Summary

This article provides important information about Backup from the Cloud (Microsoft Office 365) backup sets.

  • Backup and Restore Functionality for Microsoft Office 365 Data 
  • DS-NOC on Windows required for Office 365 backups 
  • Recommended DS-Client-to-DS-System setup for Office 365 backups 
  • Basic Workflow for Backup and Restore of Office 365 Data 
  • Prerequisites for Backup and Restore of Office 365 Data 
  • Prerequisites for Backup and Restore of SharePoint Online Data 
  • Prerequisites for Backup and Restore of Exchange Data 
  • Known Issues 
  • Important Information

Notice: Microsoft Office 365, Exchange, SharePoint, and Office are all trademarks of Microsoft Corporation. These trademarks, related terminologies, and their accompanying screenshots (if any) are used solely for the purpose of describing expected configuration and/or behavior to ensure proper use of the software described in this document.

For the remainder of this article, the term "Office 365 backup set" will be an abbreviation of "Backup from the Cloud (Microsoft Office 365) backup set".

Backup and Restore Functionality for Microsoft Office 365 Data

The Office 365 data that can be backed up and restored using DS-Client includes Exchange data, SharePoint Online data, andOneDrive data (as SharePoint Online data). There are exceptions for Office 365 Small Business domains.

Note: In Office 365 Small Business domains, only the backup and restore of Exchange Online data is supported by DS-Client; the backup and restore of SharePoint Online data is not.

Exchange data

Supported

DS-Client can back up Exchange data from Exchange Online or from an on-premises Exchange Server using Exchange Web Services (EWS). It can also restore Exchange data to either of the two. Exchange data that can be backed up and restored includes the following:

  • Email messages
  • Calendars and appointments
  • Contacts (including Contact Lists, but not Contact Groups)
  • Tasks

Exchange data needs to be in a user mailbox, shared mailbox, or resource mailbox to be supported. It can be restored to the same mailbox or a different mailbox of the original domain or of a different domain using DS-Client.

Note: Although Exchange data on an on-premises Exchange Server is not Office 365 data, the backup and restore of such data will be processed by DS-Client using Office 365 backup sets. Therefore, the backup and restore of data for Exchange Online, and for an on-premises Exchange Server using EWS, require mostly the same prerequisites.

Not supported: distribution groups

Exchange distribution groups are not supported in Office 365 backup sets. Because of the limitation of APIs provided by Microsoft, distribution groups cannot be automatically excluded in the DS-NOC interface.
For more details, see II. Exclude distribution groups from backup sets.

SharePoint Online data

Supported

DS-Client can back up SharePoint data from SharePoint Online and restore it to SharePoint Online. SharePoint data that can be backed up and restored includes the following:

  • Site collections
  • Sites
  • Lists
  • Individual list items

You can select data for backup at the site collection, site, and list levels. You cannot select list items individually as backup set items; however, the individual list items that are within selected lists will be backed up. You can select individual list items for restore. SharePoint data can only be restored to the same site collection at the original domain (i.e. Original Location) using DS-Client.

Not supported: Web Parts

Web Parts cannot be restored; however, the corresponding lists can be backed up and restored. For instructions on re-creating a Web Part, see this link at Microsoft Office Support.

For other instructions on managing or using Microsoft SharePoint, visit the Microsoft Office Support website.

OneDrive data (as SharePoint Online data)

Supported

OneDrive data is processed as SharePoint Online data by DS-Client. OneDrive data under personal sites can be backed up and restored using DS-Client.
OneDrive data for each user is backed up as the Documents List of each user's personal site, e.g.\\OFFICE.MICROSOFT.COM\VirtualShare:SharePoint Site Collections\https://< tenant >-my.sharepoint.com/personal/< user >_< tenant >_onmicrosoft_com/\Documents\*

DS-NOC on Windows required for Office 365 backups

To back up data for Office 365 users, you must use DS-NOC on Windows in addition to DS-Client. DS-NOC on Linux does not support Office 365 backups.

Cloud Management System in Windows DS-NOC is the required interface for you to create and schedule Office 365 backup sets. It is not recommended for you to use the Classic DS-User interface for creating or scheduling Office 365 backup sets.

After Office 365 backup sets have been created and scheduled using Cloud Management System in Windows DS-NOC, then you can use Classic DS-User to initiate on-demand Office 365 backups or to restore data for Office 365 backup sets, as necessary.

Required interfaces for Office 365 backup sets

Cloud Management System
in Windows DS-NOC		 Classic DS-User
Creating Office 365 backup sets REQUIRED Not recommended
Scheduling Office 365 backups REQUIRED Not recommended
Initiating on-demand Office 365 backups Not available REQUIRED
Restoring Office 365 data Not available REQUIRED
Monitoring Office 365 backup sets Recommended Available

Cloud Management System in Windows DS-NOC

Cloud Management System in DS-NOC on Windows is a centralized tool that offers an automated process for creating and scheduling Backup from the Cloud (Microsoft Office 365) backup sets and Backup from the Cloud (Google Apps) backup sets for multiple users. It is also a centralized interface for monitoring these backup sets.

Cloud Management System in DS-NOC allows you to specify backup settings for multiple users in one single pane; backup sets will be automatically created according to your specified settings. For Office 365 backup sets, DS-NOC can divide backup sets among multiple DS-Client instances and distribute multiple Microsoft Office credentials among many backup sets.

Recommended DS-Client-to-DS-System setup for Office 365 backups

To optimize the speed of Office 365 backups, set up DS-Client and DS-System to communicate within the same local area network (LAN) at the same site location. This setup keeps communication localized between DS-Client and DS-System. After obtaining data from the source, DS-Client can send the backup data to DS-System via a LAN, which is more efficient than transferring over a wide area network (WAN).

This setup differs from the typical recommendation of installing DS-Client on the same LAN with the backup source.

Basic Workflow for Backup and Restore of Office 365 Data

Backing up Office 365 data for multiple users

First, you need to configure and edit backup settings for Office 365 backup sets using Cloud Management System in DS-NOC on Windows.
DS-NOC on Windows will create and schedule Office 365 backup sets in DS-Client according to your settings and configure DS-Client as necessary. DS-Client will then run Office 365 backups according to your settings.
Procedural instructions on using Cloud Management System in DS-NOC are available in Section 7- DS-Client of the DS-NOC User Guide.

Restoring Office 365 data for individual users

  1. Before restoring the data of a particular Office 365 user, you need to identify the Office 365 backup set in the DS-Client that processed that user's data. You will obtain that information using Cloud Management System in DS-NOC on Windows.
  2. In DS-User, using the Restore Now Wizard, select the data that you want to restore in that backup set.

DS-Client will then restore the selected data.

Prerequisites for Backup and Restore of Office 365 Data

Ensure that the following prerequisites are met before you perform the backup and restore of data on Exchange Online, an on-premises Exchange Server, SharePoint Online, and OneDrive.

DS-NOC on Windows: Required tool for Office 365 backups

You must use Cloud Management System in DS-NOC on Windows to create Office 365 backup sets. 
DS-NOC on Linux does not support Office 365 backups.

DS-Client Computer & DS-NOC Server: Required network configuration

You must ensure that all of the following network requirements are met:

  • That the DS-Client computer and DS-NOC server are able to access *.office365.com.
  • That ports 80, 8080, and 443 are open on the DS-Client computer and the DS-NOC server. The backup and restore ofOffice 365 backup sets require these ports.
  • That proxy server settings are configured if the DS-NOC service, the DS-Client service, or both are behind a proxy.

If the DS-NOC service is behind a proxy, see instructions on configuring Tomcat to use a proxy server in the DS-NOC Installation Guide.

If the DS-Client service is behind a proxy, see instructions on configuring DS-Client to connect to DS-NOC and to cloud sites via a proxy server in the DS-Client User Guide.

DS-Client Installation: Microsoft Office 365 DS-Client plug-in required

For DS-Client to perform backup and restore for Backup from the Cloud (Microsoft Office 365) backup sets, including Microsoft Exchange Server (using EWS) backup sets, you must install the Microsoft Office 365 DS-Client plug-in on the DS-Client computer or on every node of a Grid DS-Client installation.

The plug-in installation file can be found on the installation DVD in the following folders:

  • \Software\DS-Client\Windows_64_bit\plugins\install.exe
  • \Software\DS-Client\Windows_32_bit\plugins\install.exe

License: Microsoft Office 365 license required

Microsoft Office 365 license is required for two types of Office 365 user accounts:

  • Each end user whose Office 365 mailbox or SharePoint site you plan to back up and restore. The corresponding license, e.g., Microsoft Exchange Online license or Microsoft SharePoint Online license, is required depending on the backup source.
  • Each user (1) who will administer/manage the backup and restore process in the Office 365 portal/admin center, and/or (2) whose credentials will be used by DS-Client to access the backup source.

Requirement for backup: Limit each backup set to one user or site collection

You must limit each Office 365 backup set to back up the data of no more than one Office 365 user account or site collection.

This requirement applies to the backup of Exchange Online, SharePoint Online, and on-premises Exchange Server using EWS.

Note: When you create Office 365 backup sets using Cloud Management System in Windows DS-NOC, this requirement will be met automatically.

Prerequisites for Backup and Restore of SharePoint Online Data

Ensure that the following prerequisites are met before you perform the backup and restore of SharePoint Online data, including OneDrive data:

DS-Client Installation: Windows administrator account required for SharePoint Online

Ensure that the DS-Client Service uses a Windows administrator account to log on when it starts. This user is selected during DS-Client installation: In the Service Account screen of the DS-Client/DS-User Setup Wizard, select This Account to specify a Windows administrator account, instead of selecting Local System Account.

The Windows-specific dependencies installed for SharePoint Online require a Windows administrator account for proper operation. If the DS-Client Service uses a Local System Account, Login failure errors may occur when you attempt to create a Backup from the Cloud (Microsoft Office 365) backup set for SharePoint Online data. This is a limitation of the SharePoint authentication method used by the Microsoft SharePoint Component Object Model SDK, which DS-Client uses to back up SharePoint Online data.

This requirement applies if there is any possibility that you will use Asigra software for the backup and restore of SharePoint data, including OneDrive data.

DS-NOC Server: Windows-specific dependencies required for SharePoint Online

You must ensure that Windows-specific dependencies are installed on the DS-NOC server to use DS-NOC to create, edit, or monitor Office 365 backup sets for SharePoint Online data, including OneDrive data.

SharePoint Online requires Windows-specific dependencies to allow data access. For details on these requirements, see information on additional configurations for SharePoint Online in the DS-NOC User Guide.

Apache Tomcat Service: Windows administrator account required for SharePoint Online

Ensure that the Apache Tomcat Service uses a Windows administrator account to log on. Apache Tomcat is the service that runs DS-NOC.

This is a requirement to ensure proper operation owing to the same Windows-specific dependencies for SharePoint Online that are mentioned above in DS-Client Installation: Windows administrator account required for SharePoint Online. It applies if there is any possibility that you will use Asigra software for the backup and restore of SharePoint data, including OneDrive data.

Office 365 domain: User permission requirements for SharePoint Online

To perform the backup and restore of SharePoint Online data, including OneDrive data, you must configure the 12 users per DS-Client that are used for accessing the backup source and restore destination as follows.

  • Global admin: Ensure that all of the users whose network credentials will be used for accessing the backup source and restore destination are set as Global administrators in Office 365 admin center.
  • Site Collection Administrator: In the Office 365 SharePoint admin center, set those same Global administrators as the Site Collection Administrators for each site collection, including each personal site, to be backed up and restored.

Backup requirement: Limit each backup set to one site collection

Limit each Office 365 backup set to back up the data of no more than one site collection.

When you create Office 365 backup sets using Cloud Management System in Windows DS-NOC, this requirement will be met automatically.

Note: Backing up multiple site collections using one Office 365 backup set may result in failure.

Prerequisites for Backup and Restore of Exchange Data

Ensure the following prerequisites are met before you perform the backup and restore of Exchange data on Exchange Online or an on-premises Exchange Server using EWS, unless otherwise specified:

On-premises Exchange Server using EWS: Authentication setup required

Implement the following authentication setup on the DS-Client computer and on the on-premises Exchange Server.
The following procedures prepare your on-premises Exchange Server to be a backup source and restore destination for Backup from the Cloud (Microsoft Office 365) backup sets. They are important for ensuring that DS-Client is able to connect to the Exchange Server using EWS.

Authentication Setup in DS-Client Computer

On the DS-Client computer on which the Office 365 plug-in is running, set the following configuration in Local Group Policy Editor:

  1. Start > Run.
  2. Enter gpedit.msc The Group Policy Object Editor appears.
  3. Browse to Local Computer Policy > Computer Configuration > Administrative Templates > Windows Components> Windows Remote Management (WinRM) > WinRM Client.
  4. Set up authentication as follows:

Allow Basic Authentication : Enabled
Allow CredSSPauthentication : Not configured
Allow unencrypted traffic : Enabled
Disallow Digest authentication : Not configured
Disallow Kerberos authentication : Not configured
Disallow Negotiate authentication : Enabled
Trusted Hosts : Enabled
Note: When you enable Trusted Hosts, be sure to add the computer name of the on-premises Exchange Server (or add *) to theTrustedHostsList.

Authentication Setup in on-premises Exchange Server

I. Enable Windows Authentication for the EWS virtual directory in IIS:

  1. On your on-premises Microsoft Exchange Server, open Internet Information Services Manager (IIS).
  2. Browse to the Default Web Site/EWS folder.
  3. For the folder Windows Authentication, set the status to Enabled.

The authentication setup should appear as follows:

Anonymous Authentication : Disabled
ASP .NET Impersonation : Disabled
Basic Authentication : Enabled
Digest Authentication : Disabled
Forms Authentication : Disabled
Windows Authentication : Enabled

II. Enable Basic Authentication for EWS:

  1. To go to the administrative settings for your on-premises Exchange Server, visit: https://< server >/ecp In the URL, < server > can be an IP address, hostname, or FQDN at which the Exchange Server can be accessed.
  2. In the Exchange Admin Center, click servers to go to your on-premises Exchange Server.
  3. Click virtual directories and double-click EWS.
  4. Under Authentication, select Basic authentication.

Exchange domain: Multiple credentials required for Exchange

You must prepare multiple credentials to be used for the backup of Exchange data:

  1. Identify or create multiple users whose credentials will be used for the backup of Exchange data.
  2. Configure each user according to procedures in Exchange 365 domain: User configuration required for Exchange.

Note: We recommend a minimum of 12 backup credentials per DS-Client. If you increase the maximum concurrent activities via the MaxSessions parameter, you must increase the number of backup credentials accordingly.

This requirement applies to data backup for Exchange Online and for an on-premises Exchange Server.
Before setting up the backup of Exchange Online data using DS-NOC, prepare to provide multiple credentials. DS-NOC will distribute the credentials among backup sets for mutiple DS-Clients, maximum 500 backup sets per DS-Client, to use during backup. Backup may fail if DS-Client does not have access to multiple credentials.

For the data backup of an on-premise Exchange Server using EWS, prepare multiple credentials that DS-Client can use for backup activities that will run concurrently. You must plan backups carefully to prevent concurrent backup activities from using the same credentials.

Exchange domain: User permission requirements for Exchange

The following procedures are required for the backup and restore of data for Exchange Online and for on-premises Exchange using EWS. Configure each user that will be used for logging on to the Exchange Server as follows:

I. Add user to Discovery Management

  1. Go to the administrative settings for Exchange:
    • For Exchange Online: In the Microsoft Office 365 account, on the ADMIN menu, select Exchange.
    • For Exchange Online in an Office 365 Small Business domain, visit: https://outlook.office365.com/ecp/
    • For an on-premises Exchange Server, visit: https://< server >/ecp In the URL, < server > can be an IP address, hostname, or FQDN at which the Exchange Server can be accessed.
  2. Go to permissions > admin roles.
  3. In the list, select Discovery Management and click the Edit button.
  4. In the pop-up window, under Members, click +.
  5. In a new pop-up window, select the user you need to add, click add, and click OK.
  6. In the first pop-up window, click Save.
  7. In the admin roles pane, verify that the user you need to add is listed under Members of the Discovery Managementgroup.

II. Add user to Organization Management

  1. Go to the administrative settings for Exchange:
    • For Exchange Online: In the Microsoft Office 365 account, on the ADMIN menu, select Exchange.
    • For Exchange Online in an Office 365 Small Business domain, visit: https://outlook.office365.com/ecp/
    • For an on-premises Exchange Server, visit: https://< server >/ecp In the URL, < server > can be an IP address, hostname, or FQDN at which the Exchange Server can be accessed.
  2. Go to permissions > admin roles.
  3. In the list, select Organization Management and click the Edit button.
  4. In the pop-up window, under Members, click +.
  5. In a new pop-up window, select the user you need to add, click add, and click OK.
  6. In the first pop-up window, click Save.
  7. In the admin roles pane, verify that the user you need to add is listed under Members of the Organization Managementgroup.

III. Add Application Impersonation as an assigned role in Organization Management

  1. Go to the administrative settings for Exchange:
    • For Exchange Online: In the Microsoft Office 365 account, on the ADMIN menu, select Exchange.
    • For Exchange Online in an Office 365 Small Business domain, visit: https://outlook.office365.com/ecp/
    • For an on-premises Exchange Server, visit: https://< server >/ecp In the URL, < server > can be an IP address, hostname, or FQDN at which the Exchange Server can be accessed.
  2. Go to permissions > admin roles.
  3. In the list, select Organization Management and click the Edit button.
  4. In the pop-up window, under Role, click +.
  5. In a new pop-up window, select ApplicationImpersonation, click add, and click OK.
  6. In the first pop-up window, click Save.
  7. In the admin roles pane, verify that ApplicationImpersonation is listed under Assigned Roles of the Organization Management group.

Exchange Data: Requirements for backup

The following requirements apply to both Exchange Online and an on-premises Exchange Server using EWS unless otherwise specified.
I. Restrict source location: Ensure that the Exchange data that you need to back up are located in a user mailbox, shared mailbox, or resource mailbox. The backup of Exchange data are only supported at these source locations.

II. Exclude distribution groups from backup sets: Ensure that distribution groups are excluded in every Office 365 backup set whether you are creating it via DS-NOC or DS-User. 

Note: An Exchange backup set that contains distribution groups as backup items or as part of backup set items may result in error during backup.

III. (Exchange Online) Provide multiple credentials to be used for backups: Ensure that you have provided multiple credentials when editing backup settings for a domain in DS-NOC. DS-NOC will distribute the credentials among backup sets for DS-Client to use for backup processes.

Note: Backups may fail if DS-Client does not have access to multiple credentials.

III. (On-premises Exchange) Prevent concurrent backups from using the same credentials: When creating backup sets in DS-User, make sure that you use different credentials among backups that will run concurrently. Plan backup activities carefully to avoid running concurrent backups using the same credentials.

Note: Backups may fail if concurrent backup activities use the same credentials.

IV. Limit each backup set to one user: Limit each Microsoft Exchange Server (using EWS) backup set and each Office 365backup set to back up the data of no more than one user.

Note: Backing up data for multiple users using one Microsoft Exchange Server (using EWS) backup set or one Office 365backup set may result in failure.

When you create Office 365 backup sets using Cloud Management System in Windows DS-NOC, this requirement will be met automatically.

How to exclude Exchange distribution groups via DS-User
In DS-User, you can enable a feature that automatically makes distribution groups unavailable for selection. This elimination process will delay the New Backup Set Wizard as it populates a list of mailboxes for selection.
To enable this feature, follow these steps in DS-User:
1. In DS-User, on the Setup menu, select Configuration.
2. Click the Advanced tab.
3. Select the category Miscellaneous.
4. Select the parameter ExchangeOnlineExcludeGroupMailboxes and set its value to Yes.
Note: If this feature is not enabled, you must ensure that distribution groups are not selected alongside mailboxes that you have manually selected for backup in an Office 365 backup set.

How to exclude Exchange distribution groups via DS-NOC
Distribution groups will appear in the same list of mailboxes in Cloud Management System in DS-NOC. The DS-NOC interface cannot automatically separate users from groups because of the limitations of the APIs provided by Microsoft.
Therefore, when you configure Office 365 backup sets for a domain in Cloud Management System, you must ensure that distribution groups are not selected alongside mailboxes that you have manually selected for backup.

Known Issues

Backup error in Event Log

In the backup of Exchange Online data using an Office 365 backup set, you may see the following error in the DS-Client Event Log after the backup of some mailboxes: 10110039 : The following exception has occurred. This property was requested, but it wasn't returned by the server.
This error does not affect the successful backup or restore of items from the mailbox.

Restore error when mailbox is deleted and inactive

When you restore Office 365 Exchange data to Original Location using DS-Client within 30 days after the deletion of a mailbox and the required mailbox is inactive at the destination location, the following behavior may occur:

  • The deleted mailbox remains in deleted status.
  • Restore attempts fail with this event: 10110039 : The following exception has occurred. The SMTP address has no mailbox associated with it. The mailbox remains in deleted state.

Note: To prevent this error, ensure that the required mailbox already exists and is active in the domain at the destination.

Limitation: UNC paths not supported for local disk restores

UNC paths are not supported for Office 365 backup sets that are configured for local disk restores. When you click Browse to select a restore location, UNC paths will not be available for selection.

Limitation: Automatic versioning unavailable for SharePoint Online data

DS-Client does not support automatic versioning for SharePoint Online data even if you have enabled versioning for specific lists in SharePoint. DS-Client will only back up the latest version of the list items, and it will only restore the generation that is selected to be restored for each list item. The restored generation will be added to the SharePoint Online database as the latest version.

Limitation: Backup of SharePoint lists with 5,000+ items not supported

Microsoft SharePoint has a list view threshold of 5,000 items. See this Microsoft Support article.

DS-Client cannot back up lists that exceeds this threshold. The following error message may appear in the Event Log when DS-Client attempts to back up a SharePoint list that contains more than 5,000 items: The number of items in this list exceeds the list view threshold, which is 5000 items.

To avoid backup failure because of this limitation, split items from one list into multiple lists so that each list that needs to be backed up by DS-Client does not exceed 5,000 items.

Important Information

Restoring orphaned Office 365 backup sets

Like other kinds of backup sets, an Office 365 backup set can become orphaned and can be restored. To restore an orphaned Office 365 backup set to an Alternate Location or to the local disk of the DS-Client computer, perform the following:

  1. Recover the backup set.
  2. Restore the backup set.

To restore an orphaned Office 365 backup set to its Original Location, perform the following:

  1. Recover the backup set.
  2. Migrate the backup set.
  3. Restore the backup set.

In the migration of a backup set, you will re-configure the backup items of the set and provide the credentials that DS-Client requires to access the source of a backup set. Migration is required for restoring an orphaned Office 365 backup set specifically to its Original Location or for performing backups for the set.

For procedural instructions on the following topics, see the DS-Client User Guide:

  • Recovering orphaned backup sets
  • Migrating a backup set
  • Restoring an Office 365 backup Set