Veeam Backup for Microsoft 365: step-by-step deployment (architecture, immutable storage, restore)

The short answer: a successful Veeam Backup for Microsoft 365 deployment depends less on the installation than on the decisions made before it. Where will the data be stored? For how long? With what immutability? Two of those choices cannot be changed on the repository concerned: the retention type and immutability. The installation itself follows a simple order: server and proxy, PostgreSQL database, Microsoft 365 organization, object repository, backup jobs, then a restore test.

At ALLSAFE SOLUTIONS, a Veeam partner in Morocco, we deploy and monitor this tool from Casablanca. The figures and limits in this guide come from Veeam’s version 8 user guide (build 8.6 when we checked it in November 2026), its best practice guide and its licensing policy. Check them against the documentation for the version you install. If you are still unsure whether you need this kind of backup, start with the Microsoft 365 shared responsibility model.

What the tool protects, and what it leaves out

Check the scope before buying: several kinds of data that people assume are covered are not.

Service	Backed up	Not backed up (per Veeam’s guide)
Exchange Online	User, shared and archive mailboxes, public folders under IPM_SUBTREE	Sharing permissions on folders and calendar
OneDrive and SharePoint	OneDrive accounts, sites, libraries	Recycle bin, external lists, archived sites, Loop-created sites, sensitivity labels
Teams	Teams, channels, posts, certain tabs	One-on-one and group chats, calls, contacts, meeting details

Two points to raise at the scoping stage. OneNote notebooks over 2 GB are not guaranteed, and app-only authentication rules out OneNote restores according to Veeam’s KB3146. Entra ID is a separate line in Veeam’s licensing policy: plan its protection separately if losing your identities and access policies is a concern.

The building blocks

Component	Role	Keep in mind
Backup server	Manages the infrastructure and jobs	Windows only
Backup proxy	Performs reads and writes	Windows or Linux; several possible
Proxy pool	Groups several proxies	Communication handled by NATS
PostgreSQL	Central configuration database, object repository cache	Local or remote; SSD recommended
Object repository	Stores backups and copies	Only type accepted for copies and immutability
JET repository	Stores backups on disk	Local, DAS, SAN or SMB NAS
Veeam Explorers	Browse and restore data	Included with no separate licence

For an SMB, the server and a proxy can start on the same virtual machine. Veeam nevertheless recommends installing third-party components (PostgreSQL, NATS) on other machines, and a dedicated PostgreSQL instance. That separation becomes useful as object counts grow.

Prerequisites to gather before installing

Item	Requirement published by Veeam (version 8)
Backup server	8 cores, 16 GB of memory (32 GB with dynamic memory), 3 GB for the product
Proxy	4 cores, 16 GB of memory (32 GB with dynamic memory)
Windows	Windows Server 2016, 2019, 2022 or 2025; Windows 10 and 11 in the listed versions
Linux proxy	RHEL 8.8 to 9.6 and Ubuntu 20.04, 22.04 or 24.04 LTS, per the vendor’s list
Database	PostgreSQL 15 (15.9 or later) or 16 (16.4 or later); SSD with at least 5,000 IOPS recommended
Software components	.NET 8.0 Runtime, .NET Framework 4.7.2; PowerShell 7.4.2 or later for PowerShell use
Ports	9193 (proxy and server), 4222 (NATS), 5432 (PostgreSQL), 9191 (REST and PowerShell), 9194 (Explorers and portal), 443 (cloud)

For sizing, the best practice guide reasons in objects rather than terabytes. A proxy with 8 cores and 32 GB should be able to handle 20,000 objects. The vendor quotes throughput of 8 MB/s per core for Exchange and 5 MB/s per core for SharePoint, and notes a Microsoft egress limit of 400 GB per hour. It also states that two proxies with 4 cores and 16 GB are more efficient than a single one with 8 cores and 32 GB. To estimate volume, use Veeam’s official calculator rather than a rule of thumb.

The deployment, in order

1. Prepare the tenant. Clean up unused accounts, list shared mailboxes and check admin security, using the 10 settings to apply on Microsoft 365.
2. Install the server. The wizard checks prerequisites and asks for the data location and the PostgreSQL and NATS configuration. With no database prepared, it installs PostgreSQL locally.
3. Add a proxy if the server does not fill that role, then a pool if you use several.
4. Add the organization. Signed in with a Global Administrator account, the wizard creates an Entra application or reuses an existing one. In version 8, modern app-only authentication is the only option for adding a Microsoft 365 organization.
5. Check the permissions: Microsoft Graph, Exchange (full_access_as_app, Exchange.ManageAsApp) and SharePoint (Sites.FullControl.All). The Global Reader role is used to detect shared mailboxes correctly.
6. Create the object repository, with immutability and retention type decided in advance.
7. Create the backup jobs, starting with a small pilot batch, then expand.
8. Add a copy job to a second object repository.
9. Connect alerts to your monitoring and actually restore data.

Choosing the repository: object rather than JET

Veeam accepts Amazon S3, S3-compatible storage, Azure Blob, IBM Cloud Object Storage and Wasabi as object repositories. The best practice guide recommends object storage and advises against SMB shares, whose support the user guide says will be dropped in future versions.

Choosing an object repository has three practical consequences:

• Backup copy requires it. The source and target of a copy must be object repositories, use the same proxy or pool and the same retention type.
• Archive classes are reserved for copies. S3 Glacier and Azure Blob Archive are not supported for direct backup.
• There is no way back. Data can move from a JET repository to an object repository, not the reverse.

The hosting location also deserves a written decision. If the repository sits outside Morocco, see what that implies in our guide on transferring data outside Morocco and the CNDP. For an on-site repository, make sure a copy stays off site, following the 3-2-1 rule and immutable backup.

Retention and immutability: the two final settings

The retention type is set at repository level and cannot be changed afterwards:

Type	How it works	Better suited to
Snapshot-based	Keeps an item’s state as long as a restore point within retention contains it	Recovering the full state of a mailbox at a given date
Item-level	Removes an item when its creation or last modification date exceeds the period	Retention calculated on the age of each item

Immutability is available on Amazon S3, S3 Glacier, S3-compatible storage and Azure Blob. It applies to both backups and copies. A few rules to know before ticking the box:

• It is enabled when adding the repository, never later, and cannot be disabled.
• On S3, Object Lock and Versioning must be active from bucket creation.
• The duration follows either a chosen number of days or the repository’s retention period.
• Compliance mode is the default; governance mode remains an option.
• With snapshot-based retention, Veeam automatically adds 10 days for backups and 30 days for copies. That data therefore occupies space for longer: factor it into the storage budget.

Veeam also documents 256-bit AES data encryption. Keep the encryption password in a separate vault, accessible even if the backup environment is down.

Scheduling and the first backup

The wizard offers a daily run at a set time or a periodic run every N minutes or hours. A backup window can stop a job that overruns it, and a grid lets you stagger start times within the hour so several jobs do not start together. Retries on failed objects are configured separately.

Microsoft throttling mainly affects the initial full backup. It shows up as HTTP 500 or 429 errors, to look for in the logs under C:\ProgramData\Veeam\Backup365\Logs. For Exchange Online, the best practice guide mentions a possible temporary lift of per-mailbox limits through Microsoft 365 self-service help, for up to 90 days. On a modest internet link, start in batches and run the first backup outside office hours.

Restore: Explorers and the portal

The Veeam Explorers for Exchange, SharePoint, OneDrive and Teams come with the product. For Exchange, they can send an item by email, to the original mailbox or another recipient, and export data. The self-service Restore Portal needs its own Entra application and is enabled in the general options. Veeam calls for a separate REST installation and application per Entra region if your organizations span several regions.

A backup is only proven by a successful restore. Test at least one email, one OneDrive file, one SharePoint file and one Teams post, then record the result using our restore testing method.

Licensing: what to count

• Unit: per user account, with a minimum of 10 users, by subscription or rental under Veeam’s policy.
• No licence needed: shared, resource and group mailboxes, external SharePoint users. The guide specifies that a shared mailbox licensed in Microsoft 365 consumes a unit.
• Consumption: a unit is only counted when the object has a restore point from the last 31 days. Restores consume none.
• Community Edition: up to 10 accounts, 1 TB of SharePoint and 10 teams, useful for a trial.

Veeam Backup for Microsoft 365 is purchased separately from Veeam Data Platform, as explained in our Veeam buying guide for Morocco. ALLSAFE SOLUTIONS supplies these licences to businesses, with or without installation.

The mistakes we see most often

1. Choosing retention by reflex, without knowing it can no longer change on that repository.
2. Forgetting immutability at creation of the bucket or repository.
3. Promising a backup of “all of Teams”, when private chats are out of scope.
4. Placing the backup server in the same admin domain as the accounts it protects, with no separation or MFA. Our key Veeam settings cover this separation.
5. Launching the whole tenant at once, then reading throttling as a failure.
6. Never restoring, and discovering an unusable repository or password on the day of the incident.

Go-live checklist

• Accounts, shared mailboxes and SharePoint sites listed.
• Legal and business retention written down, retention type chosen.
• Server, proxy and PostgreSQL sized on object count.
• Entra application created, permissions checked, admin account protected by MFA.
• Immutable object repository and a copy to a second repository.
• Encryption password kept outside the backup environment.
• Backup windows and retries configured, alerts connected.
• Test restores performed and recorded.

How we do it

We start with a free initial audit: tenant, volumes, critical data and retention constraints. We then agree the retention, immutability and storage location with you, before deploying the infrastructure and performing a first restore in front of you. Backups then enter our 24/7 monitoring, with critical incidents handled in under 15 minutes.

This deployment fits into our backup and business continuity offering and our managed Microsoft 365 cloud, alongside our work as a Microsoft partner. Browse our case studies, then request your free initial audit: we reply within 24 business hours.