Configuring a tenant for Microsoft 365

Last published : Apr 02, 2026
To backup and restore Microsoft 365 data, a tenant must be added in Backup Exec. You can configure, update, and delete a tenant.
To configure a tenant for Microsoft 365
  1. On the Backup and Restore tab, in the Servers and Virtual Hostsgroup, clickAdd.
  2. Select Add Microsoft 365 Tenant.
  3. In the Configure Tenant wizard, select the appropriate region where the tenant exists.
  4. (Optional) To protect public folders, in Public Folders Administrator , specify the User Principal Name (UPN).
The UPN must have administrative access to the entire Public Folders hierarchy starting at the root level. The UPN is validated when the backup job is created, during backup browse of the public folder.
For Exchange Online, use the PowerShell script from the following link to ensure that the specified UPN has Owner-level permissions on the root public folder (IPM_SUBTREE) and its subfolders.
https://aka.ms/PFPermissionScript
  1. Click Next.
  2. Select the workloads that you want to configure for the tenant.
    Note: You must select at least one workload.
  3. Select the check box and click Next.
  4. To configure Microsoft 365 tenant, logon to the tenant with global administrator credentials.
Perform the steps in the following order:
  • Click Copy Code to copy the device code.
The device code expires after 15 minutes. Ensure that you complete the logon process before the code expires.
Note: If the code expires, click theRefresh Codelink for a new device code.
  • Click the authentication link.
https://microsoft.com/devicelogin
  • Paste the device code.
  • Enter the global administrator credentials and complete the login process.
  • After the login process is completed, return to the Configure Tenant wizard.
  1. After the authentication is completed successfully, select the check box and then click Next.
Azure Active Directory applications are registered in the Azure Active Directory for the tenant. Global administrator privileges are used to grant permissions to the Azure Active Directory applications to backup and restore Microsoft 365 data.
Backup Exec does not save the global administrator credentials. For backup and restore between Backup Exec and tenant, certificate-based authentication is used.
  1. Click Finish.
The tenant is added. The tenant properties list the type of tenant, tenant ID, and AuthCookie details. Backup Exec raises alerts when the certificates are due for expiration. You must update the tenant configuration to renew the certificates.
For Teams, after you configure the tenant, Channel Posts are backed up using Microsoft Graph Export APIs. These are metered APIs and require additional cost.
To view tenant details
  1. Right-click the tenant name and then click Details.
  2. In the left pane, select the details that you want to view.
To update the tenant configuration
  1. Right-click the tenant name and then click Update.
  2. Select the configuration that you want to update.
    • Update Configuration-Update Public Folder Administrator-Delete Public Folder Administrator-Add Application-Delete Application
  3. If you selectUpdate Configuration , you can select any additional workloads for the tenant and then select the check box.
The tenant is configured for the existing and selected workloads.
  1. If you select Add Application , specify the number of additional applications that you want to create.
You can only use the additional applications for SharePoint Online. These applications are only assigned SharePoint API permissions.
Backup Exec displays the maximum number of applications that you can create. The applications help to reduce throttling during backup and restore operations and to improve the backup and restore performance of SharePoint data.
  1. If you select Delete Application , specify the number of applications that you want to remove.
Only the applications added during the add application workflow with SharePoint API are deleted.
Backup Exec displays the number of application that you can remove.
  1. Click Next.
  2. Perform the same steps to update the tenant using the global administrator credentials.
After the applications are created, you can view the list by going into the tenant properties and click Fetch details.
To delete the tenant configuration
  1. Right-click the tenant name and then click Remove.
If you remove the tenant, all the jobs that are associated with the tenant are deleted.
  1. Click Yes.
  2. Perform steps to delete the application that is registered when you added a new tenant, using the global administrator credentials.
Related information