Overview
The diagram below illustrates the workflow for configuring the Microsoft 365 Backup Storage.
Prerequisites:
Ensure you have a Microsoft 365 global administrator account with a valid Microsoft 365 license. This account is used only to give consent for the required permissions. Later, the global admin role can be changed to a regular user role.
Review the permissions required. For more information, see Permissions.
Onboarding
To start onboarding, you must establish a connection between Druva and your Microsoft 365 tenant. The first step in this process is to register your Microsoft 365 tenant. The global admin credentials must be used during registration to obtain permission. Refer to the overview of the onboarding process below for a concise summary.
Step 1: Install Druva App for Microsoft 365 Backup Storage
Log in to the Druva console.
Click the global navigation icon (three horizontal lines) on the top nav.
Click Microsoft 365 under Data Protection.
Click Get Started for Microsoft 365 Backup Storage.
The Installation screen will appear.Click Install for the Microsoft 365 Backup Storage application.
On the confirmation screen, review the license agreement, then click Agree to proceed.
Select your Microsoft account and grant the requested permissions.
📝 Note
Based on your license, you may see two options under 'Select Backup Cloud.' Make sure you select the correct cloud option. Choose 'Microsoft 365 Backup Storage.'
Step 2: Register your Microsoft 365 Tenant
Once the application is installed, the configuration wizard will automatically launch to set up your data storage environment. The wizard guides you through four steps:
Connect to the Microsoft account: Establish a connection with the Microsoft Backup service, which may be part of Microsoft Azure or Microsoft 365, and activate the service for your account or organization.
Prerequisite Assignment: Configure your environment to integrate with Microsoft Backup by assigning necessary permissions and performing verifications.
📝NOTE: If the KMS service is disabled, the prerequisite assignment will fail.
Service application configuration: The service application is the Azure Backup component responsible for orchestrating backup and restore operations, managing data storage, and ensuring compliance with backup policies.
For more information, see the Service application configuration below.
Datastore Initialization: Initialize the Microsoft 365 Backup Storage APIs.
Service application configuration:
Once the Microsoft 365 Backup Storage application receives consent to execute within your consuming tenant, it can function as the Microsoft 365 Backup Storage Controller. The service application configuration involves the following four automated steps:
Register Application: Registering Druva’s service application, Microsoft 365 Backup Storage controller.
Check Service: Check if the Microsoft 365 Backup Service is enabled in the Consuming Tenant.
Activate Controller: Activate your application to be the Microsoft 365 Backup Storage Controller.
Enable Billing: Billing is enabled for the consuming tenant.
The following are the service application states:
The section below outlines the various states of the service application. Once the backup configuration has been completed, the status of the service application can be viewed on the overview page.
Active: The application is currently being used as a Microsoft 365 Backup Storage controller.
If there is no existing Microsoft 365 Backup Storage Controller, the Druva application is immediately activated with an "Active" status, and billing is enabled, proceeding to the next step.
Pending Active: A request has been made to activate the application, but the application has not yet been activated.
If another Microsoft 365 Backup Storage Controller exists, this step enforces a Grace Period. The Druva application will remain in a "pendingActive" state until the Microsoft-defined grace period ends, allowing you to deactivate and unregister.
Pending Inactive: A request for deactivation has been submitted. The read-write access to protection policies and restore will be retained until the grace period has elapsed.
Inactive: The application is currently not in use and is therefore designated as inactive.
Step 3: Configure Backup
Upon completing all steps in the wizard, the page will automatically refresh, presenting the overview page. During this stage, select the specific resources and add them to the protection policy. For more information on configuring the backup settings, refer to the Protect Your Exchange Online using M365 Backup Storage, Protect Your SharePoint Online using M365 Backup Storage and Protect Your OneDrive using M365 Backup Storage
After configuring backup for Microsoft applications, the overview page displays the number of configured accounts, mailboxes, and sites. It also shows the status of the Azure application and service application on the same page.
📝NOTE
If the state is set to “pendingInactive,” it indicates that another application has initiated the onboarding process and is attempting to register as the Microsoft 365 Backup Storage Controller for the consuming tenant.
The Consuming Tenant Backup Admin can cancel this pending change, but the Druva application will not automatically revert to the “Active” state.
You must reinstall the Druva application to restore its functionality as the “Active” Microsoft 365 Backup Storage Controller. If this reinstallation is not completed before the grace period expires, the Druva application's state will change to “Inactive.”
Offboarding
To offboard Druva App for Microsoft 365 Backup Storage, you must unregister the service application. Once unregistered, the service application will no longer be available to act as the Microsoft 365 Backup Storage controller.
To unregister the service application:
Navigate to the Manage Apps section on the overview page.
Click Unregister for the service application.
Confirm the action by clicking Unregister on the confirmation message.
Upon successful unregistration, you will be redirected to the Getting Started page, confirming that the application has been unregistered.
Backup Policies
Due to a Microsoft Backup Storage API limitation, you cannot modify the backup schedule and retention settings. All snapshots are retained for a period of one year, and the backup frequency is as follows:
For more details about the backup policy, see the Microsoft documentation.
Type | RPO for 0-14 days in the past | RPO for 15-365 days in the past |
Full OneDrive account and full SharePoint site restore | 10 minutes | One week |
Exchange Online | 10 minutes | 10 minutes |
📝 Note
Excluding accounts from the backup policy leads to suspending future backups for those excluded accounts. It is important to note that existing backups for those accounts will not be deleted.
Backup Policies Performance
When you add users to a protection policy, the process of backing up their OneDrive accounts, SharePoint sites, and Exchange mailboxes begins.
According to Microsoft the request to activate the policy is submitted, it generally takes up to 60 minutes to process, followed by another 60 minutes to create restore points. Initial backups take about 15 minutes per 1,000 units added to the policy.
For more details on performance expectations, refer to the Microsoft documentation.