Docs

Backup overview

How Tenvara backs up devices, Macs, Microsoft 365, Entra ID and Google Workspace, how backups are protected and proven, how the Backup area and its sidebar are laid out, and how to read the overview page.

Tenvara backs up:

  • Devices, through the agent you already install: whole volumes as images, virtual machines on Hyper-V hosts and Proxmox VE nodes, chosen folders file by file, and a whole Mac from an APFS snapshot. On a Linux Docker host you can also back up Compose projects with a dump of their databases: see Updating, backing up and managing containers.
  • Microsoft 365, straight from Microsoft for each customer tenant: mailboxes, OneDrive, calendars, contacts, SharePoint sites and Teams, plus the tenant's Entra ID directory.
  • Google Workspace, through a service account you set up: every user's Gmail, Drive, Calendar and Contacts, and shared drives.

Everything lands in the same encrypted, deduplicated storage, is scheduled and kept the same way, and is found and restored the same way: one search across every backup, a browser with a time slider, and one restore sheet. Backups of any size carry on after a reboot, a restart or an update of Tenvara instead of starting again. On top of that, backups can be locked against deletion, copied to a second location, tested on a schedule, started as machines, and restored by your customers themselves from the portal.

The Backup overview with protected devices, Microsoft 365, success rate and storage
The Backup overview with protected devices, Microsoft 365, success rate and storage

How it works

Devices

When you protect a device, the agent downloads a small backup helper onto it and keeps it running and up to date. There is nothing to install by hand, and the helper only goes onto devices you protect.

  • The helper reads the data on the device and sends it to your backup storage over HTTPS. It encrypts the data before it leaves, so the backup server never sees your files in plain text during a backup.
  • Each customer has one repository for its devices. Identical data across that customer's machines is stored once, so backing up ten similar laptops costs little more than one.
  • Only changed data is sent after the first backup.
  • Restores run on the device itself, from the same repository.

Microsoft 365

Microsoft 365 backup reads each connected tenant through Microsoft Graph, using one app registration you set up once and each customer's admin consent. Each run fetches only what changed since the last one, so frequent runs stay small.

Storage and encryption

Backups are stored in one repository per customer and source, in storage locations: folders on the backup server or S3-compatible buckets. A location can be locked with S3 Object Lock so nothing can be deleted before its time, and every repository can be copied to a second location. Everything is encrypted with a master key that Tenvara creates on first start. See Setting up backup and Storage locations and immutable backups.

Proving backups work

Tenvara reads every repository's stored data back on a schedule and repairs anything damaged from the second copy or the source (see Repository health, healing and verification), restores sampled files from every repository and checks them, starts each machine's newest image backup on a sandbox host (a Proxmox VE node or Hyper-V host you manage) to prove it boots, and scans every restore for malware before it is written back. The results go in a PDF report you can give customers and insurers. See Test restores, boot checks and malware scans.

Warning: If the master key is lost, no backup can ever be restored. Keep a copy of it away from the backup server: download a recovery copy from the Status tab in backup settings. See A recovery copy of the encryption key.

The Backup sidebar

Open Backup from the rail. The sidebar has:

Item What it shows
Overview The page described below
Devices Every device with the agent and whether it is backed up. The list's views are Protected, Backup failing, Backup overdue, Paused, Not backed up and Sandbox hosts
Microsoft 365 Each customer's tenant and what is protected in it
First backups The queue of new tenants waiting for their first full backup. It shows while the queue has anyone in it. See The first backups queue
Google Workspace Each customer's connected Google Workspace domain
Coverage Every protected Microsoft 365 and Google Workspace user, mailbox, site and team against each workload
Jobs Every backup, restore, download, directory sync and maintenance run. The list's views are Running now, Failed and errors and Restores and downloads
Restore One search across every backup, with a Deleted items only switch. See Restoring
Protection Repositories, Test restores, Recycle bin, Pinned restore points and Approvals
Recovery Bootable machines, Boot checks, Standby machines and Bare metal
Archiving eDiscovery, Legal holds and Email archiving
Customer self-service Self-service restores, with Portal activity as a tab on the page
Backup settings Opens Settings > Backup: storage locations, protection, restores, reports, alerts, defaults, recovery, the Microsoft 365 app registration, self-service and status

Views are in each list's Views picker rather than the sidebar, so the sidebar stays short.

Reading the overview

The top row sums up backup across every customer:

  • Protected devices: how many devices are protected, with how many are failing, overdue or paused underneath, and how many more have protection on but nothing selected to back up. Sandbox hosts that are not backed up are counted on their own.
  • Microsoft 365: how many items are protected, split into people, sites, and groups and teams. Accounts with no mailbox and no OneDrive have nothing to back up, so they are not counted as people.
  • Success, last 24 hours: the share of runs that succeeded, with the number of runs and failures, and the figure for the last seven days. A run interrupted by a restart or an update is not a failure and is not counted here.
  • Storage used: how much space backups take, and underneath how much data they protect. The difference is what deduplication and compression save.

Below that:

  • Needs attention lists failed and overdue backups, protected devices with nothing selected, new devices left unprotected, helpers that will not start and tenants that refuse sign-in, most serious first, each with the reason in plain words. Each has a button to act on it, such as See the log, Choose what to back up or Protect. A line above the list says how many of them are open alerts, which failed once and alert only if their next run fails too, and which are only overdue by their schedule; Open backup alerts opens Alerts filtered to backup. Items with an alert show an Alert link to it. A few skipped items and paused devices are not problems, so they are not listed here. See Skipped items.
  • Last 14 days gives every active customer with backups set up a strip of their daily results: red when a run or a Microsoft 365 part failed, amber for errors, missed backups and overdue days. The last column names the worst ("2 failed", "14 days overdue", "1 missed") and says All good only when nothing failed, was missed or was overdue. Hover a day for what happened.
  • Storage growth shows the customers whose backups grew most over 30 or 90 days, with what they store and send each day.
  • Recent jobs lists the newest jobs, and says why a queued one is waiting. All jobs opens the Jobs list.
  • Catching up appears after the backup service has been stopped for a while: how many overdue backups are done, which start next and why any is waiting. See Backups through restarts and updates.

Settings at the top right goes straight to backup settings, and Restore to the restore search.

Where else backup shows up

Backup is built into the rest of Tenvara rather than living only in its own area:

  • Customer page: the Backup tab lists that customer's devices and tenants with their protection, Pause backups and Restore, removed devices, skipped items, storage growth, recent jobs, its schedule and retention, restore approval rules, the customer's backup email and the confidential switch. The customer's overview has a short backup summary.
  • Device page: Back up now and Restore at the top, and a Backup section on the Overview tab with the protection switch, what is backed up, the schedule, recovery points and recent jobs. See Protecting devices.
  • Cloud user and contact: on a person in Cloud > Users and on a contact's Microsoft 365 card, a backup line with the parts protected and the last good backup, with Restore. The leaver adds a final backup and keeps their backups longer. See Microsoft 365 backup.
  • Tickets: More > Restore for this ticket opens the contact's mailbox and devices first, and the result goes on the ticket. See Restoring from anywhere and sharing.
  • Devices list: in Devices > All devices, a backup column, the Backup failing and Not backed up views, a Backup menu when you tick devices (protect, back up now, stop protecting, pause and resume), and Back up now in Cmd+K or Ctrl+K.
  • Alerts: failed and overdue backups raise alerts that your alert rules can turn into tickets. Each alert says what raised it and, where it can, offers to retry the backup from the alert. See Backup alerts and troubleshooting.
  • Home: a backup line with how many are protected, how many are failing, and success in the last 24 hours.
  • Customer portal: with self-service on, your customers' people search and restore their own mail, files and computer files from Backups, contacts with backup status see what is protected and how many devices are not set up for backup, and contacts who may see reports get the test restore report. See Self-service restores in the portal.

Backup and the Backup module

Backup is a module. A new install starts with the service desk, so switch Backup on in Settings > Modules first; see Modules. You can switch it off there too. While it is off, no scheduled backups, directory syncs or checks run. Queued jobs wait and start once it is on again, and running jobs finish. Anyone who could see backup sees "Backup is switched off" instead of the backup pages.

Who can see and change backup is set in Roles and permissions.

In this section

Was this page helpful?

Thanks for the feedback.