#AvePoint Cloud Backup

AvePoint Cloud Backup supports backup for all Microsoft 365 instances, such as Exchange Online, OneDrive, SharePoint Online, Microsoft 365 Groups, Teams, Microsoft Teams Chat, Project Online, Public Folders, Viva Engage, Power BI, Power Automate, and Power Apps to protect your data. These object types are backed up and restored independently of one another.

Note the following for using the services of AvePoint Cloud Backup:

#SharePoint Online, OneDrive, and Project Online:

For the hidden lists that you can include in the backup, refer to Hidden Lists.

• It is now possible to change the SharePoint domain name for your organization in Microsoft 365, as introduced in the Microsoft article: Rename your SharePoint domain. This change affects only the SharePoint and OneDrive URLs. It doesn’t impact email addresses. After the domain name is changed and updated into Auto Discovery, Cloud Backup for Microsoft 365 will run a full backup for SharePoint Online sites and OneDrive objects with new URLs.

• AvePoint Cloud Backup service for OneDrive will protect the Documents library and protect the Site Assets library if the site feature Site NoteBook is activated.

  The service only protects content and permissions for OneDrive since OneDrive is the cloud service used to securely store, share, and access your files.

• Backup for OneDrive now uses Microsoft Graph API for improved performance. Graph API has been more focused on protecting OneDrive content, and it has some limitations, such as it cannot protect the file versions. The file version number cannot be kept either after being restored to the destination. The restored file will use version: 1.0. You can refer to OneDrive Data Types for additional details. If you require any additional assistance, contact AvePoint Support.

• Due to API limitations, Cloud Backup cannot protect the history versions of OneNote files.

• If there are security changes but no changes on the content in the sites, the scheduled incremental backup jobs will not back up the securities. Moving forward, the changes on the securities in the sites (including the SharePoint Online sites, OneDrive, and Microsoft 365 Groups/Teams team sites) that have not yet been backed up, in this case, will be included in an incremental backup once a week.

  If some items in a site encounter errors in a backup but there are no changes on the content in the site for the next backup, the scheduled incremental backup jobs will not back up these items with errors. Moving forward, they will be included in an incremental backup once a week.

• If you would like to filter the folders to protect for OneDrive service or Exchange Online service, or filter the folders or lists/libraries within the site collections of SharePoint Online service, Project Online services, Microsoft 365 Groups services, or Teams service, you can contact the AvePoint Support team for assistance. Note that if your subscription to Cloud Backup for Microsoft 365 is based on the protected data size, the total consumed data size in your subscription will not be affected by the filter policy. AvePoint will not exclude the size of the filtered items from the total consumed data size.

• The files in the SharePoint site and the mailbox items in Exchange Online that are applied with the labels created via AIP (Azure Information Protection) can be protected by AvePoint Cloud Backup, as well as the applied Label. The documents applied with the sensitivity labels of DKE (Double Key Encryption) are also supported, but only the user who has permission can access them.

• By default, the Preservation Hold library is not protected by AvePoint Cloud Backup for Microsoft 365. An additional cost is required to enable the feature.

• AvePoint Online Services Auto discovery now supports including orphaned OneDrive in scan profiles of OneDrive, but the objects cannot be synchronized to Cloud Backup for Microsoft 365.

• AvePoint Cloud Backup for SharePoint Online also supports protecting Communication Sites. When restoring a deleted Communication Site to its original location, AvePoint Cloud Backup supports restoring the custom design of the Communication Site in the backup. If the Communication Site is registered through App Profile, the Communication Site can only be restored with the default design. Note that the comments in Communication Sites are not currently supported.

• As the locked site collections are inaccessible, the backup job will check the lock status and skip backing up the locked site collections, which will be recorded in the job report; For read-only site collections, only the full backup job that runs once every year will back them up. Since no changes can be made to read-only site collections, the incremental backup jobs will skip them.

• You can now use an app profile to scan the Project Online site collections. In this way, the service account does not require the Site Collection Administrator role. However, Project Online data cannot be protected in the app context (using app profile authentication). A service account with enough permissions is still required for the backup and restore for Project Online. For the required permissions of a service account, refer to Service Account Authentication. Note the following for the Project Online data types:

  • AvePoint Cloud Backup for Project Online service supports restoring Project Permission Mode features.

  • Project Online service cannot protect the Project for the web data and cannot fully support the data added through the Microsoft 365 subscription Project Online desktop client. For example, custom fields.

  • For additional details on the protected data types, refer to Project Online Data Types.

#Exchange Online and Public Folders:

• You can now choose to protect the Recoverable Items folder in the user’s primary mailbox for the Exchange Online service. If you want to enable this feature, contact support for assistance. Note that an additional cost is required. Currently, we support the Deletions, Purges, Versions, and DiscoveryHolds subfolders in the Recoverable Items. For more information about Recoverable Items, refer to this Microsoft article: Recoverable Items folder in Exchange Online. On the backup data tree, you can find the data in the following directory: mailbox address/Recoverable Items folder (System). This folder cannot be a destination for an out of place restore, and the backup data of this folder being restored to its original mailbox will use the following name: Recovery Items folder (System) _ Restored. Note that due to the API limitation, this folder directory will always be displayed in English regardless of the preferred display language of Microsoft 365.

• The hidden folders in the mailboxes (including Exchange Online mailboxes, Group mailboxes, and Teams group mailboxes) will be excluded from the backup for better performance. If you want to include the hidden folders in your backup, contact AvePoint support for assistance.

• If you would like to filter the folders to protect for OneDrive service or Exchange Online service, or filter the folders or lists/libraries within the site collections of SharePoint Online service, Project Online services, Microsoft 365 Groups services, or Teams service, you can contact the AvePoint Support team for assistance. Note that if your subscription to Cloud Backup for Microsoft 365 is based on the protected data size, the total consumed data size in your subscription will not be affected by the filter policy. AvePoint will not exclude the size of the filtered items from the total consumed data size.

• The service for Public Folders only supports restoring content and permissions of Public Folders to the original location. Cloud Backup for Microsoft 365 now supports the backup of Public Folder metadata via app profile authentication. To protect Public Folder metadata, ensure your backup for Public Folder metadata is enabled and the Exchange Administrator role is assigned to the app in Microsoft Entra ID. Note that the impersonation accounts that you configured for Public Folders in AvePoint Online Services interface will be synchronized to Cloud Backup for Microsoft 365 after June 2023 release and the Cloud Backup in app context only supports using impersonation accounts for the backup and restore of Public Folders. If you are a new customer, you must navigate to the Settings > Backup page to configure impersonation accounts. For details, refer to Configure Settings.

• For subscriptions with Multi-Geo enabled, the public folders can only be protected in the Central AOS Location.

• Use Object ID instead of mailbox address as the unique identifier for Exchange Online mailboxes and Public Folders. This change has been made to both the Cloud Backup for Microsoft 365 service and the Standalone tool. Due to this change, the mailboxes that have been re-created with the same address will no longer be regarded as the same one. This might require a broader search to ensure you find all the backup data for restoring, exporting, or deleting; the mailbox being renamed can only be found by the new name with the former backup data associated, and its former name will be displayed in its row.

• The Exchange Online service does not support protecting the Search Folders.

#Microsoft 365 Groups and Teams

• The Teams service is now available for customers using Microsoft 365 operated by 21Vianet in China. Note that hosted content is unsupported and will be skipped in the backup.

• To protect Teams mailboxes, at least one owner/member in the team should have the Exchange Online product license.

• The hidden folders in the mailboxes (including Exchange Online mailboxes, Group mailboxes, and Teams group mailboxes) will be excluded from the backup for better performance. If you want to include the hidden folders in your backup, contact AvePoint support for assistance.

• AvePoint Cloud Backup for Microsoft 365 can now check the status of groups and teams in Microsoft 365 and provides the option to help you restore the soft-deleted groups and teams (within the 30-day retention period) from Microsoft 365 recycle bin.

• If you are using service account authentication for the backup of Teams’ shared/private channels, the service account must be the owner of the shared/private channel.

#Teams Chat

• The Teams Chat service can protect the 1:1 chats and the group chats in Teams.

• Before you enable the Teams Chat backup service, you must register a Cloud Backup for Microsoft 365 (All permissions) app profile or a custom app profile for Microsoft 365 for Auto Discovery to scan the Microsoft 365 users and request access to the Microsoft Graph Teams Export API. For the app permissions, refer to Required Permissions of Microsoft 365 App Profile.

  Note that starting May 18, 2023, the online form and the protected API approval process are no longer needed. You can call the protected APIs as long as the requirements for accessing without a user (https://learn.microsoft.com/en-us/graph/auth-v2-service) are met.

• Microsoft Teams Chat service in Cloud Backup for Microsoft 365 uses the Microsoft Graph Teams Export API model B to retrieve Teams chat messages from Microsoft Teams Chat for backup. Teams Export API model B provides high-performance, reliable, and efficient export of large-scale Teams data through the Microsoft Graph API.

  Note that effective August 25, 2025, Microsoft discontinued usage charges for the Teams Export API (Model B) globally. After this date, no further billing events were registered and no client changes were required. For details, refer to Microsoft documentation: Overview of metered APIs and services in Microsoft Graph and Metered APIs and services in Microsoft Graph.

  NOTE

  The number of messages in the Microsoft 365 Admin Center is just for the specific duration you define when exporting the report, not the full total amount. Additionally, the Microsoft Export API only supports export at a user level, so if there is a group chat with multiple users, the same message will be exported multiple times if all these users are included in the scope, which means the number of messages which will be backed up by Cloud Backup has the potential to be higher than the number of messages in the Microsoft admin center report. For confirmation, you can check the job report after the job has finished for the backup chat messages count to compare with the bill from Microsoft. If necessary, you can also limit the user scope for the export. Here is an example: In the report in the Microsoft 365 admin center shows the last 180 days’ number of Teams chat messages are 1000. Then for the whole year, the number of messages will be approximately 2000. Because there is no deduplication logic for the Microsoft 365 export API, the same message will be exported multiple times if all these users are included in the scope. So let’s say that all are 1V1 chats, then the message number charge by export API will be doubled to approximately 4000 messages. If most of chats are group chats with multiple users, the cost will be even higher.

• Cloud Backup for Microsoft 365 uses the Teams Export API model B for Teams Chat backup. Chats started by internal users (even including external users) can be fully protected. For chats started by external users, only plain text can be protected. The group chat messages cannot be protected if the user has been removed from the group.

#Viva Engage

• To protect Viva Engage data, If you use the Viva Engage service, you need to have the Microsoft 365 app (All permissions) or Cloud Backup for Microsoft 365 app (All permissions), and the Viva Engage app. The authentication user of this Viva Engage app must have the Verified Admin role and the Yammer administrator role with the Viva Engage product license. Alternatively, you can have a custom Azure app with delegated permissions. For details on configuring a Viva Engage app, refer to Create an App Profile. Viva Engage service currently supports in place restore only (restoring to the original location), meaning the Viva Engage community needs to already be there, as well as the ability to export files and conversations. Note that the Microsoft 365 services in GCC High data center and the data center operated by 21Vianet in China do not support Viva Engage, so the Viva Engage backup service in such data centers is not supported as well.

• If you have Microsoft 365-connected Viva Engage communities protected under Microsoft 365 Groups service, once the Viva Engage service is enabled, the connected groups will be removed from Microsoft 365 Groups service and can only be protected in Viva Engage even if you disable the Viva Engage service again. Cloud Backup job will start a new backup cycle for these Viva Engage communities, but their former backup data as Microsoft Groups will not be deleted until the data retention period expires.

#Power BI

• Power BI service can only protect the Power BI content in the new workspace experience. (The personal workspace is the classic workspace, which is not supported.)

• To use Cloud Backup for Microsoft 365 to protect the Power BI data, you must configure an app profile for the Microsoft Delegated app with the Power BI option selected or a custom Azure app with delegated permissions. For the list of the required permissions added to the Delegated app for Power BI, refer to App Profile Authentication. If you have been using a scan profile with service account authentication for Power Platform object types, the Auto discovery scan jobs and the Cloud Backup jobs can continue using the service account authentication.

• If you use service account authentication or the Delegated app to protect the Power BI data, the service account or the authentication user of the Delegated app must have a Power BI Pro license or a Premium Per User (PPU) license, and have the Fabric Administrator role (the former Power BI admin role).

• Before you enable the Power BI service, ensure the Download reports feature in the tenant settings has been enabled. This feature was enabled by default. In addition, the Cloud Backup Power BI service now can only protect the .pbix Power BI files that can be downloaded. For the limitations on downloading a report from Power BI, refer to Limitations when downloading a report .pbix file. The exported .pbix file includes both the report you're downloading and the dataset (the data on which the report is based), the same as the “A copy of the report and data” download mode in Power BI. If a Power BI report is created using data from Dataverse, neither the report nor the data in Dataverse will be protected.

• If you use the service account authentication to protect Power BI data or use the Delegated app to scan Power BI workspaces in AOS, the Auto Discovery scan job will automatically add the service account or the authentication user of the Delegated app as the workspace admin.

• Due to the API limitation, the backup job of Power BI can back up at most 200 workspaces per hour.

• Power BI service can now protect Power BI reports larger than 1 GB in the small semantic model storage format.

#Power Automate

• Power Automate service can only protect the cloud flows.

• To use Cloud Backup for Microsoft 365 to protect the Power Automate flow data, you must configure a Microsoft Delegated app or a custom Azure app with delegated permissions. For the list of the required permissions added to the Delegated app for Power Automate, refer to the Required Permissions of Microsoft Delegated App. If you have been using a scan profile with service account authentication for Power Platform object types, the Auto discovery scan jobs and the Cloud Backup jobs can continue using the service account authentication.

• If you use the Delegated app to protect the Power Automate data, the authentication user of the Delegated app must be the Global Administrator and the Environment Admin/System Administrator. If you use service account authentication to protect the Power Automate data, the service account must be the Global Administrator.

• The backup job will automatically add the service account or the authentication user of the Delegated app (the user who consents the app permissions) as the flow owner. Due to the Microsoft native logic, after the authentication user is added as the flow owner, the corresponding flows will be listed under the My flows > Shared with me tab for the existing flow owners.

#Power Apps

• Power Apps service can only protect standard Canvas apps which have been published and the component libraries. Note that the Restore action is unsupported and the backup data can only be exported. For a full support list, refer to Power Apps Data Types.

• To use Cloud Backup for Microsoft 365 to protect the Power Apps data, you must configure an app profile for the Microsoft Delegated app with the Power Apps option selected or a custom Azure app with delegated permissions. For the list of the required permissions added to the Delegated app for Power Apps, refer to the Required Permissions of Microsoft Delegated App. If you have been using a scan profile with service account authentication for Power Platform object types, the Auto discovery scan jobs and the Cloud Backup jobs can continue using the service account authentication.

• If you use service account authentication or the Delegated app to protect the Power Apps data, the service account or the authentication user of the Delegated app must be the Global Administrator and the Environment Admin/System Administrator, and have the Power Apps for Microsoft 365 license to proceed.

• The backup job will automatically add the service account or the authentication user of the Delegated app as the app’s co-owner and flow owner (if the app has an associated flow).

For more information on the supported and unsupported data types of Microsoft 365 Backup, refer to:

• SharePoint Sites Data Types

• Modern Team Site Data Types

• Project Online Data Types

• Exchange Online Data Types

• Public Folders Data Types

• Microsoft 365 Groups Data Types

• Teams Data Types

• Teams Chat Data Types

• Viva Engage Data Types

• OneDrive Data Types

• Document-Related Data Types

• Power BI Data Types

• Power Automate Data Types

• Power Apps Data Types

#Backup Schedule

The backup service will perform scheduled backups automatically and compress and encrypt backup data by default. The schedule of an object type starts with the first backup job. Note that the first backup job of the Distribution MSP’s customers will start in 24 hours after the backup wizard is set up.

For new customers, AvePoint now adjusted the backup frequency to once a day by default. Your second scheduled backup job on the next day will run ten hours after the start time of the first backup job, to ensure your backups all run at night for the best throughput. The subsequent jobs inherit the schedule automatically. In the meantime, you still have the option to adjust the backup frequency and the start time for the backup jobs.

Backup jobs can also be run manually if some items encounter errors during the last backup job. For detailed instructions on manually running backup jobs, refer to Monitor and Manage Your Backup.

#Storage Location

You can choose to store the backup data in the default storage location provided by AvePoint or your custom storage location. If you are currently using the default storage location and you want to use your own storage afterward, you can contact AvePoint support to update your subscription and change the default storage to your own storage.

Currently, the following storage types are supported for AvePoint default storage:

• Microsoft Azure Blob Storage
• Amazon S3
• Google Cloud Storage

The following storage types are supported for BYOS (bring your own storage):

• Azure Blob Storage
• Amazon S3
• Amazon S3-Compatible Storage
• FTP
• SFTP
• Dropbox
• IBM Storage Protect-S3
• IBM Cloud Object Storage
• Google Cloud Storage

If you choose to use AvePoint default storage, you can choose the storage type of your AvePoint default storage location from the following:

• Google Cloud Storage

  NOTE

  This storage type is not supported for customers that have Multi-Geo enabled and is only available in the Google Cloud Platform (GCP) data centers listed below:

  • GCP for Australia Southeast (Sydney)

  • GCP for West Europe (Eemshaven, Netherlands)

  • GCP for Japan (Tokyo)

  • GCP for East US (Moncks Corner)

  • GCP for South Korea (Seoul)

• Microsoft Azure Blob Storage

  If you choose to use Microsoft Azure Blob Storage as the default storage type, Cloud Backup for Microsoft 365 will store your data in the data center you signed up for in AvePoint Online Services. For available data centers, refer to Microsoft Azure Cloud Platform

  NOTE

  In October 2025 release, AvePoint Cloud Backup for Microsoft 365 supports United Arab Emirates (Dubai) as a new data center. In December 2025 release, Qatar Central (Doha) is also supported as a new data center.

  If you signed up to AvePoint Online Services with the data center Australia Southeast (Victoria), and you have purchased a subscription to use AvePoint Azure storage to store backup data, the default storage region is Australia Southeast (Victoria), and the other optional storage region is New Zealand North (Auckland). You can choose from the two options in the wizard when you sign into the Cloud Backup for Microsoft 365 interface for the first time.

• Amazon S3 storage

  NOTE

  AvePoint Amazon S3 storage is not available for the US Gov data center or data center operated by 21Vianet.

  If you choose to use Amazon S3 storage as the default storage type, refer to the following data center mappings between the data center you signed up to AOS with and the data center of the Amazon S3 storage.

  Data Center You Signed Up for AOS (Home Region)	Amazon S3 Storage Data Center (Storage Region)
  East US (Virginia)	US East (N. Virginia)
  North Europe (Ireland)	Europe (Ireland)
  Southeast Asia (Singapore)	Asia Pacific (Singapore)
  Australia Southeast (Victoria)	Asia Pacific (Sydney)
  Japan West (Osaka)	Asia Pacific (Tokyo)
  UK South (London)	Europe (London)
  Canada Central (Toronto)	Canada (Central)
  Germany West Central (Frankfurt)	Europe (Frankfurt)
  Korea Central (Seoul)	Asia Pacific (Seoul)
  France Central (Paris)	Europe (Paris)
  Switzerland North (Zurich)	Europe (Zurich)
  South Africa North (Johannesburg)	Africa (Cape Town)
  United Arab Emirates (Dubai)	Middle East (UAE)
  West Europe (Netherlands)	Not Supported
  Qatar Central (Doha)	Not Supported

For data redundancy, note the following:

• For Microsoft Azure Blob Storage, Locally redundant storage (LRS) is the default option to replicate your data.

• For Amazon S3 storage, objects will be redundantly stored on multiple devices across a minimum of three Availability Zones in an AWS Region.

• For Google Cloud Storage, data is stored across available zones within a single region.

If you want to use your own storage, you can configure the storage of one of the following storage types: Amazon S3, Amazon S3-Compatible, Dropbox, FTP, Microsoft Azure Blob Storage, SFTP, IBM Storage Protect – S3, IBM Cloud Object Storage, and Google Cloud Storage.

If you have purchased a subscription for BYOS (Bring your own storage) but are currently using AvePoint default storage for your backup data, your backup jobs will fail and we will send you an email notification every 7 days to remind you to update your BYOS storage configuration.

If you are using your own Azure storage (BYOS), note the following:

• If you are using your own Azure storage, Amazon S3 storage, or Amazon S3-Compatible Storage (BYOS) with immutability policies applied, your backup data cannot be deleted and all data deletion operations including unprotected data removal, data retention, manual deletion, and Data Subject Access Requests (DSARs) will be blocked. Data governed by these policies will remain immutable and cannot be modified or removed unless the policies are modified. However, the index referencing it will be destroyed, making the data unrecoverable.

• After the December 2023 release, Cloud Backup will write your new backup data to the cold tier by default to reduce storage costs. The supported Azure account kinds are StorageV2 and BlobStorage of Standard performance type. For existing customers, your former backup data are still stored in the cool tier. This intelligent tiering also extends to additional BYOS storages appended to the system.

  To use your Azure blob storage in the most cost-effective manner, you can store the backup data in the archive tier. For new customers after the December 2023 release, AvePoint will set archives to old backup cycles if the new backup cycle starts more than 180 days by default. If you are an existing customer with the archive settings configured before, you will continue with your current setup.

  For details about blob access tiers and how to change access tiers, refer to the Microsoft article: Azure Blob storage: hot, cool, and archive access tiers.

• If you are facing the upper limit on your Azure storage account, you can append a new Microsoft Azure Blob storage account. The maximum storage account capacity for a standard storage account is 5 PiB. You can contact Microsoft Azure support to request an increase. Currently, you can only append one additional storage account, and this is only available for BYOS customers on Azure.

• The backup data will be purged from the storage after the data reaches the retention period. If you use the default storage location, you can buy a service subscription with a retention period of multiple years (between 1 and 99) or unlimited years.

• When you perform a restore job, you can choose to allow the restore job to automatically rehydrate data from the archive tier, or they must manually change the access tier of the backup data in storage.

  The restore job will first rehydrate the data sets in the archive tier, and this restore job may take longer than previously. The restore job also supports restoring the archive tier backup data to your own storage. If you are using default AvePoint storage, the restore job will automatically rehydrate data.

• The export job also supports automatically rehydrating backup data in the archive tier if you are using AvePoint Azure storage. This feature has not been supported yet for customers using BYOS.

#Retention

If you use your own storage device or AvePoint default storage, and have purchased an unlimited data retention agreement, you can customize the data retention period for each service type. Note that the Teams Chat service does not support the retention policy and all backup data of Teams Chat will be retained until the subscription expires. To enable the day unit retention policy, contact AvePoint support for assistance.

Before any data deletion, AvePoint Cloud Backup will send a notification email informing you of the service data which will be deleted. You will still have time to either extend your retention period or export your data (a paid service).

Other than Power Apps and Power Automate, you can choose to customize the retention settings at container level. You can now configure a retention period that is less than 1 year (from 30 days to 365 days) for services and containers.

If you move to Cloud Backup from Classic DocAve Backup and your backup data generated in Cloud Backup has reached the end of the retention period you configured, your legacy backup data generated by Classic DocAve Backup will be deleted as well.

#Report Center

By monitoring the subscription consumptions and jobs operations, your application administrator can have an overall understanding of the resource usage, review and analyze the job progress and details, predict the service usage trends, and get alerted for the unusual activities.

For details, you can refer to the following:

• Monitor Subscription Consumption

• View Storage Consumption Report

• Use the Job Analytics Report

• Use the Unusual Activities Analysis Report

• View the End-User Restore Report

• View the Coverage Report

#Use Public APIs

You can now use the Cloud Backup for Microsoft 365 Public APIs to get the audit records, subscription consumption, job information, and basic information of unusual activities detected by Cloud Backup for Microsoft 365. For details, refer to Use Public APIs.