===============
LIBRARY RULES
===============
From library maintainers:
- This is unofficial documentation - always verify against official Veeam Help Center

# Veeam Backup for Microsoft 365 Documentation

Veeam Backup for Microsoft 365 is an enterprise data protection solution designed to back up and restore Microsoft 365 cloud services including Exchange Online, SharePoint Online, OneDrive for Business, and Microsoft Teams. The product provides comprehensive protection against accidental deletion, security threats, and retention policy gaps in Microsoft 365 environments, ensuring organizations maintain full control over their critical business data.

The architecture consists of several core components: the Veeam Backup for Microsoft 365 server (which coordinates all operations), backup proxy servers (which handle data transfer operations), backup repositories (JET-based or object storage), and supporting infrastructure including NATS server for communication and PostgreSQL for configuration storage. The solution offers both a graphical console interface and a full-featured PowerShell module for automation, along with REST API access and a self-service Restore Portal for end users.

## PowerShell Module - Server Connection

The `Connect-VBOServer` cmdlet establishes a connection to a Veeam Backup for Microsoft 365 server, initiating a PowerShell session for managing backup operations.

```powershell
# Connect to local VBO server using current credentials
Connect-VBOServer

# Connect to remote VBO server using current credentials
Connect-VBOServer -Server "172.13.53.53"

# Connect to remote VBO server with specific credentials
$creds = Get-Credential
Connect-VBOServer -Server "172.17.53.58" -Credential $creds -Port 9191

# Disconnect from current server when done
Disconnect-VBOServer
```

## Adding Microsoft 365 Organizations

The `Add-VBOOrganization` cmdlet adds Microsoft 365 organizations to the backup infrastructure using modern app-only authentication with Microsoft Entra application certificates.

```powershell
# Add Microsoft 365 organization with modern app-only authentication
# Backs up Exchange Online, SharePoint Online, OneDrive, and Teams with chats
$securepassword = Read-Host "Enter certificate password" -AsSecureString

$appSettings = New-VBOOffice365ApplicationOnlyConnectionSettings `
    -ApplicationCertificatePath "C:\certificate\cert.pfx" `
    -ApplicationCertificatePassword $securepassword `
    -ApplicationId "6c957a12-93fd-469a-86f6-1dc3cc81cf07" `
    -ConfigureApplication

Add-VBOOrganization `
    -Office365ExchangeConnectionsSettings $appSettings `
    -Office365SharePointConnectionsSettings $appSettings `
    -EnableTeamsChats

# Follow browser authentication prompt to complete device login
# WARNING: To sign in, use a web browser to open https://microsoft.com/devicelogin
```

## Adding Backup Proxy Servers

The `Add-VBOProxy` cmdlet adds Windows or Linux-based backup proxy servers to distribute backup workloads and improve performance.

```powershell
# Add Windows-based backup proxy in domain environment
Add-VBOProxy -Hostname "172.70.53.53" -Port 9193 -UseDomainNetwork

# Add Windows-based backup proxy with specific credentials and throttling
$serverCredentials = Get-Credential
Add-VBOProxy -Hostname "172.70.53.53" `
    -WindowsCredential $serverCredentials `
    -Port 9193 `
    -EnableNetworkThrottling `
    -ThrottlingValue 10 `
    -ThrottlingUnit Mbps

# Add Linux-based backup proxy server
$linuxpwd = ConvertTo-SecureString -String "SecurePassword123" -AsPlainText -Force
$linuxcredentials = New-VBOLinuxCredential `
    -Account "Administrator" `
    -ElevateAccountToRoot:$true `
    -Password $linuxpwd

Add-VBOProxy -Hostname "linux-proxy01" -Port 9193 -LinuxCredential $linuxcredentials
```

## Creating Backup Repositories

The `Add-VBORepository` cmdlet creates JET-based or object storage repositories with configurable retention policies for storing backups.

```powershell
# Add JET-based backup repository with default 3-year retention
$proxy = Get-VBOProxy -Hostname "support.north.local"
Add-VBORepository -Proxy $proxy `
    -Name "External Data Storage" `
    -Path "C:\External Data Storage" `
    -Description "North Backup Repository" `
    -RetentionType SnapshotBased

# Add repository with 1-year retention, daily cleanup at 3 PM
$proxy = Get-VBOProxy -Id "d96f55a4-d15d-410b-b0f0-d51d17ccdab6"
Add-VBORepository -Proxy $proxy `
    -Name "Daily Backup Repository" `
    -Path "C:\External Data Storage" `
    -RetentionPeriod Year1 `
    -RetentionFrequencyType Daily `
    -DailyTime 15:00:00 `
    -DailyType Everyday `
    -RetentionType ItemLevel

# Add Azure Blob Storage object storage repository
$account = Get-VBOAzureBlobAccount -Id "133dae61-cfce-4fe0-8f8d-cbe52bd5612a"
$connection = New-VBOAzureBlobConnectionSettings -Account $account -RegionType Global
$container = Get-VBOAzureBlobContainer -ConnectionSettings $connection -Name "ContainerName"
$folder = Get-VBOAzureBlobFolder -Container $container -Name "FolderName"
$objectstorage = Add-VBOAzureBlobObjectStorageRepository -Folder $folder -Name "AzureBackups"

$proxy = Get-VBOProxy -Hostname "support.south.local"
Add-VBORepository -Proxy $proxy `
    -Path "C:\AzureStorage" `
    -Name "Azure Blob Storage" `
    -ObjectStorageRepository $objectstorage
```

## Creating Backup Jobs

The `Add-VBOJob` cmdlet creates backup jobs to protect Microsoft 365 organization data with flexible scope selection and scheduling options.

```powershell
# Create backup job for entire organization
$org = Get-VBOOrganization -Name "ABC Company"
$repository = Get-VBORepository -Name "ABC Backup Files"

Add-VBOJob -Name "ABC Full Backup" `
    -Organization $org `
    -Repository $repository `
    -Description "Complete Organization Backup" `
    -EntireOrganization `
    -RunJob

# Create backup job for selected items with exclusions
$org = Get-VBOOrganization -Name "ABC Company"
$repository = Get-VBORepository -Name "ABC Backup Files"

# Exclude specific user's mailbox
$excludedUser = Get-VBOOrganizationUser -Organization $org -Name "UserAlpha"
$excludedItem = New-VBOBackupItem -Mailbox -User $excludedUser

# Include all organization mailboxes
$item1 = New-VBOBackupItem -Organization $org -Mailbox

Add-VBOJob -Organization $org `
    -Repository $repository `
    -Name "ABC Mailbox Backup" `
    -SelectedItems $item1 `
    -ExcludedItems $excludedItem `
    -RunJob

# Output: Organization, Repository, Name, IsEnabled, LastStatus, Description
```

## Starting and Managing Backup Jobs

The `Start-VBOJob` cmdlet manually triggers backup jobs, while `Get-VBOJob` retrieves job configurations and `Enable-VBOJob`/`Disable-VBOJob` control job state.

```powershell
# Get all backup jobs
Get-VBOJob

# Get specific backup job by name
$job = Get-VBOJob -Name "Backup Daily"

# Start a backup job immediately
Start-VBOJob -Job $job

# Start a full backup run (forces complete backup)
$job = Get-VBOJob -Name "Full Backup"
Start-VBOJob -Job $job -Full:$true

# Start job asynchronously (returns immediately)
Start-VBOJob -Job $job -RunAsync

# Enable or disable a backup job
Enable-VBOJob -Job $job
Disable-VBOJob -Job $job

# Stop a running job
Stop-VBOJob -Job $job
```

## Creating Backup Copy Jobs

The `Add-VBOCopyJob` cmdlet creates backup copy jobs to replicate backups to secondary object storage repositories for long-term retention and disaster recovery.

```powershell
# Create basic backup copy job
$job = Get-VBOJob -Name "ABC Backup"
$repository = Get-VBORepository -Name "Azure Archive Storage"

Add-VBOCopyJob -Repository $repository -BackupJob $job

# Create backup copy job with daily schedule and backup window
$job = Get-VBOJob -Name "ABC Backup"
$repository = Get-VBORepository -Name "Azure Archive Storage"

# Define backup window (Monday 8 AM to Sunday 5 PM)
$bwindow = New-VBOBackupWindowSettings `
    -FromDay Monday -FromHour 8 `
    -ToDay Sunday -ToHour 17 `
    -Enabled:$true

# Create daily schedule at 10 AM with backup window
$daily = New-VBOCopyJobSchedulePolicy `
    -Type Daily `
    -DailyType Everyday `
    -DailyTime 10:00:00 `
    -BackupWindowSettings $bwindow

Add-VBOCopyJob -Repository $repository -BackupJob $job -SchedulePolicy $daily

# Output: Id, Name, Description, Repository, BackupJob, SchedulePolicy, IsEnabled, LastStatus
```

## Monitoring Job Sessions

The `Get-VBOJobSession` cmdlet retrieves backup and backup copy job session history with filtering by job type, status, and recency.

```powershell
# Get all job sessions
Get-VBOJobSession

# Get job sessions for backup jobs with Success status
Get-VBOJobSession -JobType Backup -Status Success

# Get the latest job session
Get-VBOJobSession -Last

# Get latest failed backup job session
Get-VBOJobSession -JobType Backup -Status Failed -Last

# Get sessions for a specific backup job
$job = Get-VBOJob -Name "ABC Backup"
Get-VBOJobSession -Job $job

# Get detailed statistics for latest session
$session = Get-VBOJobSession -Last
$session.Statistics

# Available statuses: Disconnected, Failed, NotConfigured, Queued,
# Running, Stopped, Success, Warning, Updating
```

## Working with Restore Points

The `Get-VBORestorePoint` cmdlet retrieves restore points for data recovery operations, supporting filtering by organization, repository, job, and restore point type.

```powershell
# Get all restore points
Get-VBORestorePoint

# Get restore points for specific organization
$org = Get-VBOOrganization -Name "ABC"
Get-VBORestorePoint -Organization $org

# Get restore points for specific backup job
$job = Get-VBOJob -Name "Backup: Sales Mailbox"
Get-VBORestorePoint -Job $job

# Get only the latest restore point
Get-VBORestorePoint -Latest

# Get restore points from backup copies
Get-VBORestorePoint -IsCopy

# Get restore points from long-term archive storage (Glacier/Azure Archive)
$archiverepo = Get-VBORepository -Name "Azure Blob Storage Archive" -LongTerm
Get-VBORestorePoint -Repository $archiverepo -IsLongTermCopy

# Start Exchange restore session from specific restore point
$job = Get-VBOJob -Name "Backup: Sales Mailbox"
$restorepoint = (Get-VBORestorePoint -Job $job | Sort -Property BackupTime)
Start-VBOExchangeItemRestoreSession -RestorePoint $restorepoint[0]
```

## Managing Organizations

The `Get-VBOOrganization` cmdlet retrieves Microsoft organizations configured in the backup infrastructure for use with backup jobs and restore operations.

```powershell
# Get all configured organizations
Get-VBOOrganization

# Get organization by exact name
Get-VBOOrganization -Name "Atlanta"

# Get organization by ID
Get-VBOOrganization -Id "47972f7d-05c4-43b5-95f7-60735ee56006"

# Get organizations using wildcard pattern
Get-VBOOrganization -Name "Columb*"

# Use organization in backup job creation
$org = Get-VBOOrganization -Name "ABC Company"
$repository = Get-VBORepository -Name "Default Repository"
Add-VBOJob -Organization $org -Repository $repository -Name "New Backup" -EntireOrganization
```

## License Management

The `Get-VBOLicense` cmdlet retrieves information about the installed product license including status, expiration, and usage statistics.

```powershell
# Get current license information
Get-VBOLicense

# Example output:
# Status                : Valid
# ExpirationDate        : 4/1/2026 (225 days left)
# Type                  : Subscription
# Package               : M365Suite
# LicensedTo            : Veeam Software GmbH
# ContactPerson         :
# TotalNumber           : 9999 (2 used)
# SupportId             : 12345678
# SupportExpirationDate :

# Install new license
Install-VBOLicense -Path "C:\Licenses\veeam_license.lic"
```

## REST API Configuration

The `Set-VBORestAPISettings` cmdlet configures the REST API service settings including SSL certificates, authentication tokens, and Swagger UI access for API documentation.

```powershell
# Enable REST API service with default settings
Set-VBORestAPISettings -EnableService

# Configure REST API with custom SSL certificate and token lifetime
$plainpassword = "CertificatePassword123"
$securepassword = $plainpassword | ConvertTo-SecureString -AsPlainText -Force

Set-VBORestAPISettings `
    -EnableService `
    -AuthTokenLifeTime 4800 `
    -HTTPSPort 4443 `
    -CertificateFilePath "C:\Certificates\api-cert.pfx" `
    -CertificatePassword $securepassword `
    -EnableSwaggerUI

# Get current REST API settings
Get-VBORestAPISettings
```

## Complete Backup Workflow Example

This example demonstrates a complete workflow for setting up backup protection for a Microsoft 365 organization from scratch.

```powershell
# 1. Connect to Veeam Backup for Microsoft 365 server
Connect-VBOServer -Server "vbo-server.domain.local"

# 2. Add Microsoft 365 organization with modern authentication
$certPassword = Read-Host "Enter certificate password" -AsSecureString
$appSettings = New-VBOOffice365ApplicationOnlyConnectionSettings `
    -ApplicationCertificatePath "C:\certs\m365-backup.pfx" `
    -ApplicationCertificatePassword $certPassword `
    -ApplicationId "your-app-id-guid" `
    -ConfigureApplication

Add-VBOOrganization `
    -Name "Contoso Organization" `
    -Office365ExchangeConnectionsSettings $appSettings `
    -Office365SharePointConnectionsSettings $appSettings `
    -EnableTeamsChats

# 3. Add backup proxy server
$proxyCreds = Get-Credential
Add-VBOProxy -Hostname "proxy01.domain.local" `
    -WindowsCredential $proxyCreds `
    -UseDomainNetwork

# 4. Create backup repository with 3-year retention
$proxy = Get-VBOProxy -Hostname "proxy01.domain.local"
Add-VBORepository -Proxy $proxy `
    -Name "Primary Backup Repository" `
    -Path "D:\VeeamBackups" `
    -RetentionPeriod Years3 `
    -RetentionFrequencyType Daily `
    -DailyTime 02:00:00 `
    -DailyType Everyday `
    -RetentionType SnapshotBased

# 5. Create and start backup job
$org = Get-VBOOrganization -Name "Contoso Organization"
$repo = Get-VBORepository -Name "Primary Backup Repository"

Add-VBOJob -Name "Contoso Full Backup" `
    -Organization $org `
    -Repository $repo `
    -EntireOrganization `
    -RunJob

# 6. Monitor job progress
$job = Get-VBOJob -Name "Contoso Full Backup"
Get-VBOJobSession -Job $job -Last

# 7. Disconnect when done
Disconnect-VBOServer
```

## Summary

Veeam Backup for Microsoft 365 provides comprehensive data protection for cloud-based Microsoft services through a flexible architecture supporting both on-premises and cloud storage targets. The primary use cases include protecting Exchange Online mailboxes, SharePoint Online sites and document libraries, OneDrive for Business user data, and Microsoft Teams conversations and files. Organizations typically deploy the solution to address compliance requirements, protect against ransomware and accidental deletion, and maintain long-term data retention beyond Microsoft's native capabilities.

Integration patterns commonly involve automating backup operations through PowerShell scripts for scheduled tasks, leveraging the REST API for custom application development and third-party tool integration, and using the Restore Portal for delegated self-service recovery. The modular architecture allows scaling from single-server deployments to distributed environments with multiple proxy servers and proxy pools, supporting both JET-based local repositories and cloud object storage including Amazon S3, Azure Blob Storage, and S3-compatible storage systems for cost-effective long-term retention.