How to offboard a single protection unit from an Express backup policy in Veeam Data Cloud for M365

Issue Summary

After creating an Express Protection Policy in Veeam Data Cloud for Microsoft 365, backups are retained for one year. These Express Protection Policies are built on the Microsoft 365 Backup storage backend. Over time, a situation may arise where you need to offboard a single protection unit (an Exchange Online Mailbox, a user's OneDrive, or a SharePoint Site) and have its data removed from retention by Microsoft 365 Backup Storage. Due to the sensitivity of data deletion, additional safeguards are in place.

This article outlines the steps required to request that Microsoft perform manual data removal of the protection unit from Microsoft 365 Backup Storage for compliance purposes. For security reasons, Microsoft will only honor up to five protection unit removal requests per organization. In the future, Veeam, through coordination with Microsoft, will release an improved protection unit removal procedure that will eliminate this manual procedure.

Please note that while it is possible to offboard an entire organization from Microsoft 365 Backup, this knowledge base article does not address that scenario. This article focuses specifically on the process for offboarding a single protection unit and removing its data.

Removing a Single Protection Unit from Protection

To remove backup data associated with a single protection unit, the unit must no longer be actively protected by an Express Protection Policy in Veeam Data Cloud.

1. Remove the protection unit from the relevant protection policy.
2. Submit a ticket to Veeam Support referencing the protection unit ID you wish to have removed, along with the associated tenant ID and protection policy ID. Work with Veeam Support to confirm that you want this protection unit removed and that it is no longer covered by any protection policy.
3. Submit a ticket to Microsoft Support referencing the protection unit ID you wish to have removed. Include the Veeam Support ticket number, your tenant ID, and protection policy ID, and business justification for the data removal request. Wait for approval and confirmation of the offboarding completion.