How to Create a Microsoft 365 Backup Set

This guide covers creating a Microsoft 365 backup set: the prerequisites, the Microsoft EWS retirement that started on 1 October 2026, authorising against your tenant, choosing what to back up, destinations, encryption, and what can and cannot be restored afterwards.

Before you start

Software version

Use version 10.3.2 or later of the backup software. Earlier versions do not have the Microsoft Graph changes needed after the EWS retirement described below. After upgrading, re-run Authorise on any existing Microsoft 365 backup set so the additional Microsoft Graph API permissions are granted.

Microsoft 365 account permissions

The account used to authorise the backup set needs one of the following:

• Global Administrator, or
• all four of Application Administrator, Exchange Administrator, SharePoint Administrator and Teams Administrator, if Global Administrator cannot be granted.

In addition:

• Term Store Administrator may be needed to back up and restore some SharePoint items. Add it in the SharePoint admin centre under Content services > Term store.
• The account should be a member of the Discovery Management role group in the Exchange admin centre, with the Legal Hold, Mailbox Import Export and Mailbox Search roles assigned to that group.
• Public Folders can only be selected by a licensed Exchange administrator, or a licensed user with Public Folder permission.

Microsoft 365 licences on the tenant side

The account you restore data into needs a matching Microsoft licence: an Exchange Online licence to restore Outlook items, and a SharePoint Online licence to restore OneDrive or Personal Site items.

Users on Exchange Online Kiosk, Microsoft 365 F1 or F3 licences are affected by the EWS changes below — read that section if you back up frontline users.

How backup licences are counted

• Each Microsoft 365 user selected for backup uses one Microsoft 365 backup licence, whether or not the user is licensed by Microsoft. The same user in several backup sets under one backup account counts once.
• Each shared, room or equipment mailbox selected for backup also uses one licence.
• A backup set containing only SharePoint Site Collections uses no licences, but at least one licence must be available for the backup to start.
• When a user is removed from the backup source, their data moves to the retention area and keeps using a licence until retention clean-up permanently deletes it.

Microsoft EWS retirement (October 2026)

Microsoft has begun retiring Exchange Web Services (EWS) in Exchange Online. From 1 October 2026 it is being switched off tenant by tenant, and on 1 April 2027 it is turned off permanently for every tenant, with no exceptions or extensions. This is a Microsoft change and affects every Microsoft 365 backup vendor.

Most Microsoft 365 data has already moved to Microsoft Graph and is not affected: Outlook mailboxes (mail, calendar, contacts), OneDrive, Personal Sites, SharePoint, Group Sites, Teams Chat and Teams Channels.

Three data types still depend on EWS, because Microsoft Graph does not yet support them:

Keeping archive, Group Mail and Public Folder backups running until April 2027

If a customer relies on any of those three, EWS must be enabled on their tenant, with the backup software on the tenant’s EWS application allow list. A tenant left at the default setting was switched off on or after 1 October. Check the setting in Exchange Online PowerShell:

Get-OrganizationConfig | Select EwsEnabled, EwsApplicationAccessPolicy

If EwsEnabled is False or blank, enable it:

Set-OrganizationConfig -EwsEnabled $true

Then make sure the backup software’s application is on the tenant’s EWS allow list. Enabling EWS without an allow list entry does not work after 1 October 2026. The application appears under Enterprise applications in the Microsoft Entra admin centre once the backup set has been authorised; contact us if you need its Application ID. EWS can be re-enabled at any point before 1 April 2027, including after backups have started failing, and backups resume on the next run.

Treat this as a bridge, not a fix. Plan for archive, Group Mail and Public Folder backups to stop on 1 April 2027.

Kiosk, F1 and F3 licensed users

Separately, Microsoft blocks EWS for mailboxes licensed only as Exchange Online Kiosk, Microsoft 365 / Office 365 F1 or F3, returning an HTTP 403 error. The tenant setting above does not override this. For these users, Outlook (Archive) and any other EWS-dependent backup fails. To keep it working, assign a licence that includes EWS rights, such as Exchange Online Plan 1 or 2, or Microsoft 365 E3/E5.

What happens to data already backed up

Archive, Group Mail and Public Folder data already in your backup stays restorable for as long as your retention policy keeps it. It simply stops being updated once EWS is unavailable to the tenant.

Creating the backup set

1. Log in to the backup software.

2. In the main interface, click Backup Sets.

   

3. Click the + icon before “Add new backup set”.

   

4. Enter a Name for your backup set and select Microsoft 365 Backup as the backup set type.

   

   Select the Backup Scope and Region. Tick Access the Internet through proxy if needed, then click Test.

   

5. Click Authorise to start the authentication process.

   

   Sign in to your Microsoft account.

   

   If the account is required to use MFA — through Security Defaults, a Conditional Access policy or per-user MFA — complete the verification with whichever method the account is registered for, such as the Microsoft Authenticator app, a text or a call. The screenshots below show the text and call options.

   

   If Call was selected, answer the call and follow the instructions to complete the verification.

   

   If Text was selected, enter the code and click Verify.

   

   Note: verification is only requested if MFA is required for the account signing in.

   Copy the authorisation code.

   

   Go back to the backup software, paste the authorisation code and click OK.

   

   If the backup scope selected is Entire organisation but the account used to sign in is a personal account, this error message is displayed.

   

   Change the backup scope to This Microsoft 365 user only — only a business account can be used to sign in when the scope is Entire organisation.

   “Test completed successfully” is shown when the validation succeeds. Click Next to continue.

   

Backup source

6. The Backup Source window that appears depends on the backup scope you selected — Entire organisation or This Microsoft 365 user only.

   If Entire organisation is selected

   Select the users and data types to back up.

   

   To select specific users, click Select.

   

   Users can be sorted alphabetically or by user group. Sorted alphabetically:

   

   Sorted by user group:

   

   The list of users can be displayed three ways: Show all, Selected only and No longer available.

   

   You can search for a user by entering a name or email address in the search box; matching names and addresses are listed automatically. Click Check All Current Items to select every listed user.

   

   Select specific users by ticking the checkbox beside each one.

   

   To display only the users you have selected, choose Selected only.

   

   Click OK once done with the selection.

   Tick Auto-exclude any Microsoft 365 unlicensed user during backup if you do not want unlicensed users included.

   

   An unlicensed user is shown with a yellow warning tag on the icon.

   

   Select the data types to include in the backup: Outlook, Outlook (Archive), OneDrive, Personal Site and Teams Chat. Ticking a checkbox backs up all of that type — ticking Outlook, for example, backs up the mailboxes of the selected users. For Teams Chat you do not need to select the other user accounts involved in a chat to back up the conversation.

   Note: Outlook (Archive) depends on Microsoft EWS. It only backs up if EWS is enabled on the tenant, and stops entirely on 1 April 2027. See Microsoft EWS retirement.

   

   Select whether to back up Teams, SharePoint Sites and Public Folders. To back up a specific group in Teams, tick Select Specific, then click Select.

   

   You can search for a group by entering its name in the Search Groups field. Groups can also be displayed as Show all, Selected only or No longer available. Click OK once done, and choose whether Group Mail, Group Site and Teams Channel are included.

   

   Note: to back up shared attachments on certain Teams Channel posts, OneDrive and Group Site must both be selected as source.

   Note: Group Mail and Public Folders depend on Microsoft EWS. They only back up if EWS is enabled on the tenant, and stop entirely on 1 April 2027. See Microsoft EWS retirement.

   To back up a specific site in SharePoint Sites, tick Select Specific, then click Select. Searching and listing sites works the same way as for users.

   

   

   To back up a specific public folder, tick Select Specific, then click Select. Searching and listing public folders works the same way.

   

   

   If This Microsoft 365 user only is selected

   The window shown depends on the type of account used for authentication. For a business account:

   

   Note: this message appears if OneDrive is not selected but Teams Channel and/or Teams Chat are.

   

   For a personal account:

   

   Note: for instructions on using the Filter, refer to the Backup Source Filter section.

Schedule

7. In the Schedule window, configure a backup schedule so backup jobs run automatically at your specified intervals.

   

   Slide the on/off button to turn the feature on, then click + Add new schedule and configure the settings in the New Backup Schedule window.

   

Destination

8. In the Destination window, select a backup destination for the backup data. Click the + icon before “Add new storage destination”.

   

   Select the storage destination.

   

   You can choose destinations such as Local / Mapped Drive / Network Drive / Removable Drive or cloud storage. Click OK when you are done with the settings.

   • If you chose Local / Mapped Drive / Network Drive / Removable Drive, select the Type. Click Change to browse to a directory path where backup data will be stored, or enter the path manually. Tick This share requires access credentials if credentials are needed. Click Test to validate the path; “Test completed successfully” is shown when validation is done.

   

   • If you chose cloud storage, click Test to log in to the corresponding cloud storage service.

   

   You can add multiple storage destinations. Backup data is uploaded to all of them, in the order you added them. Use the up and down icons to change the order. Click Next to proceed.

   

Encryption

9. In the Encryption window, Encrypt Backup Data is enabled by default with an encryption key preset by the system, which provides the most secure protection. Click Next when you are done.

   

10. If you enabled the encryption key feature in the previous step, the following pop-up window is shown, whichever encryption type you selected.

    

    • Unmask encryption key — the key is masked by default; click to show it.
    • Copy to clipboard — copies the encryption key so you can paste it somewhere of your choice.
    • Confirm — exits the pop-up and proceeds to the next step.

    

    Important: write the encryption key down and keep it somewhere safe. Without it your backup data cannot be restored, and we cannot recover it for you.

Finishing up

11. This screen is displayed when the new Microsoft 365 backup set is created successfully. Click Backup now to back up your data, or Close to return to the main screen.

    

12. We strongly recommend changing the Temporary Directory to a location with sufficient free disk space other than drive C. Go to Others > Temporary Directory and click Change to browse to another location.

    

13. Optional: select your preferred compression type. By default the compression is Fast with optimisation for local. Go to Others > Compressions, then choose from No Compression, Normal, Fast (compressed size larger than normal) or Fast with optimisation for local.

    

    Click Save to apply the changes.

What can be restored

For the restore walkthrough itself, see Microsoft 365 Restore. This section covers what you get back.

Most Microsoft 365 data restores as it was backed up. A few things are limited by what Microsoft’s APIs allow, rather than by the backup software, so it is worth agreeing expectations before they are tested.

Restoring after a user is deleted

Microsoft keeps a deleted user recoverable for 30 days under Users > Deleted users in the Microsoft 365 admin centre. Within that window, restoring the user is quicker than restoring their data, and brings back the mailbox and OneDrive with it.

After 30 days the account is gone. Data cannot be restored into an account that does not exist, so you would recreate the user — which requires a licence — and restore into it, or restore the data to a different existing account if it only needs to be readable.

Note: Microsoft 365 retention, litigation hold and the recycle bin are not backups. They are time-limited, they can be cleared by an administrator, and they do not survive the tenant itself being lost. The backup set described in this guide is held separately from your tenant, which is the point of it.

What is not backed up

The backup software connects to Microsoft 365 using modern authentication and Microsoft’s current APIs, mainly Microsoft Graph. Basic authentication has been switched off by Microsoft, and some things the older APIs could reach are not available through the modern ones. The items below are skipped or only partly handled. Most appear in the backup log as a warning, not an error — the rest of the job completes normally.

Troubleshooting

For restoring from one of these backup sets, see Microsoft 365 Restore.

If you need a hand with any of the above, contact us at support@bobcloud.net.