#AvePoint Cloud Backup

AvePoint Cloud Backup supports backup for all Microsoft 365 instances, such as Exchange Online, OneDrive, SharePoint Online, Microsoft 365 Groups, Teams, Microsoft Teams Chat, Project Online, Public Folders, Viva Engage, Power BI, Power Automate, and Power Apps to protect your data. These object types are backed up and restored independently of one another.

*Note: To protect the service types under the Power Platform and AvePoint Cloud Backup Express, you need to purchase additional licenses.

#SharePoint Online, OneDrive, and Project Online

• The hidden lists in SharePoint sites (including SharePoint Online sites, Teams team sites, Group team sites, Viva Engage community sites, and Project Online sites) are now excluded from the backup scope for better performance. If you want to include the hidden lists in your backup, contact AvePoint support for assistance. For the hidden lists that you can include in the backup, refer to Hidden Lists.

• It is now possible to change the SharePoint domain name for your organization in Microsoft 365, as introduced in the Microsoft article: . This change affects only the SharePoint and OneDrive URLs. It doesn’t impact email addresses. After the domain name is changed and updated into Auto Discovery, Cloud Backup for Microsoft 365 will run a full backup for SharePoint Online sites and OneDrive objects with new URLs.

• AvePoint Cloud Backup service for OneDrive will protect the Documents library and protect the Site Assets library if the site feature Site NoteBook is activated.

  The service only protects content and permissions for OneDrive since OneDrive is the cloud service used to securely store, share, and access your files.

• Backup for OneDrive now uses Microsoft Graph API for improved performance. Graph API has been more focused on protecting OneDrive content, and it has some limitations, such as it cannot protect the file versions. The file version number cannot be kept either after being restored to the destination. The restored file will use version: 1.0. You can refer to OneDrive Data Types for additional details. If you require any additional assistance, contact AvePoint Support.

• As Microsoft API has a 2 GB size limit to download OneNote notebooks saved in OneDrive or SharePoint, backup jobs will skip the OneNote files that are larger than 2 GB. In addition, due to API limitations, Cloud Backup cannot protect the history versions of OneNote files.

• If there are security changes but no changes on the content in the sites, the scheduled incremental backup jobs will not back up the securities. Moving forward, the changes on the securities in the sites (including the SharePoint Online sites, OneDrive, and Microsoft 365 Groups/Teams team sites) that have not yet been backed up, in this case, will be included in an incremental backup once a week.

  If some items in a site encounter errors in a backup but there are no changes on the content in the site for the next backup, the scheduled incremental backup jobs will not back up these items with errors. Moving forward, they will be included in an incremental backup once a week.

• If you would like to filter the folders to protect for OneDrive service or Exchange Online service, or filter the folders or lists/libraries within the site collections of SharePoint Online service, Project Online services, Microsoft 365 Groups services, or Teams service, you can contact the AvePoint Support team for assistance. Note that if your subscription to Cloud Backup for Microsoft 365 is based on the protected data size, the total consumed data size in your subscription will not be affected by the filter policy. AvePoint will not exclude the size of the filtered items from the total consumed data size.

• The files in the SharePoint site and the mailbox items in Exchange Online that are applied with the labels created via AIP (Azure Information Protection) can be protected by AvePoint Cloud Backup, as well as the applied Label. The documents applied with the sensitivity labels of DKE () are also supported, but only the user who has permission can access them.

• By default, the Preservation Hold library is not protected by AvePoint Cloud Backup for Microsoft 365. An additional cost is required to enable the feature.

• AvePoint Online Services Auto discovery now supports including orphaned OneDrive in scan profiles of OneDrive, but the objects cannot be synchronized to Cloud Backup for Microsoft 365.

• AvePoint Cloud Backup for SharePoint Online also supports protecting Communication Sites. When restoring a deleted Communication Site to its original location, AvePoint Cloud Backup supports restoring the custom design of the Communication Site in the backup. If the Communication Site is registered through App Profile, the Communication Site can only be restored with the default design. Note that the comments in Communication Sites are not currently supported.

• As the locked site collections are inaccessible, the backup job will check the lock status and skip backing up the locked site collections, which will be recorded in the job report; For read-only site collections, only the full backup job that runs once every year will back them up. Since no changes can be made to read-only site collections, the incremental backup jobs will skip them.

• You can now use an app profile to scan the Project Online site collections. In this way, the service account does not require the Site Collection Administrator role. However, Project Online data cannot be protected in the app context (using app profile authentication). A service account with enough permissions is still required for the backup and restore for Project Online. For the required permissions of a service account, refer to Service Account Authentication. Note the following for the Project Online data types:

  • AvePoint Cloud Backup for Project Online service supports restoring Project Permission Mode features.

  • Project Online service cannot protect the Project for the web data and cannot fully support the data added through the Microsoft 365 subscription Project Online desktop client. For example, custom fields.

  • For additional details on the protected data types, refer to Project Online Data Types.

#Exchange Online and Public Folders

• You can now choose to protect the Recoverable Items folder in the user’s primary mailbox for the Exchange Online service. If you want to enable this feature, contact support for assistance. Note that an additional cost is required. Currently, we support the Deletions, Purges, Versions, and DiscoveryHolds subfolders in the Recoverable Items. For more information about Recoverable Items, refer to this Microsoft article: . On the backup data tree, you can find the data in the following directory: mailbox address/Recoverable Items folder (System). This folder cannot be a destination for an out of place restore, and the backup data of this folder being restored to its original mailbox will use the following name: Recovery Items folder (System) _ Restored. Note that due to the API limitation, this folder directory will always be displayed in English regardless of the preferred display language of Microsoft 365.

• The hidden folders in the mailboxes (including Exchange Online mailboxes, Group mailboxes, and Teams group mailboxes) will be excluded from the backup for better performance. If you want to include the hidden folders in your backup, contact AvePoint support for assistance.

• If you would like to filter the folders to protect for OneDrive service or Exchange Online service, or filter the folders or lists/libraries within the site collections of SharePoint Online service, Project Online services, Microsoft 365 Groups services, or Teams service, you can contact the AvePoint Support team for assistance. Note that if your subscription to Cloud Backup for Microsoft 365 is based on the protected data size, the total consumed data size in your subscription will not be affected by the filter policy. AvePoint will not exclude the size of the filtered items from the total consumed data size.

• The service for Public Folders only supports restoring content and permissions of Public Folders to the original location. Cloud Backup for Microsoft 365 now supports the backup of Public Folder metadata via app profile authentication. To protect Public Folder metadata, ensure your backup for Public Folder metadata is enabled and the Exchange Administrator role is assigned to the app in Microsoft Entra ID. Note that the impersonation accounts that you configured for Public Folders in AvePoint Online Services interface will be synchronized to Cloud Backup for Microsoft 365 after June 2023 release and the Cloud Backup in app context only supports using impersonation accounts for the backup and restore of Public Folders. If you are a new customer, you must navigate to the Settings > Backup page to configure impersonation accounts. For details, refer to Configure Settings.

• For subscriptions with Multi-Geo enabled, the public folders can only be protected in the Central AOS Location.

• Use Object ID instead of mailbox address as the unique identifier for Exchange Online mailboxes and Public Folders. This change has been made to both the Cloud Backup for Microsoft 365 service and the Standalone tool. Due to this change, the mailboxes that have been re-created with the same address will no longer be regarded as the same one. This might require a broader search to ensure you find all the backup data for restoring, exporting, or deleting; the mailbox being renamed can only be found by the new name with the former backup data associated, and its former name will be displayed in its row.

• The Exchange Online service does not support protecting the Search Folders.

#Microsoft 365 Groups and Teams

• The Teams service is now available for customers using Microsoft 365 operated by 21Vianet in China. Note that hosted content is unsupported and will be skipped in the backup.

• To protect Teams mailboxes, at least one owner/member in the team should have the Exchange Online product license.

• The hidden folders in the mailboxes (including Exchange Online mailboxes, Group mailboxes, and Teams group mailboxes) will be excluded from the backup for better performance. If you want to include the hidden folders in your backup, contact AvePoint support for assistance.

• AvePoint Cloud Backup for Microsoft 365 can now check the status of groups and teams in Microsoft 365 and provides the option to help you restore the soft-deleted groups and teams (within the 30-day retention period) from Microsoft 365 recycle bin.

• If you are using service account authentication for the backup of Teams’ shared/private channels, the service account must be the owner of the shared/private channel.

#Teams Chat

• The Teams Chat service can protect the 1:1 chats and the group chats in Teams.

• Before you enable the Teams Chat backup service, you must register a custom app profile for Microsoft 365 for Auto Discovery to scan the Microsoft 365 users and request access to the default Microsoft Graph API or Microsoft Graph Teams Export API. For details on the required permissions for custom apps, refer to App Profile Authentication. Note that starting May 18, 2023, the and the protected API approval process are no longer needed. You can call the protected APIs as long as the requirements for accessing without a user (https://learn.microsoft.com/en-us/graph/auth-v2-service) are met.

• Microsoft Teams Chat service in Cloud Backup for Microsoft 365 supports to use the default Microsoft Graph API or Microsoft Graph Teams Export API model B to retrieve Teams chat messages from Microsoft Teams Chat for backup. Note that the will charge the app creator $ 0.00075 per message and that the cost may be high if there are a large number of chat messages in your tenant. Since the Teams Export API model B requires payment for use, you must follow the steps described in to set up an active Azure subscription for your application for billing purposes. You can follow this to estimate the number of Teams chat messages that may be backed up.

*Note: The number of messages in the Microsoft 365 Admin Center is just for the specific duration you define when exporting the report, not the full total amount. Additionally, the Microsoft Export API only supports export at a user level, so if there is a group chat with multiple users, the same message will be exported multiple times if all these users are included in the scope, which means the number of messages which will be backed up by Cloud Backup has the potential to be higher than the number of messages in the Microsoft admin center report. For confirmation, you can check the job report after the job has finished for the backup chat messages count to compare with the bill from Microsoft. If necessary, you can also limit the user scope for the export. Here is an example: In the report in the Microsoft 365 admin center shows the last 180 days’ number of Teams chat messages are 1000. Then for the whole year, the number of messages will be approximately 2000. Because there is no deduplication logic for the Microsoft 365 export API, the same message will be exported multiple times if all these users are included in the scope. So let’s say that all are 1V1 chats, then the message number charge by export API will be doubled to approximately 4000 messages. If most of chats are group chats with multiple users, the cost will be even higher.

• For the default Microsoft Graph API, the backup of chats started by external users is not supported, but chats started by internal users that include external users can be protected. For the Teams Export API model B, only plain text can be protected.

• The group chat messages cannot be protected if the user has been removed from the group.

• Only the default Microsoft Graph API can be used to protect Teams Chat in GCC/GCCH environment.

• For customers using Microsoft 365 operated by 21Vianet in China, the Teams Chat backup service using the Microsoft Graph API is currently available in Cloud Backup for Microsoft 365. Due to API limitations, the backup of hosted content is not supported.

#Viva Engage

• To protect Viva Engage data, If you use the Viva Engage service, you need to have the Microsoft 365 app (All permissions) or Cloud Backup for Microsoft 365 app (All permissions), and the Viva Engage app. The authentication user of this Viva Engage app must have the Verified Admin role and the Yammer administrator role with the Viva Engage product license. Alternatively, you can have a custom Azure app with delegated permissions. For details on configuring a Viva Engage app, refer to . Viva Engage service currently supports in place restore only (restoring to the original location), meaning the Viva Engage community needs to already be there, as well as the ability to export files and conversations. Note that the Microsoft 365 services in GCC High data center and the data center operated by 21Vianet in China do not support Viva Engage, so the Viva Engage backup service in such data centers is not supported as well.

• If you have Microsoft 365-connected Viva Engage communities protected under Microsoft 365 Groups service, once the Viva Engage service is enabled, the connected groups will be removed from Microsoft 365 Groups service and can only be protected in Viva Engage even if you disable the Viva Engage service again. Cloud Backup job will start a new backup cycle for these Viva Engage communities, but their former backup data as Microsoft Groups will not be deleted until the data retention period expires.

#Power BI

• Power BI service can only protect the Power BI content in the new workspace experience. (The personal workspace is the classic workspace, which is not supported.)

• To use Cloud Backup for Microsoft 365 to protect the Power BI data, you must configure an app profile for the Microsoft Delegated app with the Power BI option selected or a custom Azure app with delegated permissions. For the list of the required permissions added to the Delegated app for Power BI, refer to App Profile Authentication. If you have been using a scan profile with service account authentication for Power Platform object types, the Auto discovery scan jobs and the Cloud Backup jobs can continue using the service account authentication.

• If you use service account authentication or the Delegated app to protect the Power BI data, the service account or the authentication user of the Delegated app must have a Power BI Pro license or a Premium Per User (PPU) license, and have the Fabric Administrator role (the former Power BI admin role).

• Before you enable the Power BI service, ensure the feature in the tenant settings has been enabled. This feature was enabled by default. In addition, the Cloud Backup Power BI service now can only protect the Power BI files that can be downloaded. Note that the backup data can only be exported and downloaded. For the limitations on downloading a report from Power BI, refer to . The exported .pbix file includes both the report you're downloading and the dataset (the data on which the report is based), the same as the “” download mode in Power BI. If a Power BI report is created using data from Dataverse, neither the report nor the data in Dataverse will be protected.

• If you use the service account authentication to protect Power BI data or use the Delegated app to scan Power BI workspaces in AOS, the Auto Discovery scan job will automatically add the service account or the authentication user of the Delegated app as the workspace admin.

• Due to the , the backup job of Power BI can back up at most 200 workspaces per hour.

• Power BI service can now protect Power BI reports larger than 1 GB in the small semantic model storage format.

#Power Automate

• Power Automate service can only protect the cloud flows.

• To use Cloud Backup for Microsoft 365 to protect the Power Automate flow data, you must configure a Microsoft Delegated app or a custom Azure app with delegated permissions. For the list of the required permissions added to the Delegated app for Power Automate, refer to the Required Permissions of Microsoft Delegated App. If you have been using a scan profile with service account authentication for Power Platform object types, the Auto discovery scan jobs and the Cloud Backup jobs can continue using the service account authentication.

• If you use the Delegated app to protect the Power Automate data, the authentication user of the Delegated app must be the Global Administrator and the Environment Admin/System Administrator. If you use service account authentication to protect the Power Automate data, the service account must be the Global Administrator.

• The backup job will automatically add the service account or the authentication user of the Delegated app (the user who consents the app permissions) as the flow owner. Due to the Microsoft native logic, after the authentication user is added as the flow owner, the corresponding flows will be listed under the My flows > Shared with me tab for the existing flow owners.

#Power Apps

• Power Apps service can only protect standard Canvas apps which have been published and the component libraries. Note that the Restore action is unsupported and the backup data can only be exported. For a full support list, refer to Power Apps Data Types.

• To use Cloud Backup for Microsoft 365 to protect the Power Apps data, you must configure an app profile for the Microsoft Delegated app with the Power Apps option selected or a custom Azure app with delegated permissions. For the list of the required permissions added to the Delegated app for Power Apps, refer to the Required Permissions of Microsoft Delegated App. If you have been using a scan profile with service account authentication for Power Platform object types, the Auto discovery scan jobs and the Cloud Backup jobs can continue using the service account authentication.

• If you use service account authentication or the Delegated app to protect the Power Apps data, the service account or the authentication user of the Delegated app must be the Global Administrator and the Environment Admin/System Administrator, and have the Power Apps for Microsoft 365 license to proceed.

• The backup job will automatically add the service account or the authentication user of the Delegated app as the app’s co-owner and flow owner (if the app has an associated flow).

For more information on the supported and unsupported data types of Microsoft 365 Backup, refer to:

• SharePoint Sites Data Types

• Modern Team Site Data Types

• Project Online Data Types

• Exchange Online Data Types

• Public Folders Data Types

• Microsoft 365 Groups Data Types

• Teams Data Types

• Teams Chat Data Types

• Viva Engage Data Types

• OneDrive Data Types

• Document-Related Data Types

• Power BI Data Types

• Power Automate Data Types

• Power Apps Data Types

#Backup Schedule

The backup service will perform scheduled backups automatically and compress and encrypt backup data by default. The schedule of an object type starts with the first backup job. Note that the first backup job of the Distribution MSP’s customers will start in 24 hours after the backup wizard is set up.

For new customers, AvePoint now adjusted the backup frequency to once a day by default. Your second scheduled backup job on the next day will run ten hours after the start time of the first backup job, to ensure your backups all run at night for the best throughput. The subsequent jobs inherit the schedule automatically. In the meantime, you still have the option to adjust the backup frequency and the start time for the backup jobs.

*Note: AvePoint cannot guarantee the completion of four backups per day, even if the backup frequency is set to four times daily. Various factors, such as data size, can impact job performance and are beyond our control. If a scheduled backup is due to start but the previous one is still in progress, the new job will be skipped.

Backup jobs can also be run manually if some items encounter errors during the last backup job. For detailed instructions on manually running backup jobs, refer to Monitor and Manage Your Backup.

#Storage Location

You can choose to store the backup data in the default storage location provided by AvePoint or your custom storage location. If you are currently using the default storage location and you want to use your own storage afterward, you can contact AvePoint support to update your subscription and change the default storage to your own storage.

Currently, the following storage types are supported for AvePoint default storage:

Microsoft Azure Blob Storage
Amazon S3
Google Cloud Storage

The following storage types are supported for BYOS (bring your own storage):

Microsoft Azure Blob Storage
Amazon S3
Amazon S3-Compatible Storage
FTP
SFTP
Dropbox
IBM Storage Protect-S3
IBM Cloud Object Storage
Google Cloud Storage

If you choose to use AvePoint default storage, you can choose the storage type of your AvePoint default storage location from the following:

• Google Cloud Storage

*Note: This storage type is not supported for customers with Multi-Geo enabled and is only available in the following Google Cloud Platform (GCP) data centers:

• Australia Southeast (Sydney)
• West Europe (Eemshaven, Netherlands)
• Japan (Tokyo)
• East US (Moncks Corner)
• South Korea (Seoul)

• Microsoft Azure Blob Storage

If you signed up to AvePoint Online Services with the data center North Europe (Ireland) or Australia Southeast (Victoria), and you have purchased a subscription to use AvePoint Azure storage to store backup data, Cloud Backup for Microsoft 365 will store your data in the data center you signed up for in AvePoint Online Services.

If you want to select a different storage region for backup data in Cloud Backup for Microsoft 365, follow these steps:

1. Sign up for AvePoint Online Services in the desired data center.

2. Activate your AvePoint Online Services account and log in to Cloud Backup for Microsoft 365, but do not save any settings.

3. Contact AvePoint support for further assistance.

The following storage regions will be available for selection when you sign into the Cloud Backup for Microsoft 365 interface for the first time:

Data Center You Signed Up for AOS	Available Storage Region for Cloud Backup for Microsoft 365
North Europe (Ireland)	North Europe (Ireland) Qatar Central (Doha)
Australia Southeast (Victoria)	Australia Southeast (Victoria) New Zealand North (Auckland)

• Amazon S3 storage

*Note: AvePoint Amazon S3 storage is not available for the US Gov data center or for data centers operated by 21Vianet. It is also temporarily unavailable for the United Arab Emirates (Dubai) data center.

If you choose to use Amazon S3 storage as the default storage type, refer to the following data center mappings between the data center you signed up to AOS with and the data center of the Amazon S3 storage.

Data Center You Signed Up for AOS(Home Region)	Amazon S3 Storage Data Center(Storage Region)
East US (Virginia)	US East (N. Virginia)
North Europe (Ireland)	Europe (Ireland)
Southeast Asia (Singapore)	Asia Pacific (Singapore)
Australia Southeast (Victoria)	Asia Pacific (Sydney)
Japan West (Osaka)	Asia Pacific (Tokyo)
UK South (London)	Europe (London)
Canada Central (Toronto)	Canada (Central)
Germany West Central (Frankfurt)	Europe (Frankfurt)
Korea Central (Seoul)	Asia Pacific (Seoul)
France Central (Paris)	Europe (Paris)
Switzerland North (Zurich)	Europe (Zurich)
West Europe (Netherlands)	Not Supported

For data redundancy, note the following:

• For Microsoft Azure Blob Storage, Locally redundant storage (LRS) is the default option to replicate your data.

• For Amazon S3 storage, objects will be redundantly stored on multiple devices across a minimum of three Availability Zones in an AWS Region.

If you want to use your own storage, you can configure the storage of one of the following storage types: Amazon S3, Amazon S3-Compatible, Dropbox, FTP, Microsoft Azure Blob Storage, SFTP, IBM Storage Protect – S3, IBM Cloud Object Storage, and Google Cloud Storage.

If you have purchased a subscription for BYOS (Bring your own storage) but are currently using AvePoint default storage for your backup data, your backup jobs will fail and we will send you an email notification every 7 days to remind you to update your BYOS storage configuration.

If you are using your own Azure storage (BYOS), note the following:

• Existing BYOS customers applying immutability policies to Azure blob storage, should note the following:

  • Backup job behavior: The first backup job executed after applying an immutability policy will fail. However, subsequent backup jobs will process your data within the defined backup scope.

  • Data deletion restriction: If immutability polices are active on your Azure blob storage, all data deletion operations, including unprotected data removal, data retention, manual deletion, and Data Subject Access Requests (DSARs) will be blocked. Data governed by these polices will remain immutable and cannot be altered or deleted unless the policies are modified.

• After the December 2023 release, Cloud Backup will write your new backup data to the cold tier by default to reduce storage costs. The supported Azure account kinds are StorageV2 and BlobStorage of Standard performance type. For existing customers, your former backup data are still stored in the cool tier. This intelligent tiering also extends to additional BYOS storages appended to the system.

• To use your Azure blob storage in the most cost-effective manner, you can store the backup data in the archive tier. For new customers after the December 2023 release, AvePoint will set archives to old backup cycles if the new backup cycle starts more than 180 days by default. If you are an existing customer with the archive settings configured before, you will continue with your current setup.

For details about blob access tiers and how to change access tiers, refer to the Microsoft article: .

• If you are facing the upper limit on your Azure storage account, you can append a new Microsoft Azure Blob storage account. The maximum storage account capacity for a standard storage account is 5 PiB. You can contact Microsoft Azure support to request an increase. Currently, you can only append one additional storage account, and this is only available for BYOS customers on Azure.

• The backup data will be purged from the storage after the data reaches the retention period. If you use the default storage location, you can buy a service subscription with a retention period of multiple years (between 1 and 99) or unlimited years.

• When you perform a restore job, you can choose to allow the restore job to automatically rehydrate data from the archive tier, or they must manually change the access tier of the backup data in storage.

  The restore job will first rehydrate the data sets in the archive tier, and this restore job may take longer than previously. The restore job also supports restoring the archive tier backup data to your own storage. If you are using default AvePoint storage, the restore job will automatically rehydrate data.

• The export job also supports automatically rehydrating backup data in the archive tier if you are using AvePoint Azure storage. This feature has not been supported yet for customers using BYOS.

#Retention

If you use your own storage device or AvePoint default storage, and have purchased an unlimited data retention agreement, you can customize the data retention period for each service type. Note that the Teams Chat service does not support the retention policy and all backup data of Teams Chat will be retained until the subscription expires. To enable the day unit retention policy, contact AvePoint support for assistance.

Before any data deletion, AvePoint Cloud Backup will send a notification email informing you of the service data which will be deleted. You will still have time to either extend your retention period or export your data (a paid service).

Other than Power Apps and Power Automate, you can choose to customize the retention settings at container level. You can now configure a retention period that is less than 1 year (from 30 days to 365 days) for services and containers.

If you move to Cloud Backup from Classic DocAve Backup and your backup data generated in Cloud Backup has reached the end of the retention period you configured, your legacy backup data generated by Classic DocAve Backup will be deleted as well.

#Report Center

By monitoring the subscription consumptions and jobs operations, your application administrator can have an overall understanding of the resource usage, review and analyze the job progress and details, predict the service usage trends, and get alerted for the unusual activities.

For details, you can refer to the following:

• Monitor Subscription Consumption

• View Storage Consumption Report

• Use the Job Analytics Report

• Use Unusual Activities Analysis Report

• View the End-User Restore Report

• View the Coverage Report

#Use Public APIs

You can now use the Cloud Backup for Microsoft 365 Public APIs to get the audit records, subscription consumption, job information, and basic information of unusual activities detected by Cloud Backup for Microsoft 365. For details, refer to Use Public APIs.