Using Microsoft Graph Export API for Teams

Starting with Veeam Backup for Microsoft 365 6a, the backup of Microsoft Teams data will now be performed using Microsoft Graph Export API for Teams. These APIs access sensitive data and are considered protected APIs. To access these APIs, a form must be filled out to request access. This Veeam KB article documents what information the Microsoft form to "Request access to Protected APIs in Microsoft Graph" requires.

Due to Microsoft's planned deprecation of Exchange Web Services (EWS) backup for the TeamsMessagesData folder, which was used in previous versions of Veeam Backup for Microsoft 365, moving forward Veeam Backup for Microsoft 365 will use the  Microsoft Graph Export APIs for Teams to backup public channel messages.

Important Notes:

• Starting with Veeam Backup for Microsoft 365 6a, the protection of Teams message data will no longer be enabled by default.
  
• To protect Teams message data, additional steps must be performed, and then the Teams backup must be explicitly enabled.
• Utilizing the Microsoft Graph Export API for Teams comes at an additional cost from Microsoft. ^{*Veeam Backup for Microsoft 365 6a's API request will be considered as "model=B"}
• Microsoft's onboarding process for access to the Graph Export API may take up to two weeks to be processed. As such, it is advisable to begin the process of requesting API access as soon as possible.
• The Microsoft Graph Export API for Teams is currently not supported in Microsoft 365 US Government, Germany, and China regions.

Request API Access

As documented in Protected APIs in Microsoft Teams:
To request access to these protected APIs, complete the following request form. 

Note: The process of whitelisting an app registration may take up to two weeks to complete.

Form Fields

To simplify the request process Veeam has documented each of the fields you will fill out to request Protected API access. Where possible text below will have a copy button, so that you can easily pate the text into the form. Each step number below corelates to the numbered entry in the "Request access to Protected APIs in Microsoft Graph" form (as of 2022-06-09).
^{If you notice that the Microsoft form has changed and no longer aligns with the information below, please Send KB Feedback.}
 

1. Your email address and any others you want to list as an owner — Enter an email address for the organization you wish to protect.
2. Publisher name:

3. Application name:

4. Application ID(s) to enable permissions for — Enter the application id you gathered earlier
   
5. Which category best describes your application — Backup/restore.
6. Why does your application need read access to all messages in the tenant?

7. Data Retention:
   • It is obvious to any admin installing this app that it will make a copy of Microsoft Teams messages.
     
8. What are the tenant ID's that this application needs to run in? — Enter the tenant id you gathered earlier.
9. Does your organization own all those tenants?  — Yes
   
   
   

Click [ Next ]
 

10. What is the homepage URL registered for the application ID?

11. Terms of service URL?

12. Privacy statement URL?