Skip to main content
You connect each Veeam Backup for Microsoft 365 server once, at the MSP level. One account covers every Microsoft 365 organization the server backs up.

​
Before you start

  • Neo works with Veeam Backup for Microsoft 365 version 8 or later (REST API v8).
  • The REST API must be on: in the console, open General Options → REST API and select Enable REST API service. It listens on port 4443 by default.
  • Neo reaches the server over the internet. The REST API must answer on HTTPS with a certificate from a public certificate authority, at a public address. The self-signed certificate the server makes by default is not enough.

​
If the server is only on your internal network

Publish only the REST API, never the whole server. Put a reverse proxy at your network edge that:
  • answers on a public name over HTTPS, with a certificate from a public certificate authority;
  • forwards only paths under /v8/ to the server’s REST API (port 4443 by default), and refuses every other path;
  • accepts connections only from Neo’s addresses;
  • passes the Authorization header and the request body through unchanged.
Save the proxy’s public address in Neo. A server at a customer’s site that you cannot publish this way cannot be connected yet.

​
1. Create an account for Neo

1

Create the account

Create an account for Neo, such as neo-agent, that can sign in to Veeam Backup for Microsoft 365 as an administrator: a domain account or a local account on the server that is a member of its local Administrators group.
2

Keep its password

Neo signs in with the account’s user name and password, as DOMAIN\neo-agent or neo-agent@domain. Neo stores the password in its key vault and never shows it again.
If the account is disabled or its password changes, Neo loses access until you save the new password here.

​
2. Add the account in Neo

1

Open Integrations

In the Neo Dashboard, open Integrations → Veeam Backup for Microsoft 365, under Backup & Recovery. A search for “VB365”, “VBO” or “Veeam Backup for Office 365” also finds it.
2

Save the address, user name and password

Enter the REST API’s address with its port (for example https://vb365.example.com:4443), the user name and the password, then click Save settings. Neo signs in and reads the server’s version before saving, so a wrong address or a refused account is rejected straight away.

​
3. Turn it on per agent

Open the agent, go to its Tools & Settings tab, click Backup & Recovery, and expand the Veeam Backup for Microsoft 365 block. Pick one of its Presets, or set each area yourself: The writes that always ask, whatever the preset, are listed under Safety Controls on the Veeam Backup for Microsoft 365 API page.

​
Use it on backup tickets

Veeam Backup for Microsoft 365 emails a job’s result to the addresses in its notification settings, which is how most MSPs open backup tickets in their PSA. An agent that triggers on those tickets finds the job, reads its newest session and the log, starts it again when the cause passes, and reads the next run before it closes or escalates the ticket. Map each organization on the Organization Mapping tab first, and make sure your PSA files each backup ticket under the customer’s company: on a ticket, the agent reaches only the organization mapped to the ticket’s company.

​
Restores

A restore writes into the customer’s Microsoft 365, so it needs a sign-in there that Neo does not hold. The agent finds the item, asks the server for a sign-in code, and gives a technician the code and the Microsoft sign-in page. The technician signs in with an account that may restore in that customer’s tenant and replies; the agent then restores the item to where it was and reads the result. A restore to another mailbox, OneDrive, site or email address always asks a technician first. See Veeam Backup for Microsoft 365 API for what the agent can read and change.