> ## Documentation Index
> Fetch the complete documentation index at: https://docs.neoagent.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Veeam Backup for Microsoft 365 API

> Work Microsoft 365 backup tickets: read the failed session, rerun the job, check the next run; report licences and storage; restore lost items with approval

The common use is a ticket from a failed Veeam Backup for Microsoft 365 job: the agent finds the job, reads its newest session and the log, starts it again, reads the next run, and closes the ticket or escalates it with the cause. It also reports licence and storage use per customer, and restores a lost email, file or Teams post to where it was once a technician signs in for the restore.

> [!NOTE]
>
> Automatically enabled when you configure Veeam Backup for Microsoft 365 permissions in your agent workflow.

## What It Does

* Read backup and backup copy jobs, their sessions, logs and each processed mailbox, OneDrive, site or team
* Start, stop, enable and disable jobs, and change what they back up
* Read organizations, their users, groups, sites and teams, and what each protects; resync an organization
* Read licences used per organization, licensed users, and repository space
* Open restore sessions, search backups, and restore items to their original place
* Read repositories, proxies, the server's version, health and events

## Permission Groups

| Group | Covers |
| - | - |
| Job Runs | Start and stop backup and copy jobs |
| Backup Jobs & Sessions | Backup and copy jobs, their sessions, logs and processed objects; enable, disable, create, change and delete jobs |
| Organizations & Protected Data | Organizations and their users, groups, sites and teams, synchronization and retention exclusions; protected users, groups, sites and teams |
| Search & Restore | Restore points, restore sessions and searches in them, item-level restores of mail, OneDrive, SharePoint and Teams data; data retrieval |
| Repositories & Proxies | Repositories and their usage, object storage, proxies and proxy pools, repository synchronization, maintenance and owner changes |
| Licensing & Monitoring | The licence, licensed users, licence use per organization, the server's version, health and events |
| Settings, Operators & Credentials | Restore operators and roles, stored accounts, encryption keys, backup applications and accounts, notification and other settings |

## Access Profiles

| Profile | What runs on its own | What asks a technician |
| - | - | - |
| **Read Only** | Every read | No write is allowed |
| **Helpdesk** | Reads, and starting, stopping or retrying jobs | A change to a job's set-up (enable, disable, edit, delete) and a restore. Every other group stays read only |
| **IT Admin** | Every read and every write but the next column | A restore, and the server's settings, operators and credentials |
| **Full Automation** | Every read and write | Only the writes that always ask (below) |

## Safety Controls

| Control | Behavior |
| - | - |
| **Always ask** | These always need a technician's approval, whatever the profile: a restore to another mailbox, OneDrive, site or email address; a data retrieval from archive storage; removing an organization or a repository; changing a repository's owner; any change to restore operators, stored accounts, Azure service accounts, encryption keys or an organization's backup applications and accounts; a full update of an organization, a backup proxy, or the proxy or notification settings; signing the server in to a mail account; submitting the licence usage report; and storing a credential, such as a password |
| **Restore sign-in** | A restore writes into the customer's Microsoft 365. The agent gets a sign-in code from the server and a technician signs in with it; Neo never holds a Microsoft 365 password for the restore |
| **Hidden credentials** | Passwords, secrets, certificates with their private key and tokens read `[removed by Neo]` in every answer. Neo refuses any write that sends that text back |
| **Full updates keep what they leave out** | Before a full update of an organization, a backup proxy, or the proxy or notification settings, Neo reads the stored record and sends it with the agent's changes on top, so a field the agent leaves out keeps its value. The server never returns some passwords (a proxy's, the SMTP and proxy server's), and a password the server shows masked counts as not returned. When such a password is in use, Neo does not send the update unless the agent includes the password, which a technician gives. Each such update asks a technician |
| **Ticket scope** | On a ticket, the agent reaches only the organization mapped to the ticket's company, by a tenant or name match or one you confirmed. A call goes out only when Neo can tie it to that organization: a call under the organization's own path, a job, session, restore point, protected object or restore session Neo reads as that organization's, or a list Neo filters to it. Any other call, such as your repositories, proxies, licence or settings, is for runs with no ticket company, such as a scheduled check or a chat |
| **Never sent** | Neo never asks the server for a token, and does not download files: PST exports, saved items and reports |
| **Your server** | Neo sends the password only over HTTPS to the server address you saved, which must be a public address, and never follows a redirect |


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.