Veeam Backup for Microsoft 365 (comnam90/veeam-docs-vb365-dump)

Veeam Backup for Microsoft 365 docs

https://github.com/comnam90/veeam-docs-vb365-dump
Admin
Veeam Backup for Microsoft 365 is a backup and recovery solution that protects data in Microsoft 365...

Tokens:467,439
Snippets:4,052
Trust Score:7.3
Update:1 day ago
Show doc for...
Context Summary (auto-generated)
Raw
# Veeam Backup for Microsoft 365 (VB365) — PowerShell Reference

Veeam Backup for Microsoft 365 (VB365) is an enterprise backup solution that protects Microsoft 365 data — Exchange Online, SharePoint Online, OneDrive for Business, and Microsoft Teams — as well as on-premises Exchange and SharePoint deployments. Version 8.4 introduces updated authentication, backup application management, and enhanced object storage support. The product architecture consists of a VB365 Server, one or more Backup Proxy Servers (with optional Proxy Pools for load balancing), a PostgreSQL configuration database, a NATS messaging server, and Backup Repositories (JET-based local or cloud object storage on Azure Blob, Amazon S3, Wasabi, IBM Cloud, or S3-compatible targets). A REST API and Restore Portal (self-service portal) are deployed alongside the server, and all operations can be automated via the VB365 PowerShell module.

The PowerShell toolkit exposes every function available in the graphical console. A session is created with `Connect-VBOServer`, after which cmdlets cover the full lifecycle: registering Microsoft organizations, provisioning repositories, creating and scheduling backup and backup-copy jobs, exploring restore points, retrieving archived data from Glacier/Azure Archive tiers, exporting logs, and generating compliance reports. All cmdlets return strongly-typed output objects (e.g. `VBOJob`, `VBOOrganization`, `VBORestorePoint`) that can be piped or stored in variables for use in multi-step scripts.

---

## Connect-VBOServer — Establish a PowerShell session

Opens a connection to a local or remote VB365 server. All subsequent cmdlets in the session operate against this server. Only one server can be connected per session; call `Disconnect-VBOServer` to switch targets. Default port is 9191.

```powershell
# Connect to a remote server using explicit credentials
$creds = Get-Credential
Connect-VBOServer -Server "172.17.53.58" -Port 9191 -Credential $creds

# Connect to the local server using the current Windows account
Connect-VBOServer

# Verify connection by checking the installed version
Get-VBOVersion
# Output:
# ProductVersion
# --------------
# 8.4.0.1457
```

---

## Add-VBOOrganization — Register a Microsoft organization

Adds a Microsoft 365, on-premises, or hybrid organization to the VB365 infrastructure. Supports modern app-only authentication (certificate-based), modern authentication with legacy protocols, and basic authentication. Use `New-VBOOffice365ApplicationOnlyConnectionSettings` for app-only and `New-VBOOffice365ConnectionSettings` for credential-based modes.

```powershell
# --- Modern app-only: back up Exchange Online + SharePoint Online + Teams + Team Chats ---
$securepwd = Read-Host "Certificate password" -AsSecureString
$appSettings = New-VBOOffice365ApplicationOnlyConnectionSettings `
    -ApplicationCertificatePath "C:\certs\vb365.pfx" `
    -ApplicationCertificatePassword $securepwd `
    -ApplicationId "6c957a12-93fd-469a-86f6-1dc3cc81cf07" `
    -ConfigureApplication
# Browser prompt: https://microsoft.com/devicelogin with the displayed code
Add-VBOOrganization `
    -Office365ExchangeConnectionsSettings $appSettings `
    -Office365SharePointConnectionsSettings $appSettings `
    -EnableTeamsChats

# --- Modern auth with legacy protocols: back up Exchange Online + SharePoint Online ---
$credentials = Get-Credential
$connection = New-VBOOffice365ConnectionSettings `
    -Credential $credentials `
    -GrantRolesAndPermissions
Add-VBOOrganization `
    -Name "Contoso" `
    -Office365ExchangeConnectionsSettings $connection `
    -Office365SharePointConnectionsSettings $connection

# --- On-premises Exchange ---
$onpremCreds = Get-Credential
$onPremSettings = New-VBOOnPremConnectionSettings `
    -Credential $onpremCreds `
    -ServerName "Exchange.contoso.local"
Add-VBOOrganization -Name "Contoso On-Prem" -OnPremExchangeConnectionSettings $onPremSettings
```

---

## Set-VBOOrganization — Modify organization settings

Updates connection settings, enabled services, auxiliary backup accounts, backup application assignments, or description of an existing organization. Only supplied parameters are changed; omitted parameters remain unchanged.

```powershell
# Enable SharePoint Online backup for an existing organization
$credentials = Get-Credential
$connection = New-VBOOffice365ConnectionSettings -Credential $credentials -GrantRolesAndPermissions
$org = Get-VBOOrganization -Name "Contoso"
Set-VBOOrganization -Organization $org `
    -Office365ExchangeConnectionsSettings $connection `
    -Office365SharePointConnectionsSettings $connection `
    -EnableOffice365SharePoint

# Assign auxiliary backup accounts (needed for SharePoint / OneDrive)
$org        = Get-VBOOrganization -Name "Contoso"
$group      = Get-VBOOrganizationGroup -Organization $org -DisplayName "VBOWorkGroup"
$members    = Get-VBOOrganizationGroupMember -Group $group
$pwd        = ConvertTo-SecureString "P@ssw0rd!" -AsPlainText -Force
$account    = New-VBOBackupAccount -SecurityGroupMember $members[0] -Password $pwd
Set-VBOOrganization -Organization $org -BackupAccounts $account

# Rotate backup applications (certificate refresh)
$securepwd   = Read-Host "New cert password" -AsSecureString
$newApp      = New-VBOBackupApplication -Name "BackupApp-v2" -Organization $org `
                   -ApplicationCertificatePath "C:\certs\new.pfx" `
                   -ApplicationCertificatePassword $securepwd
Set-VBOOrganization -Organization $org -BackupApplications $newApp
```

---

## Add-VBOAmazonS3ObjectStorageRepository — Add Amazon S3 backup repository

Registers an Amazon S3 object storage repository (Standard, Standard-IA, Glacier Instant Retrieval, Glacier Flexible Retrieval, or Glacier Deep Archive). Use `EnableImmutability` together with `ImmutabilityPeriodDays` to enable WORM protection against ransomware. Note: in VB365 8+ prefer the newer `Add-VBOAmazonS3Repository` / `Add-VBOAmazonS3GlacierRepository` cmdlets; this cmdlet is deprecated but still functional.

```powershell
# --- Standard S3 repository ---
$account    = Get-VBOAmazonS3Account -Id "26e61916-0257-4a05-8f65-204628d2ed7a"
$connection = New-VBOAmazonS3ConnectionSettings -Account $account -RegionType Global
$bucket     = Get-VBOAmazonS3Bucket -AmazonS3ConnectionSettings $connection `
                  -RegionId "eu-north-1" -Name "vb365-primary"
$folder     = Get-VBOAmazonS3Folder -Bucket $bucket -Name "backups"
Add-VBOAmazonS3ObjectStorageRepository -Folder $folder -Name "S3-Primary" -SizeLimit 10240

# --- Glacier Instant Retrieval with 60-day immutability (for backup copies) ---
$bucket2    = Get-VBOAmazonS3Bucket -AmazonS3ConnectionSettings $connection `
                  -RegionId "eu-north-1" -Name "vb365-archive"
$folder2    = Get-VBOAmazonS3Folder -Bucket $bucket2 -Name "copies"
Add-VBOAmazonS3ObjectStorageRepository `
    -Folder $folder2 `
    -EnableLongTerm `
    -EnableGlacierInstantRetrieval `
    -EnableImmutability `
    -ImmutabilityPeriodDays 60 `
    -Name "S3-GlacierIR-Immutable"
```

---

## Add-VBOAzureBlobObjectStorageRepository — Add Azure Blob Storage repository

Registers an Azure Blob Hot/Cool or Archive access tier repository. Archive tier repositories (flag `-EnableLongTerm`) are used as backup-copy targets. Immutability (WORM) is supported on both tiers. Note: in VB365 8+ prefer `Add-VBOAzureBlobRepository` / `Add-VBOAzureArchiveRepository`; this cmdlet is deprecated but still functional.

```powershell
# --- Azure Blob Hot tier (primary backup repository) ---
$account    = Get-VBOAzureBlobAccount -Id "133dae61-cfce-4fe0-8f8d-cbe52bd5612a"
$connection = New-VBOAzureBlobConnectionSettings -Account $account -RegionType Global
$container  = Get-VBOAzureBlobContainer -ConnectionSettings $connection -Name "vb365-primary"
$folder     = Get-VBOAzureBlobFolder -Container $container -Name "backups"
Add-VBOAzureBlobObjectStorageRepository -Folder $folder -Name "Azure-Hot" -SizeLimit 20480

# --- Azure Blob Archive tier with 90-day immutability (backup copy target) ---
$container2 = Get-VBOAzureBlobContainer -ConnectionSettings $connection -Name "vb365-archive"
$folder2    = Get-VBOAzureBlobFolder -Container $container2 -Name "copies"
Add-VBOAzureBlobObjectStorageRepository `
    -Folder $folder2 `
    -EnableLongTerm `
    -EnableImmutability `
    -ImmutabilityPeriodDays 90 `
    -Name "Azure-Archive-Immutable"
```

---

## Add-VBOJob — Create a backup job

Creates a backup job to protect objects in a registered Microsoft organization. Jobs can target entire organizations (excluding items already covered by other jobs) or specific selected items. Accepts a `VBOJobSchedulePolicy` for automated scheduling.

```powershell
# --- Back up entire organization (Exchange + SharePoint + OneDrive + Teams) ---
$org        = Get-VBOOrganization -Name "Contoso"
$repository = Get-VBORepository -Name "S3-Primary"
Add-VBOJob `
    -Name "Contoso-FullOrg" `
    -Organization $org `
    -Repository $repository `
    -EntireOrganization `
    -Description "Full org backup" `
    -RunJob

# --- Back up specific mailboxes, excluding one user ---
$excludedUser = Get-VBOOrganizationUser -Organization $org -Name "john.doe@contoso.com"
$excludedItem = New-VBOBackupItem -Mailbox -User $excludedUser
$allMailboxes = New-VBOBackupItem -Organization $org -Mailbox
Add-VBOJob `
    -Name "Contoso-Mailboxes" `
    -Organization $org `
    -Repository $repository `
    -SelectedItems $allMailboxes `
    -ExcludedItems $excludedItem `
    -RunJob
# Output:
# Organization  Repository   Name                  IsEnabled  LastStatus  Description
# ------------  ----------   ----                  ---------  ----------  -----------
# Contoso       S3-Primary   Contoso-Mailboxes     True       Stopped
```

---

## New-VBOJobSchedulePolicy — Define a backup job schedule

Creates a schedule policy object to be applied to a backup job via `Add-VBOJob` or `Set-VBOJob`. Supports Daily (specific days/time) and Periodically (every N minutes/hours) schedule types, plus backup windows and automatic retry settings.

```powershell
# --- Daily backup at 11 PM on weekdays, with backup window and retry ---
$bwindow = New-VBOBackupWindowSettings `
    -FromDay Monday -FromHour 22 `
    -ToDay Friday  -ToHour 23 `
    -Enabled:$true

$schedule = New-VBOJobSchedulePolicy `
    -Type Daily `
    -DailyType Workdays `
    -DailyTime "23:00:00" `
    -BackupWindowSettings $bwindow `
    -RetryEnabled `
    -RetryNumber 3 `
    -RetryWaitInterval 10

$job = Get-VBOJob -Name "Contoso-FullOrg"
Set-VBOJob -Job $job -SchedulePolicy $schedule

# --- Periodical backup every 4 hours, no retry ---
$every4h = New-VBOJobSchedulePolicy `
    -Type Periodically `
    -PeriodicallyEvery Hours4 `
    -RetryEnabled:$false

$job2 = Get-VBOJob -Name "Contoso-Mailboxes"
Set-VBOJob -Job $job2 -SchedulePolicy $every4h
```

---

## Add-VBOCopyJob — Create a backup copy job

Creates a backup copy job that copies an existing backup job's data to a second (usually archival/offsite) object storage repository. Only one copy job per backup job is allowed. The source and target repositories must share the same proxy server and retention type.

```powershell
# --- Immediate copy to Azure Archive ---
$job        = Get-VBOJob -Name "Contoso-FullOrg"
$archiveRepo = Get-VBORepository -Name "Azure-Archive-Immutable"
Add-VBOCopyJob -Repository $archiveRepo -BackupJob $job

# --- Scheduled copy: daily at 10 AM with a backup window ---
$bwindow = New-VBOBackupWindowSettings `
    -FromDay Monday -FromHour 8 `
    -ToDay Sunday  -ToHour 17 `
    -Enabled:$true

$copySchedule = New-VBOCopyJobSchedulePolicy `
    -Type Daily `
    -DailyType Everyday `
    -DailyTime "10:00:00" `
    -BackupWindowSettings $bwindow

Add-VBOCopyJob `
    -Repository $archiveRepo `
    -BackupJob $job `
    -SchedulePolicy $copySchedule
```

---

## Get-VBOJob — Retrieve backup job information

Returns `VBOJob` objects for querying job status, settings, or passing to other cmdlets. Can filter by name (supports wildcards), GUID, or associated organization.

```powershell
# Get all jobs
Get-VBOJob

# Get a specific job by name
Get-VBOJob -Name "Contoso-FullOrg"

# Get all jobs whose names start with "Contoso"
Get-VBOJob -Name "Contoso*"

# Get all jobs for a specific organization
$org = Get-VBOOrganization -Name "Contoso"
Get-VBOJob -Organization $org

# Get a job by its GUID (from Get-VBOJobSession output)
Get-VBOJobSession
Get-VBOJob -Id "a19840ea-9cf5-413d-af29-57ecad85be9e"
```

---

## Get-VBORestorePoint — Retrieve restore points

Returns `VBORestorePoint` objects for a job, organization, or repository. Restore points are passed to Explorer restore-session cmdlets or to `Start-VBODataRetrieval` for archive retrieval.

```powershell
# All restore points in the system
Get-VBORestorePoint

# Latest restore point for a specific job
$job = Get-VBOJob -Name "Contoso-FullOrg"
Get-VBORestorePoint -Job $job -Latest

# All archive (Glacier / Azure Archive) copy restore points in a specific repo
$archiveRepo = Get-VBORepository -Name "Azure-Archive-Immutable" -LongTerm
Get-VBORestorePoint -Repository $archiveRepo -IsLongTermCopy

# Start an Exchange item restore session from the oldest restore point
$restorepoints = Get-VBORestorePoint -Job $job | Sort-Object BackupTime
Start-VBOExchangeItemRestoreSession -RestorePoint $restorepoints[0]
```

---

## Start-VBODataRetrieval — Retrieve data from archive storage

Creates and starts a retrieval job that decompresses backed-up data from Azure Blob Storage Archive or Amazon S3 Glacier (Flexible Retrieval / Deep Archive) tiers and makes it temporarily available for Veeam Explorer restore sessions. Retrieval policies control speed vs. cost trade-offs.

```powershell
# Retrieve mailbox data from Azure Blob Archive (high priority, available 5 days)
$repository   = Get-VBORepository -Name "Azure-Archive-Immutable"
$mailbox      = Get-VBOEntityData -Repository $repository -Type Mailbox -Name "jane.smith@contoso.com"
$restorepoint = Get-VBORestorePoint -Repository $repository -Latest

Start-VBODataRetrieval `
    -RestorePoint $restorepoint `
    -AvailabilityPeriodDays 5 `
    -AzureArchiveRetrievalPolicy HighPriority `
    -Name "Retrieve-Jane-Smith" `
    -Mailbox $mailbox `
    -EnableExpirationNotification `
    -ExpirationHoursThreshold 2

# Retrieve SharePoint sites from Amazon S3 Glacier Deep Archive (bulk/low-cost)
$s3repo     = Get-VBORepository -Name "S3-GlacierIR-Immutable" -LongTerm
$site       = Get-VBOEntityData -Repository $s3repo -Type Site -Name "https://contoso.sharepoint.com/sites/HR"
$rp         = Get-VBORestorePoint -Repository $s3repo -Latest
Start-VBODataRetrieval `
    -RestorePoint $rp `
    -AvailabilityPeriodDays 3 `
    -AmazonS3GlacierRetrievalPolicy Bulk `
    -Name "Retrieve-HR-Site" `
    -Site $site
```

---

## Export-VBOLog — Export server component logs

Exports log files from VB365 server components (e.g. the VBO service, proxy service, REST API) to a local folder. Useful for troubleshooting and support cases. For job-specific logs use `Export-VBOJobLog`.

```powershell
# Export all logs from a specific backup proxy server
$proxy = Get-VBOServerComponents -Name Proxy -Id "06b7354e-518f-4a10-b4c1-98f49d743012"
Export-VBOLog -ServerComponent $proxy -TargetPath "C:\Veeam\Logs" -All

# Export logs for a specific date range
$from = [datetime]"2025-08-01 00:00:00"
$to   = [datetime]"2025-08-31 23:59:59"
Export-VBOLog -ServerComponent $proxy -From $from -To $to -TargetPath "C:\Veeam\Logs"

# Export the last 7 days of logs from all server components
$allComponents = Get-VBOServerComponents
Export-VBOLog -ServerComponent $allComponents -DayPeriod 7 -TargetPath "C:\Veeam\Logs"
```

---

## Get-VBOStorageConsumptionReport — Generate storage consumption report

Generates a PDF or CSV report detailing backup repository storage usage over a specified period. Useful for capacity planning, chargeback reporting, and compliance audits.

```powershell
# CSV report for the current year in local timezone
$timezone = Get-TimeZone
Get-VBOStorageConsumptionReport `
    -StartTime "01/01/2025" `
    -EndTime   "12/31/2025" `
    -Path      "C:\Reports" `
    -Format    CSV `
    -Timezone  $timezone

# PDF report in UTC for the last quarter
Get-VBOStorageConsumptionReport `
    -StartTime "07/01/2025" `
    -EndTime   "09/30/2025" `
    -Path      "C:\Reports" `
    -Format    PDF
```

---

## Summary

Veeam Backup for Microsoft 365 PowerShell is primarily used in three operational patterns: **initial infrastructure deployment** (registering organizations, provisioning object storage repositories, creating backup and copy jobs with schedules), **day-to-day operations monitoring** (querying job status with `Get-VBOJob`, reviewing restore points with `Get-VBORestorePoint`, exporting logs with `Export-VBOLog`), and **data recovery workflows** (starting Veeam Explorer restore sessions directly from restore points, or staging data from cold archive tiers with `Start-VBODataRetrieval` before passing retrieved restore points to Explorer cmdlets). All three patterns combine pipeline-friendly cmdlets that accept and return strongly-typed objects, enabling compact, readable automation scripts.

Integration with broader enterprise tooling is straightforward: the PowerShell module can be called from CI/CD pipelines, scheduled Windows Task Scheduler jobs, Microsoft Azure Automation runbooks, or third-party ITSM platforms. Because every operation that the VB365 console performs is also available as a cmdlet, organizations routinely implement GitOps-style infrastructure-as-code for their backup configurations — storing organization registrations, repository definitions, and job schedules as version-controlled PowerShell scripts. The REST API (deployed alongside the server) offers an alternative HTTP/JSON integration path for non-Windows environments, and the self-service Restore Portal gives end-users the ability to perform granular restores without administrator involvement, all of which are configurable through the same PowerShell surface.