DS-Client can back up Exchange data from an on-premises Exchange Server 2013 and higher using Exchange Web Services (EWS).

Exchange data needs to be in a user mailbox, shared mailbox, or resource mailbox to be supported. It can be restored to the same mailbox or a different mailbox of the original domain or of a different domain using DS-Client.

Note: Although Exchange data on an on-premises Exchange Server is not Office 365 data, the backup and restore of such data will be processed by DS-Client using Office 365 backup sets. Therefore, the backup and restore of data for Exchange Online, and for an on-premises Exchange Server using EWS, require mostly the same prerequisites.

DS-Client Installation: Microsoft Office 365 DS-Client plug-in required
For DS-Client to perform backup and restore for Backup from the Cloud (Microsoft Office 365) backup sets, including Microsoft Exchange Server (using EWS) backup sets, you must install the Microsoft Office 365 DS-Client plug-in on the DS-Client computer..
The plug-in installation file can be found on the installation DVD in the following folders:
\Software\DS-Client\Windows_64_bit\plugins\install.exe
\Software\DS-Client\Windows_32_bit\plugins\install.exe

Prerequisites for Backup and Restore of Exchange Data
Ensure the following prerequisites are met before you perform the backup and restore of Exchange data on Exchange Online or an on-premises Exchange Server using EWS, unless otherwise specified.

On-premises Exchange Server using EWS: Authentication setup required
Implement the following authentication setup on the DS-Client computer and on the on-premises Exchange Server.
The following procedures prepare your on-premises Exchange Server to be a backup source and restore destination for Backup from the Cloud (Microsoft Office 365) backup sets. They are important for ensuring that DS-Client is able to connect to the Exchange Server using EWS.
  Authentication Setup in DS-Client Computer
On the DS-Client computer on which the Office 365 plug-in is running, set the following configuration in Local Group Policy Editor:
  1. Start > Run.
  2. Enter gpedit.msc     The Group Policy Object Editor appears.
  3. Browse to Local Computer Policy > Computer Configuration > Administrative Templates > Windows Components > Windows Remote Management (WinRM) > WinRM Client.
  4. Set up authentication as follows:
Allow Basic Authentication : Enabled
Allow CredSSPauthentication : Not configured
Allow unencrypted traffic : Enabled
Disallow Digest authentication : Not configured
Disallow Kerberos authentication : Not configured
Disallow Negotiate authentication : Enabled
Trusted Hosts : Enabled

Note: When you enable Trusted Hosts, be sure to add the computer name of the on-premises Exchange Server (or add *) to the TrustedHostsList.

Authentication Setup in on-premises Exchange Server
I. Enable Windows Authentication for the EWS virtual directory in IIS:
  1. On your on-premises Microsoft Exchange Server, open Internet Information Services Manager (IIS).
  2. Browse to the Default Web Site/EWS folder.
  3. For the folder Windows Authentication, set the status to Enabled.
    The authentication setup should appear as follows:
Anonymous Authentication : Disabled
ASP .NET Impersonation : Disabled
Basic Authentication : Enabled
Digest Authentication : Disabled
Forms Authentication : Disabled
Windows Authentication : Enabled

II. Enable Basic Authentication for EWS:
  1. To go to the administrative settings for your on-premises Exchange Server, visit: https://< server >/ecp    In the URL, < server > can be an IP address, hostname, or FQDN at which the Exchange Server can be accessed.
  2. In the Exchange Admin Center, click servers to go to your on-premises Exchange Server.
  3. Click virtual directories and double-click EWS.
  4. Under Authentication, select Basic authentication.
Exchange domain: Minimum credentials required for Exchange
You must prepare at least the minimum number of credentials to be used for the backup of Exchange data:
1. Identify or create multiple users whose credentials will be used for the backup of Exchange data.

IMPORTANT: Each user account must be associated with a user mailbox.
2. Configure each user according to procedures in Section "Exchange domain: User permission requirements for Exchange"

IMPORTANT: The minimum number of credentials required is proportional to the maximum number of concurrent activities (which is configured using the MaxSessions parameter). Each credential that you provide can support no more than 4 concurrent activities. Therefore, when MaxSessions is set at a value of 4 or smaller, provide at least one credential per DS-Client. When MaxSessions is set at a value between 5 and 8, provide at least two credentials per DS-Client. When MaxSessions is set at a value between 9 and 12, provide at least three credentials per DS-Client.

This requirement applies to data backup on-premises Exchange Server.
For the data backup of an on-premise Exchange Server using EWS, prepare the required number of credentials that DS-Client can use for backup activities that will run concurrently. However, you must also carefully plan the backup activities to prevent each credential from being used by more than four concurrent backup activities.

Exchange domain: User permission requirements for Exchange
The following procedures are required for the backup and restore of data for Exchange Online and for on-premises Exchange using EWS. Configure each user that will be used for logging on to the Exchange Server as follows.
1. Add user to Discovery Management
a) Go to the administrative settings for Exchange:
For Exchange Online: In the Microsoft Office 365 account, on the ADMIN menu, select Exchange.
For Exchange Online in a Microsoft Office 365 Small Business domain, visit https://outlook.office365.com/ecp/
For an on-premises Exchange Server, visit https:///ecp
In the URL,  can be an IP address, hostname, or FQDN at which the Exchange Server can be accessed.
b) Go to permissions > admin roles.
c) In the list, select Discovery Management and click the Edit button.
d) In the pop-up window, under Members, click +.
e) In a new pop-up window, select the user you need to add, click add, and click OK.
f) In the first pop-up window, click Save.
g) In the admin roles pane, verify that the user you need to add is listed under Members of the Discovery Management group.
2. Add user to Organization Management
a) Go to the administrative settings for Exchange:
For Exchange Online: In the Microsoft Office 365 account, on the ADMIN menu, select Exchange.
For Exchange Online in a Microsoft Office 365 Small Business domain, visit: https://outlook.office365.com/ecp/
For an on-premises Exchange Server, visit https:///ecp In the URL,  can be an IP address, hostname, or FQDN at which the Exchange Server can be accessed.
b) Go to permissions > admin roles.
c) In the list, select Organization Management and click the Edit button.
d) In the pop-up window, under Members, click +.
e) In a new pop-up window, select the user you need to add, click add, and click OK.
f) In the first pop-up window, click Save.
g) In the admin roles pane, verify that the user you need to add is listed under Members of the Organization Management group.
3. Add Application Impersonation as an assigned role in Organization Management
a) Go to the administrative settings for Exchange:
For Exchange Online: In the Microsoft Office 365 account, on the ADMIN menu, select Exchange.
For Exchange Online in a Microsoft Office 365 Small Business domain, visit https://outlook.office365.com/ecp/
For an on-premises Exchange Server, visit https:///ecp
In the URL,  can be an IP address, hostname, or FQDN at which the Exchange Server can be accessed.
b) Go to permissions > admin roles.
c) In the list, select Organization Management and click the Edit button.
d) In the pop-up window, under Role, click +.
e) In a new pop-up window, select ApplicationImpersonation, click add, and click OK.
f) In the first pop-up window, click Save.
g) In the admin roles pane, verify that ApplicationImpersonation is listed under Assigned Roles of the Organization Management group.

Exchange Data: Requirements for backup
The following requirements apply to both Exchange Online and an on-premises Exchange Server using EWS unless otherwise specified.
1. Restrict source location
Ensure that the Exchange data that you need to back up are located in a user mailbox, shared mailbox, or resource mailbox. The backup of Exchange data are only supported at these source locations.
2. Exclude distribution groups from backup sets
3. Do the following where applicable:
(On-premises Exchange) Prevent concurrent backups from using the same credentials
When creating backup sets in DS-User, make sure that you use different credentials among backups that will run concurrently. Plan backup activities carefully to avoid running concurrent backups using the same credentials.

NOTE: Backups may fail if concurrent backup activities use the same credentials.

To exclude SMTP addresses not associated with a mailbox via DS-User
In DS-User, you can enable a feature that automatically makes distribution groups, deleted users, and other email addresses that do not have a mailbox unavailable for selection in the New Backup Set Wizard. This elimination process will delay the wizard as it verifies each item before populating the list of email addresses for selection.

To enable this feature, follow these steps in DS-User:
1. In DS-User, on the Setup menu, select Configuration.
2. Click the Advanced tab.
3. Select the category Miscellaneous.
4. Select the parameter ExchangeOnlineExcludeGroupMailboxes and set its value to Yes