Microsoft 365¶

Backs up Exchange Online mailboxes, OneDrive, SharePoint sites, Teams channels and the Entra ID directory. Any fallbck-agent, Linux or Windows, can run these jobs as long as it has outbound HTTPS to login.microsoftonline.com and graph.microsoft.com.

1. Register the tenant¶

Under PBS Targets → Microsoft 365 Tenants (or inline in onboarding), add an Entra app registration with these read-only application permissions, and grant admin consent:

User.Read.All          Group.Read.All          Directory.Read.All
Policy.Read.All        Application.Read.All    Organization.Read.All
MailboxFolder.Read.All MailboxItem.Read.All    MailboxItem.Export.All
MailboxSettings.Read   Mail.Read               Calendars.Read
Contacts.Read          Files.Read.All          Sites.Read.All
ChannelMessage.Read.All Team.ReadBasic.All     Channel.ReadBasic.All

Authenticate with a client secret or a certificate. The secret or private key gets sealed on the server and handed to the agent per run with its backup ticket. Test gets a token from the server and reads /organization, so you know it works before the first run does.

2. Create a job¶

Pick a tenant and the workloads: mailboxes, OneDrive, SharePoint, Teams messages (plus the team's files) and the directory. Several jobs can share one tenant, which is handy for splitting big tenants up.

Give the tenant its own namespace

Snapshots add up fast: one per user, site and team, every run. Clone a target into a dedicated namespace in onboarding, and give that namespace its own prune job.

What lands on PBS¶

Each run writes one snapshot per unit, each in its own group. The prefix is the job's group, which defaults to m365-<tenant name> (override with backup_id):

Group	Archive	Contents
`host/<group>-user-<upn>`	`user.pxar`	`mailbox/`, `onedrive/`
`host/<group>-site-<host-path>`	`site.pxar`	`files/<library>/`
`host/<group>-team-<name>`	`team.pxar`	`messages/<channel>/<yyyy-mm>.json`, `hosted/`, `files/<library>/`
`host/<group>`	`entra.pxar`	directory objects as JSON, `RESTORE.md`, plus `fallbck-m365.json.blob`

A user who leaves the tenant keeps their history. One broken mailbox fails only that unit, not the run.

Incrementals¶

After the first run only changed items get fetched. The agent keeps a per-unit index (Graph delta links, sizes, change keys) under <data_dir>/m365-state/<job>/. On pxar v2 targets, unchanged items are reused from the previous snapshot without even asking Graph.

Changed mailbox items get exported to the spool first, so size it for your biggest mailbox on the first run. Files stream straight from Graph.

About mailbox items¶

Mailbox items come out of the Graph mailbox export API as Exchange's own format (.exoitem). It's opaque, but each folder has an index.json with subject, sender and date. The catch:

They can only go back into an Exchange Online mailbox (createImportSession + importUrl), and that needs MailboxItem.ImportExport.All, which the backup app deliberately doesn't have.
Microsoft documents these APIs as a migration tool, not for backup, so they might change the terms.

Files and Teams messages are stored as-is.

Not covered¶

Teams chats (it's a protected API)
online archive mailboxes and public folders (Graph can't reach them)
national clouds (the export API is global-only)