How to request access to Microsoft Graph Teams Export APIs
This article documents how to request Microsoft Graph Export API for Teams access, which is needed to enable Veeam Backup for Microsoft 365 6a to utilize that API to protect Teams chats.
After Microsoft has approved access to the Teams Protected APIs and Veeam Backup for Microsoft 365 6a is installed, follow the steps in KB4340 to enable the use of those APIs to protect Teams chats.
Purpose
Veeam Backup for Microsoft 365 6a provides an option to leverage Microsoft Graph Export API for Teams to back up Teams chatsVeeam Backup for Microsoft 365 backs up Teams channel messages. For more information on the limitations of Teams chat backup, click here.. However, because these APIs access sensitive data, they are considered protected APIs, and to access these APIs, the backup administrator must fill out a form to request access from Microsoft. This Veeam KB article documents what information the Microsoft form (Request access to protected APIs) requires.
Support for Microsoft Graph Export API for Teams was implemented in Veeam Backup for Microsoft 365 6a because soon Microsoft will deprecate the ability for EWS APIs to access the TeamsMessagesData folder. By default Veeam Backup for Microsoft 365 6a and previous versions utilized EWS APIs to protect the TeamsMessagsesData folder. After Microsoft deprecates EWS API access to the TeamsMessagesData folder, the only way to backup Teams public channel message using Veeam Backup for Microsoft 365 will be to utilize the Teams Export APIs.
Important Notes:
- To protect Teams message dataVeeam Backup for Microsoft 365 backs up Teams channel messages. For more information on the limitations of Teams chat backup, click here., additional steps must be performed, and then the Teams backup must be explicitly enabled.
- Utilizing the Microsoft Graph Export API for Teams comes at an additional cost from Microsoft. *Veeam Backup for Microsoft 365 6a's API request will be considered as "model=B"
- Microsoft's onboarding process for access to the Graph Export API may take up to two weeks to be processed. As such, it is advisable to begin the process of requesting API access as soon as possible.
- The Microsoft Graph Export API for Teams is currently not supported in Microsoft 365 US Government, Germany, and China regions.
Solution
Register App and Collect Information for API Request Form
When adding an organization with modern authentication to Veeam Backup for Microsoft 365, after following the login prompts, you will end up with an app registration. You will need information about this app registration to request Protected API access in the next section.
- Log into portal.azure.com and select Azure Active Directory.
If your account has access to more than one directory, ensure you have selected the relevant one. - Under Azure Active Directory overview, gather the Tenant ID.
- In the Veeam Backup for Microsoft 365 Console, right-click the Organization and select 'Edit organization'. Gather the Application ID.
- Under App Registrations in Azure AD, review the API permissions assigned to the app registration used.
Ensure that the Microsoft Graph Application permission to ChannelMessage.Read.All is assigned.
Request API Access
As documented in Protected APIs in Microsoft Teams:
To request access to these protected APIs, complete the following request form.
Note: Microsoft's review process may take up to two weeks to be completed.
Form Fields
To simplify the request process, Veeam has documented the fields you will fill out to request Protected API access. Where possible text below will have a copy button so that you can easily paste the text into the form. Each step number below correlates to the numbered entry in the "Request access to protected APIs " form (as of 2022-08-09).
If you notice that the Microsoft form has changed and no longer aligns with the information below, please Send KB Feedback.
- Your email address and any others you want to list as an owner — Enter an email address for the organization you wish to protect.
- Publisher name:
- Application name:
- Application ID(s) to enable permissions/subscription for — Enter the application id you gathered earlier
- Azure billing subscription ID as GUID, this subscription must be under the same tenant. — Enter the Subscription ID
- Which category best describes your application — Backup/restore
- Why does your application need read access to all messages in the tenant?:
- Data retention (select one):
- It is obvious to any admin installing this app that it will make a copy of Microsoft Teams messages.
- It is obvious to any admin installing this app that it will make a copy of Microsoft Teams messages.
- What are the tenant ID's that this application needs to run in? — Enter the tenant id you gathered earlier.
- Does your organization own all those tenants? — Yes
Click [ Next ]
- May we contact you about your app's use of non-protected APIs? (E.g., Azure subscription verification, reliability issues, advanced notice of breaking changes, throttling, etc). — Yes
- I have read and agree to the Terms and Conditions for Licensing and payment requirements that apply to these APIs (Service Specific Terms in the link below). Selecting "No" will reject your request. — Yes
Click [ Submit ]
To report a typo on this page, highlight the typo with your mouse and press CTRL + Enter.
Spelling error in text
Thank you!
Your feedback has been received and will be reviewed.
KB Feedback/Suggestion
This form is only for KB Feedback/Suggestions, if you need help with the software open a support case
Thank you!
Your feedback has been received and will be reviewed.