Microsoft 365 backup

Microsoft 365 backup protects each customer's mailboxes, OneDrive, calendars, contacts, SharePoint sites and Teams. Microsoft keeps the service running, but deleted and overwritten data is only recoverable from Microsoft for a limited time; Tenvara keeps your own copy for as long as your retention says.

Before you start, the Microsoft 365 app registration must be set up in your own Microsoft Entra ID, and each customer's administrator must consent. See Setting up backup.

What is backed up#

Item	Parts
User	Mail, OneDrive, Calendar, Contacts
Shared or room mailbox	Mail, calendar and contacts (they have no OneDrive)
SharePoint site	The site's files
Microsoft 365 group	The group's site
Team	Channel messages and the team's site

Each part has its own recovery points, so a failure in one (for example Teams) does not stop the others backing up. Planner plans and the tenant's Entra ID directory are backed up too: see Google Workspace and Entra ID backup.

An account with no mailbox and no OneDrive (a call queue, a resource account, an unlicensed admin) has nothing to back up. It shows Nothing to back up on its row and is left out of every count of people, so it never reads as someone who is not backed up.

Big OneDrives and SharePoint sites download several files at once, very large drives are backed up in parts, and a backup interrupted part-way carries on from where it stopped. See Resuming large and interrupted backups.

When Microsoft slows a backup down, the run keeps everything it read and says so, and the next run carries on from there. Microsoft's passing sign-in hiccups are retried rather than failing the part. A mail folder, calendar or OneDrive folder deleted or moved between two runs is a note on the part, not a failure, and each backed-up file keeps its real modified date.

Each file is copied at the length Microsoft really serves and, for OneDrive and SharePoint, checked against the hash Microsoft gives for it. A file counts as changed only when its version changes.

An email Microsoft cannot export in its original form ("MIME content conversion failed", often a meeting response) is kept as a copy rebuilt from Microsoft's message data, marked as rebuilt wherever you browse, search or export it. It counts as backed up, not skipped. See Searching and browsing backups.

The tenants list#

Open Backup > Microsoft 365.

Each row shows the tenant and its domain, its Connection (Connected, Waiting for consent or Sign-in refused), its Backup state, the Customer, how many People, Sites and Groups and teams are protected out of those found, and the last good backup.

One backup state per tenant#

The Backup column always says one thing, the same on the tenants list, the tenant page and the customer's Backup tab:

State	Meaning
Running	Its backup has really started, with how far it is ("3 of 8 parts, since 07:20")
Queued	Its backup is waiting, with why: its place in line when one tenant backs up at a time, the tenant it is waiting for, or memory on the backup server. Change the limit opens the setting
Pending	Not backed up yet. A new tenant says where its first backup is: "First backup: 3rd in the queue, starts about 14:20", or why it is held, such as "First backup: 2nd in the queue, waits for admin consent", linking to the first backups queue
Backed up, Errors, Failed, Overdue, Paused	The last result once nothing is running. A last run that did not simply back up is named underneath with a link to its job, for example "Last run completed with errors 15:49"

While a backup runs or waits, that is what you see, whatever the run before left.

Connecting a tenant#

1. Press Connect a tenant.
2. Leave Admin consent link chosen: a Microsoft 365 global administrator at the customer approves once.
3. Choose the Customer. A customer can have more than one tenant.
4. Under Features, leave Backup ticked. The other features are the rest of the Cloud area, and the dialog says how many permissions the consent asks for.
5. Read the line about the first backup: where it will join the queue and when it should start and finish.
6. Press Make the consent link and send it to the customer's global administrator.

The same connection is used by the rest of Tenvara's Microsoft 365 features, so the customer consents once. You can also connect tenants from the Cloud area, and backup picks them up.

After consent, Tenvara reads the tenant's directory (people, groups, sites and teams) and its first full backup takes its turn in the first backups queue, with an estimate of when it will finish. Whoever connected the tenant is told if it runs slow. A tenant is never backed up before its first directory read.

Note: A consent link works once, for seven days by default (Consent links work for on the Defaults tab of backup settings). If it expires, make a new one. One Microsoft tenant can only be connected once.

Note: A first full backup reads a lot of mail and files through your app registration, and Microsoft Defender may report it as unusual activity. The dialog says so before you connect.

The tenant page#

Click a tenant to open it.

The header has Back up now, Restore and Search, then the customer, the backup state, the domain, how it is Connected with, the last good backup, the next run and the size. Below it:

• Schedule and Keeps, with "(default)" when they follow the defaults.
• Directory checked: when the tenant was last read.
• New items: the protection rules for new users, sites and teams in words, for example "Licensed users only; no shared mailboxes".
• Protect new ones automatically: when on, new users, sites and teams are protected as soon as they appear, following the rules.
• Confidential: when on, only administrators can browse, search, download or restore what this tenant backs up. Everyone still sees whether backups ran.

The tabs People, Sites and Groups and teams list what was found, with how many are protected, and Entra ID holds the directory backup. Each row shows:

• Protected: the switch that turns backup on or off for that item.
• Backup: its state, or Nothing to back up.
• Parts: an icon for each part (mail, OneDrive, calendar, contacts). Green means the part is backed up, red that it failed, grey that it is not protected. Hover over one to see its state.
• Licence: the user's licence, or Unlicensed. Shared and room mailboxes are marked as such.
• Last good and Size.

Choosing what is protected#

• Turn an item's Protected switch on or off.
• Tick several rows and use the bar that appears to protect them or stop protecting them.
• Each row also has buttons to back up that one item now, keep its backups longer, and choose what its backups leave out.

Items you switch off stop being backed up and their alerts clear. Their existing recovery points are kept.

Tip: Leave Protect new ones automatically on. A new starter is then protected from their first day without anyone remembering to do it.

Rules for new users, sites and teams#

Open ... and choose Schedule, retention and sign-in. Under Protection rules for new items:

• Only licensed users: people without a Microsoft 365 licence wait for you. Shared mailboxes need no licence and are not affected.
• No shared mailboxes: shared, room and equipment mailboxes wait for you.
• Only members of a group: people in this group, directly or through groups inside it. Membership is read again at every directory check, so someone added to the group is protected at the next one.
• Leave out sites and teams: words anywhere in the name or address (archive), or a pattern with * and ? (*-old, sites/proj-*).

Preview what these rules protect shows what the rules would do with today's users, sites and teams, and why each one left out is left out.

Rules only decide for new items: what is protected stays protected, and you can still protect a left-out item by hand. When a directory check leaves new items unprotected, the activity says how many and why.

Leaving out folders and libraries#

To stop backing up a person's Junk Email or Deleted Items, or a site's scratch library, press Choose what the backups of ... leave out on the row.

• For a mailbox, pick Mail folders from those the backups found, or add Other folders by path from the top of the mailbox, such as Inbox/Newsletters. A folder's subfolders are left out with it.
• For a site or team, pick the document libraries to leave out.

What you leave out is left out from the next backup on; earlier recovery points keep what they hold. The row shows a "2 left out" badge with the list on hover, and so does the person's backup line in Cloud > Users.

Single emails and files can be left out too, from the skipped items list: Exclude on a skipped item adds it to these rules as one item, and the dialog lists it with who excluded it and why. See Skipped items.

Buttons and actions#

• Back up now: runs a backup of the tenant straight away. If a backup of the tenant is already running, the parts it does not hold are added to it and start at once, and Tenvara says how many were added. If that job is already finishing, a follow-on job is queued behind it.
• Restore: opens the lists of this customer's users, sites and teams to browse and restore. Search opens the restore search for this tenant.
• ... menu:
  • Find new users, sites and teams: reads the directory now instead of waiting.
  • Schedule, retention and sign-in: the tenant's name, Protect new users, sites and teams as they appear, and its own Schedule and Retention (turn on Set here).
  • Grant consent again: opens the consent page again.
  • Disconnect: stops backing up the tenant. Its backups are kept.

The directory is read again automatically about every 12 hours. Any skipped items of the tenant are listed in a Skipped items card under the list, with items you have accepted or excluded collapsed under Known skips (N).

How many tenants back up at once#

On the Defaults tab of Settings > Backup, Microsoft 365 backups at once has:

• Microsoft 365 tenants at once: how many tenants back up at the same time.
• OneDrives and sites at once per tenant: how many drives each of them backs up at once.
• First backups at once: the separate slots for first full backups. See The first backups queue.

Automatic, the default, sizes each from the backup service's memory, and the line under each setting says the most that memory safely allows. If you choose more than that, Tenvara warns before saving and keeps to what the memory allows until it is raised. A change applies without a restart: tenants that were waiting are let in at once when you raise the limit.

Coverage across every tenant#

Backup > Coverage shows every protected Microsoft 365 user, shared mailbox, site, group and team, and every protected Google Workspace user and shared drive, against each workload: Mail, Calendar, Contacts, Files, SharePoint, Teams, Planner and Entra ID. Rows are grouped by customer and tenant.

Each cell is the age of the last good backup ("8h", "3d"), coloured by state: green backed up, amber overdue or with warnings, red failed, blue frozen (not backed up since a good backup, for example a mailbox that lost its licence) and grey never. Filter with Failing, Overdue, Never and Frozen, pick one workload, or search by name or address. A name opens its tenant; a cell opens the restore browser at that person and part.

Backup on the person and the leaver#

The person's panel in Cloud > Users (see Microsoft 365) and the contact's Microsoft 365 card show a backup line: the parts protected and the last good backup ("Mail, OneDrive, Calendar, Contacts protected, last good 3 hours ago"), or Not protected with Protect. Back up now, Restore and Open in Backup are beside it.

When the tenant is backed up, a leaver gets two extra steps:

• Take a final backup and wait for it (on by default): turns backup on for the person if it was off, backs up every part, and holds back the steps that lose data (removing licences, deleting the account) until it has finished. If the final backup fails, those steps stay held.
• Keep their backups longer: a number of years, or empty for ever. See Schedules and retention.

The leaver form also warns, before licences come off or the account goes, when the person has no backup.

A person's last result#

When a person's mail, OneDrive, calendar or contacts failed, finished with errors or is overdue, their backup line shows Last result for that part: the reason in plain words with what to do ("Mailbox over its Microsoft quota. Free space or raise the quota."), Technical details with Microsoft's own text, See the log, which opens the job at that part, and Try again, which backs up just those parts now. It shows on the person in Cloud > Users, on the contact's Microsoft 365 card, and in a side panel when you click someone needing attention in the tenant's People list.

Reasons that fix themselves (Microsoft busy, asking the backup to slow down, a dropped connection) say they retry at the next run. Parts that fail twice in a row are listed in one alert per tenant: see Backup alerts and troubleshooting.

Backing up the failed parts again#

On a Microsoft 365 backup that failed or finished with errors, Back up the failed parts again on the job panel backs up just the parts that did not finish, as one new job. Back up the whole tenant again runs the whole tenant.

When Microsoft refuses the sign-in#

If Microsoft stops accepting the connection, for example because consent was withdrawn or a permission was removed, the tenant shows Sign-in refused and a red banner with Microsoft's message. A critical alert is raised for the tenant.

This is different from a restart. A backup cut short because Tenvara itself restarted or was updated is interrupted, not failed: it carries on in the same job and raises nothing. See Backups through restarts and updates.

To fix it:

1. Read the message. AADSTS65001 means the admin has not consented (or consent was removed).
2. Press Grant consent again and have the customer's global admin approve it.
3. The next accepted sign-in clears the alert and backups resume.

If only Teams is failing and everything else works, the app has probably not been approved for Microsoft's protected Teams API yet. See Setting up backup.

When a tenant moves customer#

If a Microsoft tenant is connected to a different customer later (for example after a merger), the tenant and its jobs move to the new customer. Earlier recovery points stay in the old customer's repository and can still be browsed and restored from the tenant. The next backup writes to the new customer's repository.