> For the complete documentation index, see [llms.txt](https://helpdesk.augmentt.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://helpdesk.augmentt.com/back-up/microsoft-365-backup.md).

# Microsoft 365 Backup

Microsoft 365 doesn't give you a real backup. The recycle bin and native retention tools have short windows and gaps — they aren't built to recover from ransomware, a bad admin action, an offboarding mistake, or a retention policy nobody remembered to set. Augmentt's Back-Up module (delivered through our backup partner, CloudAlly) automates a daily, independent backup of your M365 mailboxes so you can go back to a specific point in time.

{% hint style="info" %}
Backup tasks are managed in the dedicated backup portal, reached from the **Backup** link in the Augmentt navigation — it's a separate login from the main Augmentt console.
{% endhint %}

## What's backed up

The Microsoft 365 Exchange backup task covers, per mailbox:

* Mail
* Calendar
* Contacts
* Tasks
* Notes

{% hint style="warning" %}
Augmentt also sells broader "MS 365 Bundle" backup plans (billed per user) that are referenced on invoices and in sales material as covering "comprehensive Microsoft 365 backup" — which typically implies OneDrive and SharePoint alongside Exchange in a CloudAlly-style bundle. The source documentation pulled for this page only detailed the **Exchange** backup task specifically. If a customer is on a bundle plan and asks what's covered beyond mail/calendar/contacts/tasks/notes, confirm the exact scope with support or the account's plan details rather than assuming — don't state OneDrive/SharePoint/Teams coverage as fact until it's verified against the actual task types available in the portal.
{% endhint %}

## Setting up a backup task

1. In the backup portal, click **+ Add Backup Task**.
2. Choose **Microsoft Exchange**.
3. Name the task.
4. Click **Authenticate**, then sign in with a **Global Admin** account when redirected to the Microsoft sign-in page.
5. You'll land on the Backup Settings page to configure indexing, retention, and activation (below).

{% hint style="warning" %}
The account used to authenticate must have Global Admin permissions. A lower-privileged admin role will not complete setup.
{% endhint %}

Credential-based authorization (as opposed to OAuth) exists but is off by default and isn't recommended — only use it if support has specifically set it up for you.

## Activating mailboxes

You don't have to activate every mailbox manually. Options, from the Bulk Activation and Management screen:

* **Activate by directory property** — set a condition (e.g. a specific department or license type) and either activate the matching accounts once, or set a standing rule that auto-activates any *new* account matching that condition going forward.
* **Activate by Microsoft 365 Groups** — select specific groups to back up.
* **Import a list of accounts** — upload a CSV with an `Account Email` column.
* **Automatically activate new mailboxes** — a task-level toggle that detects and starts backing up new mailboxes as they're created, with no rule needed.

By default, **Unlicensed** Microsoft 365 accounts (external guest accounts, auto-generated shared-storage accounts, etc.) are not backed up. You can opt them in via **Backup Unlicensed accounts**, but be cautious about using an unlicensed *admin* account for anything — unlicensed accounts carry limited permissions.

## Backup frequency and schedule

| Setting          | Options                     |
| ---------------- | --------------------------- |
| Backup hour      | Any hour, in UTC            |
| Backup frequency | Daily, Every 3 Days, Weekly |

More frequent backups than the standard options are possible — this requires a support request, not a self-service setting.

## Retention

* Default retention is **unlimited for as long as the subscription is active**.
* You can request a **defined retention period** (in days, months, or years) instead, via a support ticket — backups older than the configured window are then automatically deleted. This is not adjustable directly in the task settings UI.
* When an entire mailbox/site is deleted upstream, its backups are auto-archived rather than dropped immediately. You can set **Retain auto-archived backups** to a specific number of days, after which they're deleted — or leave them retained indefinitely.

{% hint style="info" %}
Your backup storage region is fixed once set during account signup and can't be self-service changed. If you need to move regions, or want to explore Bring Your Own Storage (BYOS), contact support.
{% endhint %}

## Restoring data

{% hint style="warning" %}
Step-by-step restore instructions (single item vs. full mailbox restore, restore-to-original vs. restore-to-a-different-mailbox) weren't confirmed in the source material for this page. Confirm the current restore flow in the backup portal, or with support, before walking a customer through a live recovery.
{% endhint %}

What is confirmed:

* **Index all data for search** (on by default) is what enables granular, item-level search and restore. Disabling it limits you to browsing backups by date rather than searching within them. Indexing briefly decrypts data to build the search index, then re-encrypts both the data and index — if that's a policy concern, disable indexing and rely on date-based browsing instead.
* **Public Folders** have a distinct restore behavior: a restore creates a *sub-folder* of restored content, which you then have to manually add back as a Public Folder through the normal Exchange Online Public Folder creation process (including any nested sub-folders that came along with the restore). It doesn't restore in place automatically.
* To back up a Public Folder at all, the admin account used for the backup connection needs a mail-enabled Microsoft 365 license and read/write permission on that Public Folder's root permissions (set from the Exchange Admin Center).

## Common limitations

* Unlicensed accounts are excluded from backup by default.
* Public Folder restores land in a new sub-folder, not back in their original location automatically.
* Once the backup storage region is chosen, changing it isn't self-service.

### Microsoft's EWS-to-Graph API migration (2026)

This is a real, dated platform change worth knowing if you support Exchange backup customers:

{% hint style="warning" %}
Microsoft is retiring the Exchange Web Services (EWS) API that older Exchange/Groups/Teams backup tasks were built on. EWS deprecation began gradually on **June 30, 2026**, with full retirement on **October 1, 2026**. Backup tasks are being migrated to the Microsoft Graph API in this window, and tasks flagged for migration need to be **reauthorized** (Backup Task Settings > reauthorize) to grant the new Graph permissions.
{% endhint %}

What this means in practice:

* Backups **keep running on EWS** while a task shows the reauthorization prompt — the prompt itself doesn't mean backups have stopped. Reauthorization status is tracked independently of backup health status.
* After reauthorization, migration to Graph happens gradually in the background — no further action needed.
* Customers on **Kiosk, F1, or F3** Microsoft licenses are affected earlier, since Microsoft disables EWS for those license types on June 30, 2026, ahead of the general October 1 cutoff.
* **Coverage gap to flag:** the Microsoft Graph API does not yet support all Exchange data types. Once a task is migrated to Graph, **Exchange Online Archive** and **Public Folders** are no longer included in *new* backups going forward. Backups taken previously under EWS remain accessible — this only affects what gets captured after the migration.
* Customers who don't reauthorize promptly continue to be protected under EWS until Microsoft's hard October 1, 2026 cutoff — but should not wait, since EWS won't exist as a fallback after that date.

If a customer reports "my Exchange Archive or Public Folder stopped showing up in new backups," check whether that mailbox's task has already migrated to Graph — this is the expected (if disruptive) behavior of the migration, not a bug.

{% hint style="info" %}
Running into trouble — disconnected task, a reauthorization banner, or missing Archive/Public Folder content? See [Microsoft 365 Backup Troubleshooting](/troubleshooting/microsoft-365-backup-troubleshooting.md) in [Troubleshooting](/troubleshooting.md).
{% endhint %}