M365 SecureStore - Setup Organisation and Backup Jobs – vGRID New Zealand

Access the service through vGRID DPS Console (Veeam Service Provider Console):

Link: https://dpsconsole-akl.vgrid.nz
Username: username sent to you
Password: password sent to you

You will need to do these at the portal above (please refer to step-by-step guide below):

Register your Microsoft 365 organisation
Set up the necessary backup jobs

Register Microsoft 365 Organisation

Click the Configuration button (top right hand corner)
Select the Plugin Library branch (left hand side)
Click the Veeam Backup for Microsoft 365 Plugin option
Select the Organizations branch (left hand side)
Click the New button within the Organizations pane
Select the Protected Services you require, click Next

This will almost always be Exchange Online. Only enable SharePoint Online and Microsoft Teams if you have appropriate licenses, otherwise the registration will fail. Teams chat requires additional configuration and cost so is not typically selected.

Leave the Region as Default, click Next
Under Application Settings:
- Choose Register a new Azure AD application automatically
- Set Application name to vGRID-M365-Backup (or a different name you prefer)
- Tick Allow this application to enable export mode for SharePoint Web Parts (if you will be backing up SharePoint sites)
- Click Next

Next section authenticates the process so that vGRID M365 SecureStore platform can create the authentication application and connect the Organization.

Copy the code and click the link to open the device login page
You will need to authenticate with a Global Admin (GA) account from your M365 tenancy
Once authenticated you should see the Verification status change to a green tick with Verified
Once this is done, click Next
Review the summary screen, click Finish

Grant Global Reader role to the Entra application. To grant the Global Reader role to the Entra application, do the following:

Sign in to the Entra portal.
Go to Azure Active Directory > Roles and administrators.
In the Administrative roles list, find the Global Reader role and click on it.
In the Global Reader window, click Add assignments. The Add assignments wizard runs.
In the Select member(s) section, click the link.
In the Select a member window, select the Entra application in the list and click Select. The selected application appears in the Selected member(s) list.
Click Next and then Assign to finish the wizard.

[OPTIONAL] You may need to add 'Microsoft Graph - Channel Member Read' permission to the Entra application:

Log into https://entra.microsoft.com/ with a Global Administrator account.
Click on App registration.
Search for the vGRID-M365-Backup application and select it.
Select API permissions.
Select Microsoft Graph.
Type "ChannelMember.Read.All" into the filter and select the permission ChannelMember.Read.All
Click on the Add permission button, then highlight the new permission and click on Grant admin consent for...
This will change the status to green.

Set up the necessary backup jobs

Job creation is pretty straight forward and may be familiar to you if you have used the Veeam product before.

Exit the Configuration section above
Go to the Backup Jobs branch (left hand side)
Click Create Job action, select Backup Job
Set the job name to something meaningful, click Next
- We recommend you prefix the job name with your company name so we can easily associate your jobs if troubleshooting
- Set the description or leave it blank
The Organization you created in the previous section should be automatically selected, so click Next
Set up the Backup scope and Exclusions as required, click Next
- it is highly recommended not to have all products backed up in one job. Instead, create separate backup jobs for each component:
  - Exchange Mailbox
    In Processing Options, select only mailbox related objects (Mail, Archive, Group Mail, etc)
  - SharePoint/OneDrive
    In Processing Options, select only site/onedrive related objects (OneDrive, Site, Group Site, etc)
  - Teams
    In Processing Options, only select Chat if you have the required licence in your Microsoft tenancy.
  - Depending on your requirements and Microsoft tenancy environment, we also recommend that you:
    - Use entire organisation or create/use security group(s) in Backup Scope, instead of adding individual users or sites. This ensures new users are automatically included without having to edit the backup jobs.
    - Create/use security group(s) for use in Exclusions, instead of individual users or sites, to exclude any users/sites you do not wish to backup.
Review the Summary, click Finish (if required, tick the Start the job when I click finish option to start the initial backup)

A few points to note:

You can create multiple jobs and run them manually from the Backup Jobs section.
You will not be able to schedule the jobs but you can run them manually to get them underway. We will schedule them for you to run automatically once initial backup jobs have completed successfully.
It is strongly recommended that you run jobs individually and allow them to complete their initial backup as there will be a lot of data to copy down in the first backup and this takes time.
It is not unusual for jobs to take hours or days to complete initially depending on the volume of data to be backed up.

Expect some errors during initial backup runs:

It is not unusual for the jobs to complete with errors initially as the Microsoft API is easily overloaded. Microsoft API is not forgiving of latency and lag and will quite frequently terminate certain items during the initial backup. These are always successfully backed up on retry.
With the volume of data backed up on the initial backup, it may take a few attempts to get all the initial data backed up. Over many retries the data will be backed up and further backup jobs will be incremental which will be more likely to succeed.
We occasionally see some issues around SharePoint permissions . We can work with you to get these warnings resolved so the backup jobs complete successfully every time.

Related to

Related articles