Used Ports

The following table lists required ports that must be opened for inbound/outbound requests in Veeam Backup
for Microsoft Office 365.

NOTE:

Data communication between Microsoft Office 365 organizations and Veeam Backup for Microsoft Office
365 is performed through an SSL connection.

From To Protocol Port Description

Microsoft TCP 443 Required to connect to Microsoft

Exchange Exchange Online organizations.
Online

Microsoft TCP 443 Required to connect to Microsoft

SharePoint SharePoint Online organizations.
Online

On-premises HTTP 5985 Required to connect to on-premises

Microsoft (HTTPS) (5986 — Microsoft SharePoint organizations
SharePoint used by through the WinRM port.
Server default)

On-premises TCP 80 or 443 Required to connect to on-premises

Veeam Backup for
Microsoft Microsoft Exchange organizations.
Microsoft Office
Exchange
365 Server
Server

Backup Proxy TCP 9193 Required to manage inbound/outbound

Server (used by traffic when interacting with the Veeam
default) Backup for Microsoft Office 365 server.

Make sure to open this port on a backup

proxy server.

TCP 445 This port is used to:

• Install and manage the
Veeam.Archiver.Proxy service on a
target proxy machine.
• Perform RPC requests.

17 | Veeam Backup for Microsoft Office 365 | User Guide

 From To Protocol Port Description

Veeam Auto- HTTPS 443 Required to access the auto-update server

update Server and licensing server. For more
information, see Checking for Updates and
Installing License.

The endpoint is:

https://vbo.butler.veeam.com/json-
rpc.php

S3 Compatible HTTPS 443 (used Required to work with any of the object
object storage by storage repositories.
default)

Amazon S3
object storage
/ IBM Cloud
Object Storage

Azure blob
storage

Veeam Backup TCP 9191 Required to manage inbound/outbound

for Microsoft traffic when interacting with the following
Office 365 components:
Server
• RESTful API
• PowerShell
Components • Veeam.Archiver.Shell (UI)
• (optionally) A remote management
server (if any)

Make sure to open this port on a Veeam

Backup for Microsoft Office 365 server.

Veeam Explorer for Veeam Backup TCP 9194 Required to manage inbound/outbound
Microsoft for Microsoft traffic when interacting with:
Exchange Office 365
• Veeam Explorer for Microsoft
Server
Veeam Explorer for Exchange
Microsoft
• Veeam Explorer for Microsoft
SharePoint
(including Veeam SharePoint
Explorer for
Microsoft OneDrive Make sure to open this port on a Veeam
for Business) Backup for Microsoft Office 365 server.

18 | Veeam Backup for Microsoft Office 365 | User Guide

 From To Protocol Port Description

Veeam Backup TCP 9191 Required to manage inbound/outbound

for Microsoft traffic when interacting with backup proxy
Office 365 servers.
Server
Make sure to open this port on a Veeam
Backup for Microsoft Office 365 server.

You can also change this port, as

described in Editing Backup Proxy Server.
Backup Proxy
Server
Microsoft TCP 443 Required to connect to Microsoft
Exchange Exchange Online through EWS (Exchange
Online Web Services).

On-premises HTTP 5985 Required to connect to on-premises

Microsoft (HTTPS) (5986) Microsoft SharePoint organizations
SharePoint through the WinRM port.

A server that TCP 9194 Required to maintain inbound/outbound

hosts Veeam traffic.
Backup &
Replication
Cloud Gateway
and Veeam
Backup for
Microsoft
Office 365

19 | Veeam Backup for Microsoft Office 365 | User Guide

Required Permissions
This section explains the required permissions for accounts you need to protect your data using Veeam Backup
for Microsoft Office 365: Veeam Backup account and Azure AD application. Depending on configuration of
Microsoft Office 365 organizations and the restrictions on using legacy authentication protocols, you can add
organizations using either modern app-only authentication, or modern authentication method with legacy
protocols allowed, or basic authentication.

When you add Microsoft Office 365 organization using the modern app-only authentication method, you use
only Azure AD application to establish and maintain connection between Veeam Backup for Microsoft Office 365
and Microsoft Office 365 organizations and perform a backup and restore from/to such organizations.

When you add Microsoft Office 365 organization using modern authentication with legacy protocols allowed,
you use both Veeam Backup account and Azure AD application to establish and maintain connection between
Veeam Backup for Microsoft Office 365 and Microsoft Office 365 organizations and perform a backup and
restore from/to such organizations. You use MFA-enabled Office 365 user account as Veeam Backup account.

When you add Microsoft Office 365 organization using basic authentication or an on-premises Microsoft
organization, you use Veeam Backup account to establish and maintain connection between Veeam Backup for
Microsoft Office 365 and such organizations and perform a backup and restore.

Depending on authentication methods you use, you must grant permissions to Veeam Backup account and Azure
AD application.

Veeam Backup Account Permissions

When you add Microsoft Office 365 organization using either modern authentication method with legacy
protocols allowed or basic authentication, you use Veeam Backup account. Also you use Veeam Backup account
for on-premises Microsoft Exchange and on-premises Microsoft SharePoint organizations.

To provide Veeam Backup for Microsoft Office 365 with the ability to work with Microsoft Exchange
organizations, Microsoft SharePoint and OneDrive for Business organizations, and protect Microsoft Teams data,
you must grant permissions to the Veeam Backup account, as follows:

• Microsoft Exchange Organizations

Roles and permissions required to work with Microsoft Exchange organizations.

• Microsoft SharePoint and OneDrive for Business

Roles and permissions required to work with Microsoft SharePoint and OneDrive for Business
organizations.

• Microsoft Teams
Roles and permissions required to protect Microsoft Teams data.

20 | Veeam Backup for Microsoft Office 365 | User Guide

Microsoft Exchange Organizations
The following table lists the required roles and permissions that must be assigned to the Veeam Backup account
that you want to use for working with Microsoft Exchange organizations. The table lists roles required by Veeam
Backup for Microsoft Office 365 when you add organizations using modern authentication with legacy protocols
allowed or basic authentication.

Consider the following:

• The account you are using to add an organization must be a member of this organization.

• The account you are using to add an organization is not required to have a mailbox in such an organization.

• If you are backing up public folder mailboxes, the Veeam Backup account must have a valid Exchange
Online license and an active mailbox within the Microsoft Office 365 organization.

NOTE:

For more information about permissions required to restore Microsoft Exchange data from backups created
by Veeam Backup for Microsoft Office 365, see Required Permissions for Veeam Explorer for Microsoft
Exchange.

Role Description

Role Management Required to grant the ApplicationImpersonation role.

ApplicationImpersonation Required to back up Exchange data.

Organization Configuration Required to manage role assignments.

Required to obtain necessary configuration

View-Only Configuration
parameters.

View-Only Recipients Required to view mailbox recipients.

Mailbox Search or Mail Recipients Required to back up groups.

Owner Required to backup/restore public folders.

Granting ApplicationImpersonation Role in PowerShell

For On-Premises Microsoft Exchange Organizations
To grant the ApplicationImpersonation role for on-premises Microsoft Exchange organizations, do the following:

1. Connect to the Exchange server, as described in this Microsoft article.

21 | Veeam Backup for Microsoft Office 365 | User Guide

 2. Run the following cmdlet to grant the role.

New-ManagementRoleAssignment –Role ApplicationImpersonation –User "Administrato

r"

For Microsoft Office 365 Exchange Organizations

To grant the ApplicationImpersonation role for Microsoft Office 365 Exchange organizations, do the following:

1. Connect to the Exchange server:

o For Basic Authentication, see this Microsoft article.

o For Modern Authentication, see this Microsoft article.

2. Run the following cmdlet to grant the role.

New-ManagementRoleAssignment –Role ApplicationImpersonation –User user.name@dom

ain.com

To obtain the list of users whom the ApplicationImpersonation role has already been granted, use the following
cmdlet (for both on-premises and Online organizations).

Get-ManagementRoleAssignment -Role "ApplicationImpersonation"

To remove the role, use the following cmdlet (for both on-premises and Online organizations).

Get-ManagementRoleAssignment -RoleAssignee "Administrator" -Role ApplicationImp

ersonation -RoleAssigneeType user | Remove-ManagementRoleAssignment

Creating and Configuring New Authentication Policy for

Exchange Online Organizations
To protect your Microsoft Office 365 organization data properly when you add an organization using either
modern authentication with legacy protocols allowed or basic authentication, you need to create a new
authentication policy with the AllowBasicAuthPowershell and AllowBasicAuthWebService parameters
enabled for the Veeam Backup account. To do this, use the following code snippet.

New-AuthenticationPolicy -Name "Allow Basic Auth"

Set-AuthenticationPolicy -Identity "Allow Basic Auth" -AllowBasicAuthPowershell
Set-AuthenticationPolicy -Identity "Allow Basic Auth" -AllowBasicAuthWebService
Set-User -Identity <VeeamBackupAccount> -AuthenticationPolicy "Allow Basic Auth
"

To back up public folder mailboxes correctly, enable the AllowBasicAuthAutodiscover parameter for the
created authentication policy by using the following cmdlet.

22 | Veeam Backup for Microsoft Office 365 | User Guide

 Set-AuthenticationPolicy -Identity "Allow Basic Auth" -AllowBasicAuthAutodiscov
er

Microsoft SharePoint and OneDrive for Business

This section lists the required roles and permissions that must be assigned to the Veeam Backup account that
you want to use for working with Microsoft SharePoint and OneDrive for Business organizations. The section
lists roles required by Veeam Backup for Microsoft Office 365 when you add organizations using modern
authentication with legacy protocols allowed or basic authentication.

Consider the following:

• To add Microsoft SharePoint Online organizations, make sure that the LegacyAuthProtocolsEnabled
setting is enabled.
To enable this setting, use the following cmdlet.

Set-SPOTenant -LegacyAuthProtocolsEnabled $True

For more information about the Set-SPOTenant cmdlet, see this Microsoft article.

• The account you are using to add on-premises Microsoft SharePoint and Microsoft SharePoint Online
organizations must be a member of these organizations.

NOTE:

For more information about permissions required to restore Microsoft SharePoint data from backups
created by Veeam Backup for Microsoft Office 365, see Required Permissions for Veeam Explorer for
Microsoft SharePoint.

On-Premises Microsoft SharePoint Organizations

The following table lists required roles that must be assigned to the account that you want to use to add on-
premises Microsoft SharePoint organizations.

Role Description Misc.

Required to back up Microsoft The account must be a member of

Site Collection Administrator
SharePoint Sites. the Farm Administrator group.

Microsoft SharePoint Online Organizations

The following table lists required roles that must be assigned to the account that you want to use to add
Microsoft SharePoint Online organizations.

23 | Veeam Backup for Microsoft Office 365 | User Guide

 Role Description Misc.

Required to back up Microsoft

SharePoint Admin
SharePoint Sites.

You can assign the Global Admin

View-only Configuration role that overrides these roles.
Required to get a list of available
groups and users.
View-Only Recipients

Granting SharePoint Administrator Role in PowerShell

To grant the SharePoint Administrator role using PowerShell (for Microsoft SharePoint Online organizations),
use the following code snippet.

Connect-MsolService
$role=Get-MsolRole -RoleName "SharePoint Administrator"
$accountname="example@domain.com"
Add-MsolRoleMember -RoleMemberEmailAddress $accountname -RoleName $role.Name

The $accountname variable must be a user UPN (example@domain.com).

The MSOL module can be downloaded from this Microsoft page.

24 | Veeam Backup for Microsoft Office 365 | User Guide

Microsoft Teams
To back up Microsoft Teams data, Veeam Backup for Microsoft Office 365 requires access to the Exchange
mailbox of the group associated with a team and to the SharePoint site of this group. Thus, the Veeam Backup
account that you use to add an organization using modern authentication with legacy protocols allowed or basic
authentication must have permissions required for backup of Exchange Online and SharePoint Online data. For
more information, see Microsoft Exchange Organizations and Microsoft SharePoint and OneDrive for Business.

In addition, the Veeam Backup account that you use to add an organization must meet the following
requirements:

• The account must have a Microsoft Office 365 license that permits access to Microsoft Teams API. The
minimum sufficient license is Microsoft Teams Exploratory experience.

• The account must have the Team Administrator role assigned.

NOTE:

Consider the following:

• In case you add an organization in Veeam Backup for Microsoft Office 365 using the modern
authentication method with legacy protocols allowed, and specify different accounts to connect to
Microsoft Exchange and Microsoft SharePoint, the required license and role must be assigned to the
account used to connect to Microsoft SharePoint.
• For more information about permissions required to restore Microsoft Teams data from backups
created by Veeam Backup for Microsoft Office 365, see Required Permissions for Veeam Explorer for
Microsoft Teams.

Azure AD Application Permissions

This section explains required permissions for Azure AD applications that you use to back up and restore data
from/to your Microsoft Office 365 organizations.

For more information about permissions in Azure, see this Microsoft article.

Requirements for Modern App-Only Authentication

The following table lists permissions for Azure AD applications that are granted automatically by Veeam Backup
for Microsoft Office 365 when you add organizations using the modern app-only authentication method.

If you prefer to use a custom application of your own, make sure to grant all the permissions listed in this table
manually.

API Permission name Type Usage Description

Application Backup Querying Azure AD for

Microsoft organization properties, the list of
Directory.Read.All
Graph users and groups and their
properties.

25 | Veeam Backup for Microsoft Office 365 | User Guide

 API Permission name Type Usage Description

Delegated1 Restore Querying Azure AD for

organization properties, the list of
users and groups and their
properties.

Group.Read.All Application Backup Querying Azure AD for the list of

groups and group sites.

Group.ReadWrite.All Application2 Restore Recreating in Azure AD an

associated group in case of a
deleted team site restore.

This permission is only required for

restore of SharePoint site data
with Azure AD applications using a
certificate. The operation is
available through RESTful API and
PowerShell.

Delegated1 Restore Recreating in Azure AD an

associated group in case of teams
restore.

offline_access Delegated1 Restore Obtaining a refresh token from

Azure AD.

Sites.ReadWrite.All Application Backup Querying Azure AD for the list of

sites and getting download URLs
for files and their versions.

TeamSettings.ReadWrite.All Application Backup Accessing archived teams to

backup.

Application2 Restore Restoring teams to the archived

state.

EWS.AccessAsUser.All Delegated1 Restore Accessing mailboxes as the signed-

in user (impersonation) through
EWS to restore.

full_access_as_app Application Backup Reading mailboxes content to

backup.

26 | Veeam Backup for Microsoft Office 365 | User Guide