Using Microsoft Graph Export API for Teams

KB ID: 4322
Product: Veeam Backup for Microsoft 365 | 6.0
Published: 2022-06-10
Last Modified: 2022-06-21
Get weekly article updates
By subscribing, you are agreeing to have your personal information managed in accordance with the terms of Veeam's Privacy Notice.

Cheers for trusting us with the spot in your mailbox!

Now you’re less likely to miss what’s been brewing in our knowledge base with this weekly digest

error icon

Oops! Something went wrong.

Please try again later.

This article concerns a feature change coming in a future version of Veeam Backup for Microsoft 365. This article is being published well before that release to allow customers time to request API access to ensure a smooth transition when Veeam Backup for Microsoft 365 6a is released.

Purpose

Starting with Veeam Backup for Microsoft 365 6a, the backup of Microsoft Teams data will now be performed using Microsoft Graph Export API for Teams. These APIs access sensitive data and are considered protected APIs. To access these APIs, a form must be filled out to request access. This Veeam KB article documents what information the Microsoft form to "Request access to Protected APIs in Microsoft Graph" requires.

Due to Microsoft's planned deprecation of Exchange Web Services (EWS) backup for the TeamsMessagesData folder, which was used in previous versions of Veeam Backup for Microsoft 365, moving forward Veeam Backup for Microsoft 365 will use the  Microsoft Graph Export APIs for Teams to backup public channel messages.

Important Notes:

  • Starting with Veeam Backup for Microsoft 365 6a, the protection of Teams message data will no longer be enabled by default.
  • To protect Teams message data, additional steps must be performed, and then the Teams backup must be explicitly enabled.
  • Utilizing the Microsoft Graph Export API for Teams comes at an additional cost from Microsoft. *Veeam Backup for Microsoft 365 6a's API request will be considered as "model=B"
  • Microsoft's onboarding process for access to the Graph Export API may take up to two weeks to be processed. As such, it is advisable to begin the process of requesting API access as soon as possible.
  • The Microsoft Graph Export API for Teams is currently not supported in Microsoft 365 US Government, Germany, and China regions.

 

Solution

Register App and Collect Information for API Request Form

When adding an organization with modern authentication to Veeam Backup for Microsoft 365, after following the login prompts, you will end up with an app registration. You will need information about this app registration to request Protected API access in the next section.

  1. Log into portal.azure.com and select Azure Active Directory.
    If your account has access to more than one directory, ensure you have selected the relevant one.
  2. Under Azure Active Directory overview, gather the Tenant ID.
  3. In the Veeam Backup for Microsoft 365 Console, right-click the Organization and select 'Edit organization'. Gather the Application ID.

    Note that there is now a checkbox specifically for Microsoft Teams. That checkbox needs to be selected to back up Teams data. If access to the API has not been granted and this checkbox is enabled, the Teams backup will fail. Click next until you get to the Microsoft 365 connection settings. 
  4. Under App Registrations in Azure AD, review the API permissions assigned to the app registration used.
    Ensure that the Microsoft Graph Application permission to ChannelMessage.Read.All is assigned.

Request API Access

As documented in Protected APIs in Microsoft Teams:
To request access to these protected APIs, complete the following request form

Note: The process of whitelisting an app registration may take up to two weeks to complete.

Form Fields

To simplify the request process Veeam has documented each of the fields you will fill out to request Protected API access. Where possible text below will have a copy button, so that you can easily pate the text into the form. Each step number below corelates to the numbered entry in the "Request access to Protected APIs in Microsoft Graph" form (as of 2022-06-09).
If you notice that the Microsoft form has changed and no longer aligns with the information below, please Send KB Feedback.
 

  1. Your email address and any others you want to list as an owner — Enter an email address for the organization you wish to protect.
  2. Publisher name:
Veeam Software Corporation
  1. Application name:
Veeam Backup for Microsoft 365
  1. Application ID(s) to enable permissions for — Enter the application id you gathered earlier
  2. Which category best describes your applicationBackup/restore.
  3. Why does your application need read access to all messages in the tenant?
For backup and compliance purposes
  1. Data Retention:
    • It is obvious to any admin installing this app that it will make a copy of Microsoft Teams messages.
  2. What are the tenant ID's that this application needs to run in? — Enter the tenant id you gathered earlier.
  3. Does your organization own all those tenants?  — Yes


Click [ Next ]
 

  1. What is the homepage URL registered for the application ID?
https://www.veeam.com/backup-microsoft-office-365.html
  1. Terms of service URL?
https://www.veeam.com/eula.html
  1. Privacy statement URL?
https://www.veeam.com/privacy-notice.html


Click [ Next ]
 

  1. May we contact you about your app's use of non-protected APIs? — Yes
     


Click [ Submit ]

More Information

Until the whitelisting is complete you will get the following error when you try to back up Teams data:

Failed to process team: <teamname> 
Invoked API requires Protected API access in application—only context when not using Resource Specific Consent. 
Visit https://docs.microsoft.com/en—us/graph/teams—protected—apis for more details.. 
The remote server returned an error: (403) Forbidden.
Click here to send feedback regarding this KB, or suggest content for a new KB.
To report a typo on this page, highlight the typo with your mouse and press CTRL + Enter.

Spelling error in text

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.
Thank you!

Thank you!

Your feedback has been received and will be reviewed.

Oops! Something went wrong.

Please try again later.

KB Feedback/Suggestion

This form is only for KB Feedback/Suggestions, if you need help with the software open a support case

By submitting, you are agreeing to have your personal information managed in accordance with the terms of Veeam's Privacy Notice.
This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.
Verify your email to continue your product download
We've sent a verification code to:
  • Incorrect verification code. Please try again.
An email with a verification code was just sent to
Didn't receive the code? Click to resend in sec
Didn't receive the code? Click to resend
Thank you!

Thank you!

Your feedback has been received and will be reviewed.

error icon

Oops! Something went wrong.

Please try again later.