The next release of Veeam Backup for Microsoft 365 will bring a major change to the way we protect Microsoft Teams’ chat data. Starting from V6A, we will support backing up Teams chats by using the newly released Teams Export APIs. What does this mean for you and how should you prepare for this new release?
The legacy approach to Teams backup is retiring
Technically, Teams chat backup has always been a challenge because there were no specific APIs to access and get messages. Since we introduced Teams support, we only could protect the chats by backing up the messages from the TeamsMessageData folder of the Exchange group mailbox. Microsoft used this hidden folder to archive messages sent within a team channel or between individual users or groups. In the last few months, Microsoft started applying more restrictions for access to this folder, which sometimes caused issues with Teams protection for our customers. These restrictions will be applied to everyone in a couple of months.
The future – Teams Export APIs
A few months ago, Microsoft introduced a new set of Teams Export APIs designed to access Teams chats directly and get messages straight from the underlying Cosmos DB service that hosts the chats. On Jan. 31 of 2023, Microsoft will start to deprecate any access to the TeamsMessageData folder, and Teams Export APIs will remain the only way to go for working with Teams message data in the future.
The APIs are protected, and to enable them in your Microsoft 365 tenant, you need to be granted special access and permissions. And on top of that, Microsoft charges their customers for using these APIs.
How this underlying change will affect your Teams backup
Since this article was first published, we received a lot of feedback from you, our customers. We are listening. To make the transition as smooth as possible, we decided to keep the legacy default approach and let you switch to the new Teams Export APIs manually as soon as you are ready.
After you upgrade to the upcoming Veeam Backup for Microsoft 365 v6a, you will be able to manually switch the product to the new Teams Export APIs. Until you make the switch, your Teams chats will continue to be backed up via the group mailbox folder. Note that the rest of the Teams data, including metadata, channels, tabs, files and membership, will continue to be protected no matter what — regardless of when and if you switched to the new way of backing up Teams chats.
The cost
Charges for using Teams Export APIs apply per tenant per message and depend on the license model used. Veeam Backup for Microsoft 365 will support Model B, which means that the protection of Teams message data will cost you $0.00075 per message. At the end of the month, the amount spent on using the APIs will be included in your invoice from Microsoft — Veeam itself does not apply any charges.
And I know that your next question will be, “How can I estimate my costs?” Currently, the best way would be to decide what team chats are critical for your business, check out the average usage statistics, and do some calculations manually. Microsoft Teams admin center provides you usage reports on the number of channel messages sent and replies to these messages, which you can use as a basis for your calculations:
How to apply for access to the protected APIs
Microsoft provides a special form that you need to fill in to apply for access to Teams Export APIs:
The following list will help you to fill in the form quickly:
- Publisher name
- Veeam Software
- Application name
- Put the name of the app that you use to add your Microsoft 365 organization to the Veeam Backup for Microsoft 365 You can find it in the Azure Active Directory admin center -> App registrations
- Application ID(s) to enable permissions for (GUID, semicolon separated)
- Put the application (client) ID of the app that you use to add your Microsoft 365 organization to the Veeam Backup for Microsoft 365 You can find it in the Azure Active Directory admin center -> App registrations -> Overview of your app:
- Which category best describes your application (select one)
- Select “Backup/restore”
- Why does your application need read access to all messages in the tenant? (If you don’t, you don’t need access to protected APIs)
- To allow for backup/protection of Teams message data
- Data retention (select one):
- Select “It is obvious to any admin installing this app that it will make a copy of Microsoft Teams messages”
- What are the tenant IDs that this application needs to run in? (GUID, semicolon-separated. If you’re writing software for other organizations to use, include “all”).
- Put the tenant ID of your Microsoft 365 organization that you protect with Veeam Backup for Microsoft 365. You can find it in the Azure Active Directory admin center -> Overview of your tenant:
The access is usually provided by Microsoft within a few days, but sometimes it may take up to two weeks or longer, so plan for applying in advance. For more information, see the KB4322.
How to make a switch in V6A
Once you get the access to Teams Export APIs and you’re ready to switch your backups, you need to configure the following in Veeam Backup for Microsoft 365 v6a:
- Run the new Set-VBOServer PowerShell cmdlet to enable the new Teams chat backup options in the product UI. More details on this and the following steps to come when V6A is generally available.
- Use the Set-VBOProxy PowerShell cmdlet with the new -EnableTeamsGraphAPIBackup parameter to switch a backup proxy to the new method. Note that you will need to run it on every proxy that you want to process Teams chats using a new approach.
- Reconfigure your organization and explicitly select the new option to back up Teams chats:
Teams chats backup is supported only for organizations using the modern app-only authentication and is in the Default (Worldwide) region. So, on the next steps of the wizard, Veeam Backup for Microsoft 365 will verify if your organization meets the authentication and region requirements, and if the provided app has the required permissions.
4. Configure your Teams backup jobs. In v6a, we’re adding processing options for Microsoft Teams — chats are now a separate option that you can enable or disable per team when configuring your backup jobs:
Tl;Dr check-list
- In Veeam Backup for Microsoft 365 v6a, we support the new Teams Export APIs for messages data protection
- To continue protecting Teams channel chats using the new Teams Export APIs, you need to:
- Get ready for additional costs
- Apply for access to APIs from Microsoft
- Enable the switch in your backup server Config.xml file and on proxies
- Reconfigure your organization in Veeam Backup for Microsoft 365
- Reconfigure your Teams backup jobs
If you have any questions on the upcoming changes, you’re welcome to post them on Veeam Forums.