1. Support
  2. Knowledge base
  3. 100050078

How to Create Veritas Alta SaaS Protection connectors for Microsoft 365 / Exchange Mailboxes

Article: 100050078
Last Published: 2024-09-04
Ratings: 0 0
Product(s): Veritas Alta SaaS Protection

Description

 

This article describes how to configure settings specific to Exchange/Exchange Online connectors within the General and Advanced tabs of the connector properties. 

EWS connectors can be used to capture user mailboxes and public folders from Microsoft 365 and Exchange Server on premise versions 2010, 2013, or 2016.

This process only works when configuring the connectors via the Connector Service UI.  This will only apply to customers running the connector service on a server in an environment that they manage.  For all other Veritas managed customers, please refer to this article: How To Create an Exchange Connector in the NetBackup SaaS Protection (NSP) Administration Portal

Pre-requisites: 

  1. The connector must be created before these settings can be applied. For information on creating a connector, refer to the article:  How To Create Connectors In Veritas Alta SaaS Protection
  1. Steps outlined in the How to prepare a Microsoft 365 tenant for Veritas Alta SaaS Protection article must be completed.  

Configure Connector Type Specific Settings

General Tab:  
 
 
  1. Mode -- Choose from the following 4 modes based on the type of data to be captured with a specific connector.  A separate connector is required for Groups/Teams and Public Folders.  All User Mailboxes and Specific Mailboxes are for 1 connector.  
    1. All User Mailboxes --  Auto-discovers all mailboxes in the organization. Note that if the mailbox PrimarySMTPAddress changes, NSP will still recognize it as the same mailbox. This includes Shared mailboxes. 
    2. All Groups/Teams Mailboxes -- Captures all O365 Group mailboxes and Teams Mailboxes as they are all categorized under "Groups" when viewing the O365 Admin Center.  When choosing this option, enable the 'Get Location ACL's' option.  
    3. Specific Mailboxes -- When choosing this option, a new tab will be available called 'Specific Mailboxes' where SMTP addresses are manually entered by the user or can be imported from a file.  Note that if the PrimarySMTPAddress of the user subsequently changes, this will not be detected by NSP therefore, this address must be manually updated. 
    4. Public Folders --  The public folders associated with the user impersonation accounts configured in the 'EWS Auth' tab.  
  1. Management API -- By default, PowerShell has always been used to authenticate to O365.  This requires a valid user account that is in the Exchange admin role and has a minimum E1 license.  It also requires additional service accounts to deal with throttling.  The Microsoft Graph option is the preferred option as it simply requires the use of an Azure AD Application that allows authentication to the targeted workloads in O365.  This avoids having to rely on PowerShell and user licenses.  To configure this application, refer to the article:  How To Configure An OAuth Azure AD Application
  2. Use Sender and Recipients For ACL -- Overrides item ACLs from inheriting the parent folder ACL and instead assigns permissions based on the sender and recipient SMTP addresses.  This option is only available when choosing Public Folder mode.  For details on this option, refer to article:  Overview of 'Limit ACEs to Domains' Connector Setting
  3. Limit ACEs to Domains -- Filters the ACEs applied to the item based on the semicolon delimited list of approved domains.  This option is only available when enabling 'Use Sender and Recipients For ACL' and when choosing Public Folder mode. 
  4. Limit Subject as Item Name to N Characters -- Limits the length of the subject as used to populate the item name in NSP for display purposes in the Admin Portal and End User Portal. This setting is used avoid bloating the NSP database in high object count scenarios. Note that NSP always preserves the full non-truncated Subject in blob storage. 
  5. Process Recoverable Items -- If enabled, 'Recoverable Items' will be in scope for both the active and, if applicable, archive mailboxes. This setting cannot be enabled if 'Process System Folders' is true since the system folders include recoverable items. This setting is not available for public folders. This folder is used when items on Litigation Hold are deleted from a mailbox. 
  6. Process Archive Mailboxes -- If enabled, an 'Archive Mailbox' entry will be added containing the content of the archive mailbox. This setting is not available for public folders. 
  7. Process Soft-deleted Mailboxes -- If enabled, it will capture Soft-deleted mailboxes. This setting is not available for public folders. When 'Process Soft Deleted Mailboxes' option is enabled, ASP supports backup of only those soft deleted mailboxes which had any retention/hold policy applied prior to deletion.
  8. Process System Folders --  If true all folders (including hidden and system folders) are processed. This setting is not available for public folders. 
  9. Process as Journal Mailboxes -- If enabled, the Inbox of all mailboxes specified by the connector will have items containerized based on the date stamp. The structure is Inbox\YYYY\MM-DD\HH. This ensures that even massive journal mailboxes can be processed and not result in NSP folders that are difficult to render due to excessive item counts. This setting is not available for public folders. 
 
       Advanced Tab:
 
         
      
  1. Mailbox Type -- This will auto populate based on the Mode selected in the General tab.  
  2. Suppress Corrupt Message Error Logging -- If the crawler encounters an issue with specific email messages, those errors will be logged.  This option will suppress those errors from writing to the log.  A sample error would be:  "MIME content conversion failed". Typically this means there is an underlying issue with the message which prevents our process from reading it and thus will not capture it.  
  3. Log Retries to ewsdiagnostics.log -- This should only be enabled when instructed by Veritas support.  
 
       EWS Auth Tab:
 
      
      
      
  1. EWS Authentication Mode -- There are two modes to choose from: 
  2.    Basic -- This is the default setting where it utilizes service accounts that have been created as part of the How to prepare a Microsoft tenant for NetBackup SaaS Protection (NSP). 
  3.    Modern/OAuth -- This setting is used when the Microsoft Graph mode is selected on the General tab.  The fields are populated with information after creating the Azure AD Application (as previously mentioned). 
  4. Choose either 'Use Autodiscovery' or 'Manually Set EWS URL' based on the O365 configuration.  
  5. When choosing the mode 'All Groups/Teams Mailboxes', it is required to configure impersonation accounts.  Click on the red text to enter the SMTP addresses for at least 1 account. They do not need any elevated permissions/roles but do require a mailbox.  To avoid having to assign a license, using a Shared Mailbox will also work.  
  6. If this is for an Exchange Server on Premise, it is required to choose the appropriate option from the 'Advanced'  button under the EWS URL section.  Note: choosing the Exch2016 option does not work. Instead, choose the Exch2013sp1 option. 
 
       PowerShell Auth Tab:
      
 
  1. This tab is only available when choosing PowerShell as the Mode in the General tab
  2. Enter the SMTP address in the 'User Name' field and password for a user in either of the following roles:  Exchange Admin or Global Admin 
  3. In the 'PowerShell  URL' field, choose from either of the two options:  'Use On-prem Default' or 'Use O365 Default'. 
  4. If this is for an Exchange Server on Premise, it is also required to choose the appropriate option from the Advanced button. 
Microsoft Graph Auth Tab:
 
 
  1. This tab is only available when choosing Microsoft Graph as the Mode in the General tab
  2. The required information is obtained from the Azure AD Application as mentioned previously.  
 
       User Filter Tab: 
 
      
  1. This tab is only available when the Mode 'All User Mailboxes' is selected on the General tab.  
  2. This tab allows filtering of mailboxes based on an extended AD attribute.  This filtering can take the form of an exact match, a wildcard match, or even a regular expression.  In the example above, the connector will match those users whose ‘department’ is either Engineering, or something like ‘Executive’, which would match the regex specifies. 
      
        Mailbox Scope Tab: 
 
      
       
  1. This tab is only available when the Mode 'All User Mailboxes' is selected on the General tab.
  2. Mailbox Scopes are used for very large user email environments where there is potential to fill up a single Stor database.  In this scenario, the NSP Connector Service can leverage scopes to alleviate this by using multiple EWS (all user mailboxes mode) connectors which can "load balance" and each capture certain mailboxes and assign the data to specific Stors. 
    1. No Mailbox Scope (all mailboxes) -- There is no change with this setting. The crawl will capture all mailboxes.
    2. Rolling Mailbox Scope -- The connector will only process the specified number of mailboxes.  Once a mailbox has been assigned to a rolling connector, it will forever be bound to that connector.  When a rolling connector has room to process additional mailboxes (i.e. the number of currently bound mailboxes is less than the # Mailboxes for this Instance) it uses the API to prune all mailboxes already bound to any other connector in any other Stor.  Thus a mailbox will only be bound to a single connector in the entire environment. 
    3. Alphabetical Mailbox Scope -- The connector will process mailboxes based on the first letter of the SMTP address.  This is the preferred mode for multi-instance, since it allows a better organization of which mailboxes are in which connectors, and an easier admin browsing experience.  
    4. Restrict Mailboxes With Specific Domains -- This option allows for capturing mailboxes that have email addresses from specific domains.  It also works in conjunction with any other scoping or AD attribute restrictions.  
 
 

Was this content helpful?

Article Languages