Veeam Backup for Microsoft 365 API

The common use is a ticket from a failed Veeam Backup for Microsoft 365 job: the agent finds the job, reads its newest session and the log, starts it again, reads the next run, and closes the ticket or escalates it with the cause. It also reports licence and storage use per customer, and restores a lost email, file or Teams post to where it was once a technician signs in for the restore.

Automatically enabled when you configure Veeam Backup for Microsoft 365 permissions in your agent workflow.

What It Does

Read backup and backup copy jobs, their sessions, logs and each processed mailbox, OneDrive, site or team
Start, stop, enable and disable jobs, and change what they back up
Read organizations, their users, groups, sites and teams, and what each protects; resync an organization
Read licences used per organization, licensed users, and repository space
Open restore sessions, search backups, and restore items to their original place
Read repositories, proxies, the server’s version, health and events

Permission Groups

Group	Covers
Job Runs	Start and stop backup and copy jobs
Backup Jobs & Sessions	Backup and copy jobs, their sessions, logs and processed objects; enable, disable, create, change and delete jobs
Organizations & Protected Data	Organizations and their users, groups, sites and teams, synchronization and retention exclusions; protected users, groups, sites and teams
Search & Restore	Restore points, restore sessions and searches in them, item-level restores of mail, OneDrive, SharePoint and Teams data; data retrieval
Repositories & Proxies	Repositories and their usage, object storage, proxies and proxy pools, repository synchronization, maintenance and owner changes
Licensing & Monitoring	The licence, licensed users, licence use per organization, the server’s version, health and events
Settings, Operators & Credentials	Restore operators and roles, stored accounts, encryption keys, backup applications and accounts, notification and other settings

Access Profiles

Profile	What runs on its own	What asks a technician
Read Only	Every read	No write is allowed
Helpdesk	Reads, and starting, stopping or retrying jobs	A change to a job’s set-up (enable, disable, edit, delete) and a restore. Every other group stays read only
IT Admin	Every read and every write but the next column	A restore, and the server’s settings, operators and credentials
Full Automation	Every read and write	Only the writes that always ask (below)

Safety Controls

Control	Behavior
Always ask	These always need a technician’s approval, whatever the profile: a restore to another mailbox, OneDrive, site or email address; a data retrieval from archive storage; removing an organization or a repository; changing a repository’s owner; any change to restore operators, stored accounts, Azure service accounts, encryption keys or an organization’s backup applications and accounts; a full update of an organization, a backup proxy, or the proxy or notification settings; signing the server in to a mail account; submitting the licence usage report; and storing a credential, such as a password
Restore sign-in	A restore writes into the customer’s Microsoft 365. The agent gets a sign-in code from the server and a technician signs in with it; Neo never holds a Microsoft 365 password for the restore
Hidden credentials	Passwords, secrets, certificates with their private key and tokens read `[removed by Neo]` in every answer. Neo refuses any write that sends that text back
Full updates keep what they leave out	Before a full update of an organization, a backup proxy, or the proxy or notification settings, Neo reads the stored record and sends it with the agent’s changes on top, so a field the agent leaves out keeps its value. The server never returns some passwords (a proxy’s, the SMTP and proxy server’s), and a password the server shows masked counts as not returned. When such a password is in use, Neo does not send the update unless the agent includes the password, which a technician gives. Each such update asks a technician
Ticket scope	On a ticket, the agent reaches only the organization mapped to the ticket’s company, by a tenant or name match or one you confirmed. A call goes out only when Neo can tie it to that organization: a call under the organization’s own path, a job, session, restore point, protected object or restore session Neo reads as that organization’s, or a list Neo filters to it. Any other call, such as your repositories, proxies, licence or settings, is for runs with no ticket company, such as a scheduled check or a chat
Never sent	Neo never asks the server for a token, and does not download files: PST exports, saved items and reports
Your server	Neo sends the password only over HTTPS to the server address you saved, which must be a public address, and never follows a redirect

Getting started

Core

Triggered & Scheduled Agents

Chat Agents

Integrations

Product

Workflows

Customizing Neo

Veeam Backup for Microsoft 365 API

What It Does

Permission Groups

Access Profiles

Safety Controls

​What It Does

​Permission Groups

​Access Profiles

​Safety Controls

What It Does

Permission Groups

Access Profiles

Safety Controls