Microsoft 365 backup guide
Connect and back up Microsoft 365
A clear guide for Microsoft 365 administrators: approve Backup247 once, choose Exchange Online mailboxes, and keep mail, calendars and contacts recoverable.
Last updated
Your organization does not need to register a Microsoft app or create client secrets. Backup247 operates one verified multi-tenant app. A Global Administrator or Privileged Role Administrator signs in once, reviews the requested permissions and approves access for the organization. Backup247 then stores only the tenant ID and uses that approval for scheduled backups.
Who can connect
The person approving the connection must sign in with a Global Administrator or Privileged Role Administrator account from the Microsoft 365 tenant you want to protect. The approval normally takes about one minute.
You do not install software in Microsoft 365 and you do not create an Entra app. Backup247 has already completed that operator setup. Each mailbox you back up must have an Exchange Online licence and be available through Microsoft Graph.
- Use an admin account from the correct Microsoft 365 tenant.
- Have organization-wide consent available in the Microsoft approval screen.
- Confirm that the mailboxes you need have Exchange Online licences.
- If you are not an admin, ask your IT administrator to perform the approval.
Step-by-step connect
Open Backup247, go to Connectors, choose Microsoft 365 (Exchange), and click Connect with Microsoft.
Microsoft handles the sign-in and approval:
- 1. Sign in. Use your Microsoft Global Administrator or Privileged Role Administrator account.
- 2. Review permissions. Microsoft shows the permissions requested by the Backup247 app.
- 3. Approve for the organization. Select “Consent on behalf of your organization” and click Accept.
- 4. Return to Backup247. You are sent back automatically and can choose which mailboxes to back up.
Backup247 stores only the Microsoft tenant ID for this connector—never your admin password, a client secret or a delegated user token.
Choosing mailboxes
| Choice | Best for | New mailboxes |
|---|---|---|
| Individual mailboxes | A fixed, limited set | Select them manually |
| Whole tenant | Protecting every eligible mailbox | Included automatically |
Shared and disabled accounts remain visible and are labelled. If an account has no Exchange Online mailbox or licence, its backup fails with a specific message instead of silently skipping it.
What is backed up and what is not
Each selected Exchange Online mailbox is backed up independently. You can browse snapshots and export them even before you need a restore.
Mail and attachments
All normal mail folders, including nested and hidden folders, message metadata, complete MIME messages and file attachments.
Calendars
Calendars, events and supported file attachments.
Contacts
Default contacts and nested contact folders.
Not included
Archive mailboxes, public folders, Microsoft 365 group mailboxes, OneDrive, SharePoint, Teams, contact photos and separately stored recurring-event exceptions.
See the connector details on the Microsoft 365 connectors page, or compare plans on pricing.
Restoring
A restore always returns data to the original mailbox and creates new containers. Existing mail, calendars and contacts are never changed or overwritten.
- Mail. Backup247 creates a new top-level “Restored from … (Backup247)” folder and rebuilds the selected folder tree beneath it.
- Calendars. Each backed-up calendar is restored as a new calendar. Meeting attendees are not re-invited; organizer, attendee and meeting-link details are added to the event description.
- Contacts. Backup247 creates a new contact folder and recreates the backed-up contact-folder tree inside it.
Restricting and revoking access
- To limit Backup247 to selected mailboxes, create a mail-enabled security group and add only the mailboxes you want to protect.
- Application Access Policy example: New-ApplicationAccessPolicy -AppId <Backup247 app id> -PolicyScopeGroupId backup-mailboxes@contoso.com -AccessRight RestrictAccess
- Microsoft now recommends RBAC for Applications for new Exchange Online access restrictions; use it instead of an Application Access Policy where your tenant supports it.
- After changing an access policy, allow time for Microsoft to apply it, then refresh the mailbox list and run a test backup.
- To revoke access, open Entra admin center → Enterprise applications → Backup247, then remove the app or its granted permissions. Future backups and restores stop immediately.
Troubleshooting
Microsoft says I am not an administrator+
Sign out of other Microsoft accounts, then reconnect with a Global Administrator or Privileged Role Administrator account from the tenant you want to protect. If you are not an admin, send the connection instructions to your IT administrator.
I cancelled the Microsoft approval+
Nothing was connected and no access was granted. Return to the Microsoft 365 connector and try again when you are ready.
A user has no Exchange Online licence+
Assign an Exchange Online licence and wait for the mailbox to become available, then refresh the mailbox list. Accounts without a Graph-accessible mailbox cannot be backed up.
A mailbox reports ErrorAccessDenied+
An Exchange Application Access Policy or RBAC for Applications assignment is blocking Backup247. Add that mailbox to the allowed scope, or remove the restriction, wait for Microsoft to apply the change and retry.
Protect your Microsoft 365 mailboxes
Connect your tenant, choose the mailboxes that matter, and verify your first Exchange Online backup.