About IBM Spectrum Protect Plus Online Services for Microsoft 365

IBM Spectrum Protect Plus Online Services for Microsoft 365 is designed to ensure resiliency of service in the event of a disaster and helps to recover lost or corrupted content from your backup. IBM Spectrum Protect Plus Online Services for Microsoft 365 offers backup capabilities for all Microsoft 365 instances, such as Exchange Online, OneDrive for Business, SharePoint Online, Microsoft 365 Groups, Teams, Project Online, and Public Folders, to protect your data. These object types are backed up and restored independently of one another.

Note the following:
Yammer service:
  • To protect Yammer data, you must have a Yammer app connected to your tenant, and the authentication user of this Yammer app must have the Verified Admin role. For details on configuring a Yammer app, refer to App Profile for Yammer. Yammer service currently supports in place restore only (restoring to the original location), meaning the Yammer community needs to already be there, as well as the ability to export files and conversations. Note that the Microsoft 365 services in GCC High data center and the data center operated by 21Vianet in China do not support Yammer, so the Yammer backup service in such data centers is not supported as well.
  • If you have Microsoft 365 connected Yammer communities protected under Microsoft 365 Groups service, once the Yammer service is enabled, the connected groups will be removed from Microsoft 365 Groups service and can only be protected in Yammer even if you disable the Yammer service again. IBM Spectrum Protect Plus Online Services for Microsoft 365 job will start a new backup cycle for these Yammer communities, but their former backup data as Microsoft Groups will not be deleted until the data expires retention period.
SharePoint Online, OneDrive for Business, and Project Online:
  • You can change the SharePoint domain name for your organization in Microsoft 365 as introduced in the Microsoft article: Rename your SharePoint domain. This feature affects only the SharePoint and OneDrive URLs. It doesn’t impact email addresses. After the domain name is changed and updated into Auto Discovery, IBM Spectrum Protect Plus Online Services for Microsoft 365 will run a full backup for SharePoint Online sites and OneDrive for Business objects with new URLs.
  • IBM Spectrum Protect Plus Online Services for Microsoft 365 for OneDrive for Business will protect the Documents library and will protect the Site Assets library as well if the site feature Site NoteBook is activated.

    The service only protects content and permissions for OneDrive for Business since OneDrive for Business is the cloud service used to help securely store, share, and access your files.

  • As Microsoft has a 2 GB file size limit of OneNote notebooks saved in One Drive or SharePoint, backup jobs will skip the OneNote files that are larger than 2 GB. In addition, due to API limitations, IBM Spectrum Protect Plus Online Services for Microsoft 365 cannot protect the history versions of OneNote files.
  • If there are security changes but no changes on the content in the sites, the scheduled incremental backup jobs will not back up the securities. Moving forward, the changes on the securities in the sites (including the SharePoint Online sites, OneDrive for Business, and Microsoft 365 Groups/Teams team sites) that have not yet been backed up, in this case, will be included in an incremental backup once a week.
  • If you would like to filter the folders to protect a OneDrive for Business service or Exchange Online service, or filter the folders within the site collections of SharePoint Online service, Project Online services, Microsoft 365 Groups services, or Teams service, you can contact the IBM Software Support team for assistance.
  • If you would like to exclude the workflow history list as well as the list items from your backup for better backup job efficiency, contact the IBM Software Support team for assistance.
  • The files in the SharePoint site and the mailbox items in Exchange Online that are applied with the labels created via AIP (Azure Information Protection) can be protected by IBM Spectrum Protect Plus Online Services for Microsoft 365, as well as the applied Label. The documents applied with the sensitivity labels of DKE (Double Key Encryption) are also supported, but only the user who has permission can access them.
  • Preservation Hold library is not protected by IBM Spectrum Protect Plus Online Services for Microsoft 365.
  • IBM Spectrum Protect Plus Online Services for Microsoft 365 for SharePoint Online also supports protecting Communication Sites. When restoring a deleted Communication Site to its original location, IBM Spectrum Protect Plus Online Services for Microsoft 365 supports restoring the custom design of the Communication Site in the backup. If the Communication Site is registered through App Profile, the Communication Site can only be restored with the default design. Note that the comments in Communication Sites are not currently supported.
  • As the locked site collections are inaccessible, the backup job will check the lock status and skip backing up the locked site collections, which will be recorded in the job report; for read-only site collections, only the full backup job that runs once every year will back them up. Since no changes can be made to read-only site collections, the incremental backup jobs will skip them.
  • IBM Spectrum Protect Plus Online Services for Microsoft 365 for Project Online supports restoring Project Permission Mode features. Project Online data cannot be protected in the app context (using app profile authentication), and Project Online service cannot protect the Project for the web data and cannot fully support the data added through Microsoft 365 subscription Project Online desktop client. For example, custom fields.
Exchange Online and Public Folders:
  • If you would like to filter the folders to protect a OneDrive for Business service or Exchange Online service, or filter the folders within the site collections of SharePoint Online service, Project Online services, Microsoft 365 Groups services, or Teams service, you can contact the IBM Software Support team for assistance.
  • The service for Public Folders only supports restoring content, permissions, and metadata of Public Folders to the original location. Note that the Public Folders service does not support protecting Public Folder metadata in the app context.
  • Use Object ID instead of mailbox address as the unique identifier for Exchange Online mailboxes and Public Folders. This change has been made to IBM Spectrum Protect Plus Online Services for Microsoft 365. Due to this change, the mailboxes that have been re-created with the same address will no longer be regarded as the same one. This might require a broader search to ensure you find all the backup data for restoring, exporting, or deleting; the mailbox being renamed can only be found by the new name with the former backup data associated, and its former name will be displayed in its row.
Microsoft 365 Groups and Teams
  • IBM Spectrum Protect Plus Online Services for Microsoft 365 can check the status of groups and teams in Microsoft 365 and provides the option to help you restore the soft-deleted groups and teams (within the 30-day retention period) from the Microsoft 365 recycle bin.
  • If you are using service account authentication for the backup of Teams’ Private Channel, the service account must be the owner of the Private Channel.
  • If you are using custom app authentication, ensure your app has access to the protected APIs of Microsoft Teams. Otherwise, the public and private channels’ conversations cannot be protected. To request access to the protected APIs, refer to the Microsoft article: Protected APIs in Microsoft Teams.
Microsoft Teams Chat
  • To use the Microsoft Teams Chat service to protect Teams chat messages, you can register the All permissions type app profile for Microsoft 365 for Auto Discovery and backup, or you can use a hybrid approach (using service account authentication for Auto Discovery while also having an app profile configured for your tenant). You can also choose to use a custom app. For details on the required permissions for custom app, refer to App Profile Authentication.
  • Microsoft Teams Chat service in IBM Spectrum Protect Plus Online Services for Microsoft 365 currently uses the Teams Export API of Microsoft Graph to export Teams chat messages to an HTML file. Currently, we are using Export API model A to protect the chats of Microsoft 365 users with any of the following licenses:
    • Microsoft 365 A5 for Faculty
    • Microsoft 365 E5
    • Microsoft 365 E5 Compliance
    • Microsoft 365 E5 Security
    • Microsoft 365 E5 without Audio Conferencing
  • The Export API may charge the app creator for messages consumed beyond the seeded capacity. Therefore, if you are using an IBM Spectrum Protect Plus Online Services default app for Microsoft 365, you may incur charges from IBM Spectrum Protect Plus Online Services as Microsoft begins charging for this API. If you are using a custom app, to request access to Export APIs, read the Prerequisites and complete the request form.
  • Microsoft Teams Chat backup service does not support GCC tenants. For more details on the supported data types, refer to Teams Chat Data Types.
Single Sign-On

With Single Sign-On (SSO) supported, you can access IBM Spectrum Protect Plus Online Services for Microsoft 365 interface via direct URL without providing user credentials once it is detected that you have signed into the IBM Spectrum Protect Plus Online Services interface.

Backup Schedule

The backup service will perform scheduled backups automatically and compress and encrypt backup data by default. The schedule of an object type starts with the first backup job.

IBM Spectrum Protect Plus Online Services for Microsoft 365 provides a backup frequency of once a day by default. Your second scheduled backup job on the next day will run ten hours after the start time of the first backup job, to ensure your backups all run at night for the best throughput. The subsequent jobs inherit the schedule automatically. In the meantime, you still have the option to adjust the backup frequency and the start time for the backup jobs.

Note that if there is a backup job in progress, the automatic backup job scheduled to run will be skipped.

Backup jobs can also be run manually if there is data that failed to be backed up during the last backup job. For detailed instructions on manually running backup jobs, refer to Manually Run a Backup.

Storage Location

You can choose to store the backup data to the default storage location provided by IBM Spectrum Protect Plus Online Services for Microsoft 365 or your custom storage location. If you are currently using the default storage location and you want to use your own storage afterward, you can contact IBM® Software Support to update your license and change the default storage to your own storage.

The storage type of the default storage location is Microsoft Azure Blob Storage. The custom storage location can be one of the following five storage types: Amazon S3, Dropbox, FTP, Microsoft Azure Blob Storage, and SFTP. The backup data will be purged from the storage after the data reaches the retention period. If you use the default storage location, you can purchase a license with a retention period of multiple years (between 1 and 99) or unlimited years. You can restore the backup data of these object types to the original location where they are backed up, to another destination, or restore them to a custom storage location. For details, refer toRestore Options for Different Object Types and Restore and Recover Your Data.

Note: If your device is Microsoft Azure Blob Storage, IBM Spectrum Protect Plus Online Services will automatically store your backup data to a cool tier to help conserve storage costs. The supported Azure account kinds are StorageV2 and BlobStorage of the Standard performance type.

You may have some old backup data stored to the archive tier, the most cost-effective manner of using Azure blob storage. But for a successful restore, IBM Spectrum Protect Plus Online Services recommends keeping the index database in the online tier (hot or cool).

When Azure Blob Storage users perform a restore job, they can choose to allow the restore job to automatically rehydrate data from the archive tier, or they must manually change the access tier of the backup data in storage.

The restore job will first rehydrate the data sets in the archive tier, and this restore job may take longer than previously. The restore job also supports restoring the archive tier backup data to your own storage. If you are using IBM Spectrum Protect Plus Online Services default storage, the restore job will automatically rehydrate data.

The export job also supports automatically rehydrating backup data in the archive tier if you are using IBM Spectrum Protect Plus Online Services default storage. This feature has not been supported yet for customers using BYOS.

For details about blob access tiers and how to change access tiers, refer to the Microsoft article: Azure Blob storage: hot, cool, and archive access tiers.

If you are using your own Microsoft Azure Blob Storage and facing the upper limit on your storage account, you can append a new Microsoft Azure Blob storage account. The maximum storage account capacity for a standard storage account is 5 PiB. You can contact Microsoft Azure support to request an increase. Currently, you can only append one additional storage account, and this is only available for BYOS customers on Azure.

Retention

If you use your own storage device and have purchased an unlimited data retention agreement, you can customize the data retention period for each service type. Prior to any data deletion, IBM Spectrum Protect Plus Online Services for Microsoft 365 will send a notification email informing you of the service data which will be deleted. You will still have time to either extend your retention period or export your data (a paid service).

Reporting

By monitoring the license consumptions, jobs operations, and all user activities, your application administrator can have an overall understanding of the resource usage, review and analyze the job progress and details, and predict the service usage trends.