsoft 365 Business Essentials Microsoft 365 Business Premium Microsoft 365 Education Microsoft 365 Enterprise E1 Microsoft 365 Enterprise E3 Microsoft 365 Enterprise E4 Microsoft 365 Enterprise E5 Microsoft 365 Subscription Status
Make sure that your Microsoft 365 subscription with Microsoft is active in order to enjoy all privileges that come along with our backup services. If your account has expired, renew it with Microsoft as soon as possible so that you can continue to enjoy the Microsoft 365 backup services provided by Ahsay.
When your account is expired, depending on your role, certain access restrictions will be applied to your account. Refer to Microsoft 365 Subscription Status for more details.
Microsoft 365 Permission Requirements
The basic permissions required by a Microsoft user account for authentication of a Microsoft 365 backup set.
- Assigning Global Admin Role to Accounts
- Granting Permission to Discovery Management Group
- Granting Permission to Accounts for Creating Backup Set
Assigning Global Admin Role to Accounts
The Microsoft 365 account used for authentication must have the Global Admin Role, since Modern Authentication will be used.
This is to ensure that the authorization configuration requirements will be fulfilled (e.g. connect to Microsoft Azure AD to obtain the App Access Token).
Assigning the Roles
Click the App launcher in the upper left side then click on Admin to go to the Microsoft 365 admin center.
In the "Microsoft 365 admin center", on the left panel click Users. Find the user you want to assign the Global Admin role to and select Manage Roles.
In the "Manage roles" window, select Admin center access then check the box beside Global admin. Click Save Changes to save the role you assigned.
Granting Permission to Discovery Management Group
This permission allows users added under the Permissions section of the Discovery Management group to back up and/or restore user item(s) not only for their own account, but also the accounts of other users granted membership in the group under the Assigned section.
Assigning Discovery Management Security Group their Roles
- Open https://admin.exchange.microsoft.com
Log in as an account administrator when prompted.
Select Roles on the left-hand side panel, then click on Admin roles. From the list, click on Discovery Management, causing the Discovery Management menu panel to open.
Under the Permissions section in the newly opened panel, search for the following roles:
- Mailbox Search
- Public Folders
Mark the checkbox on the left of each role, then click on Save to confirm.
Granting Permission to Accounts for Creating Backup Set
- Open https://admin.exchange.microsoft.com
Log in as an account administrator when prompted.
Select Roles on the left-hand side panel, then click on Admin roles. From the list, click on Discovery Management.
You can now add users to this group. Open the Assigned tab, then click on "+ Add".
The "Add admins" menu will open; use the search bar to look for the name(s) or username(s) of the account that you would like to add permissions for. Select the user(s) from the drop down.
Once done selecting user(s), click Add to confirm and exit the setting.
Data Synchronization Check (DSC) Setup
To compensate for the significant backup performance increase, there is a tradeoff made by the Change Key API, which skips the checking of de-selected files in the backup source, which over time can result in a discrepancy between the items or files/folders selected in the backup sources and those in the backup destination(s). However, the Change Key API will continue to check for de-selected Microsoft 365 user accounts. Un-selected individual Microsoft 365 user accounts detected during a backup job will be automatically moved to Retention Area.
To overcome this, it is necessary in some cases to run a Data Synchronization Check (DSC) periodically. The DSC is similar to a regular Microsoft 365 Change Key API backup job but with the additional checking and handling of de-selected files and/or folders in the backup source. So that it will synchronize the data in the backup source and backup destination(s) to avoid data build-up and the freeing up of storage quota.
Here are the pros and cons of performing the DSC.
| Backup time | Enabled | Disabled |
|---|---|---|
| Backup time | Since DSC is enabled it will only run on the set interval. For example, the default number of interval is 60 days. | As DSC is disabled, the backup time will not be affected. |
| The backup time for the data synchronization job will take longer than the usual backup as it is checking the de-selected files and/or folders in the backup source and data in the backup destination(s). | ||
| Storage | Management of storage quota will be more efficient as it will detect items that are de-selected and move them to retention where they will be removed after exceeding the retention policy, freeing up the storage quota. | Management of storage quota will be less efficient. Even though files and/or folders are already de-selected from the backup source, these files will remain in the Data Area of backup destination(s). |
To set up the DSC, refer to Appendix - Setting the Data Synchronization Check (DSC).
Authentication
To comply with Microsoft’s product roadmap for Microsoft 365, Basic Authentication (Authentication using Microsoft 365 login credentials) will no longer be utilized. Instead all new Microsoft 365 backup sets created will use Modern Authentication.
Since the second half of 2021, it will be a mandatory requirement for organizations still using Basic Authentication or Hybrid Authentication to migrate to Modern Authentication.
Modern Authentication provides a more secure user authentication by using app token for authentication aside from using the Microsoft 365 login credentials. In order to use Modern Authentication, the Microsoft 365 account is registered under Global region and the Microsoft 365 backup is configured to use Global region.
Existing backup sets using Basic Authentication created prior to AhsayACB v8.3.6.0 can be migrated to Modern Authentication. However, once the authentication process is completed, the authentication can never be reverted back to Basic Authentication.
After upgrading to AhsayACB v9.1.0.0 or above, the backup and restore process of existing Microsoft 365 backup sets still using Basic Authentication will not be affected during this transition period since Modern Authentication is not yet enforced by Microsoft.
For more information on how to migrate to Modern Authentication, please refer to:
To check the current authentication being used in your Microsoft 365 backup set, see criteria below:
Basic Authentication
If you click on the backup set and the following pop-up message is displayed, then the backup set is using Basic Authentication.
Modern and Hybrid Authentication
For backup set using Modern or Hybrid Authentication, there is no pop up authentication alert.
For more information on how to migrate to Modern Authentication, refer to Appendix – Re-Authentication of Microsoft 365 Backup Set.
Supported Services
Below are the supported services of Microsoft 365 Backup module. It is also specified in the table that some services that are currently not yet supported by the Microsoft 365 Backup module.
If you wish to back up SharePoint Sites, you have to use AhsayOBM.
Below are the supported Outlook Mailbox types of Microsoft 365 Backup.
Below are the items that you can back up or restore from an Outlook mailbox.
Below are the items that you can back up or restore from OneDrive.
Below are the items that you can backup or restore from Teams Chat.
Below are the Personal Site items that you can back up or restore from a Microsoft 365 backup set.
Below are the items from the Public Folder that you can backup and restore from a Microsoft 365 backup set.
Maximum Supported File Size
The following table shows the maximum supported file size per item for backup and restore of each service.
