What you will set up
BackupZit reads a Microsoft 365 tenant through Microsoft Graph with an app registration that has read-only permissions: nothing in the tenant is changed or deleted. Any BackupZit agent with internet access downloads the data — for example the agent on the console machine — and stores it like every other backup: deduplicated, encrypted, with retention, copy jobs and restore tests. BackupZit is free and open source (AGPLv3), with no per-user licences.
Why a separate copy of Microsoft 365?
Microsoft keeps the service running, but the data in it is your responsibility: a mailbox deleted by mistake, files encrypted through a synced OneDrive, or an account removed when someone leaves the company. Recycle bins and retention settings live inside the same tenant and expire. A backup on your own storage is an independent copy that you control, outside the tenant and its admin accounts.
Microsoft and other vendors also sell Microsoft 365 backup as a cloud service, usually billed per user or per gigabyte. BackupZit is the self-hosted option: the data lands on your NAS, server or S3 bucket, and the only cost is the storage.
What you need
- A BackupZit console — a small Linux VM (2 vCPU, 2–4 GB RAM, 16–20 GB disk) from the ready-made image on the download page, or the install script on an existing Debian, Ubuntu, AlmaLinux or Rocky Linux server.
- An agent that downloads the data: Windows or Linux, with HTTPS access to
login.microsoftonline.com,graph.microsoft.comand, for OneDrive and SharePoint files,*.sharepoint.com. The agent on the console machine is enough. - Backup storage: SFTP, an SMB share, an S3-compatible bucket, Azure Blob Storage or a BackupZit hardened repository.
- A Global Administrator of the tenant, once, to register the app and grant consent.
Step 1 — Register an app in Microsoft Entra ID
Once per tenant, in the Microsoft Entra admin center:
- App registrations → New registration: name it e.g.
BackupZit, choose Accounts in this organizational directory only, no redirect URI. Note the Application (client) ID and the Directory (tenant) ID on its overview page. - Certificates & secrets → New client secret: choose a lifetime (e.g. 24 months) and copy the secret's Value right away — it is shown only once. The Secret ID is not the secret.
- API permissions → Add a permission → Microsoft Graph → Application permissions (not delegated):
To back up Permissions Mail and OneDrive User.Read.All,Mail.Read,Files.Read.AllCalendars and contacts also Calendars.Read,Contacts.ReadSharePoint sites also Sites.Read.All - Click Grant admin consent for …. Until then the status shows Not granted and backups are refused.
These are read permissions only. To limit the app to some mailboxes, an Exchange administrator can add an application access policy or RBAC for Applications scope; accounts outside it are then reported as not readable.
Step 2 — Add a storage target
In the console open Storage and add a target — for example an SMB share on a NAS for the first copy and an S3 bucket with Object Lock for the off-site copy. Leave Encrypt backups on (the default): mail and files are encrypted with AES-256 on the agent before they leave it. Keep the recovery key the console shows away from the backups, e.g. printed or in a password manager.
Step 3 — Create the Microsoft 365 job
- Under Backup jobs create a job of the kind Microsoft 365 and choose the agent that downloads.
- Enter the Directory (tenant) ID, Application (client) ID and Client secret from step 1. The secret is stored encrypted.
- Choose what to back up: Mail, OneDrive, Calendars and contacts, SharePoint sites — any combination.
- Choose the accounts: All accounts with a mailbox or OneDrive (accounts added later are included automatically; list exceptions one per line), or Only these accounts. Accounts without a licence are skipped. For SharePoint the same choice applies to sites: all sites with exceptions, or only listed site addresses such as
https://contoso.sharepoint.com/sites/sales. - Instead of typing addresses, click Choose from the list: the console reads the tenant's accounts and sites with the app you just entered and lets you tick them.
- Pick the storage target, a schedule (e.g. every night) and the retention.
When the job is saved, the console signs in as the app and checks the permissions, the accounts and the sites, so a wrong secret or a missing admin consent shows at once.
The first backup downloads everything. Every later backup lists the folders again but downloads only messages and files that are new or changed (read, flagged, moved or edited messages count as changed); unchanged data is taken from the previous backup. Microsoft limits how fast an app may read — BackupZit waits when Microsoft asks it to and continues, so a first backup of large mailboxes can take hours.
What is backed up
| Data | Stored as |
|---|---|
All mail folders and subfolders; each message complete with attachments as an .eml file, named by date and subject. Outlook, Thunderbird and most mail programs open it. | |
| OneDrive | All files and folders with their modification time. |
| Calendars | Every calendar; each event as an iCalendar file (.ics) with time, place, attendees, reminder and recurrence. Outlook, Google Calendar and Thunderbird import it. |
| Contacts | Contacts and contact folders as vCards (.vcf). |
| SharePoint | Every document library of each site, with all folders and files. Teams files live in SharePoint and are included. |
A backup holds one folder per account — ana@contoso.com/Mail/Inbox/…, …/OneDrive/…, …/Calendar/…, …/Contacts/… — and SharePoint/<site>/<library>/…. Because the files are standard formats, they stay readable without BackupZit.
Step 4 — Keep an off-site copy (3-2-1)
Add a job of the kind Backup copy with the Microsoft 365 job as its source and a second target in another place — an S3 bucket with Object Lock or a hardened repository makes that copy immutable. Only data not yet at the destination is sent, and the copy has its own retention. Automatic restore tests (weekly by default, under Settings → Restore tests) restore a random sample from the newest backup and verify every byte against the stored checksums.
Restoring
- Browse and download: on a backup run, open an account's mail folders, OneDrive, calendars or contacts, or a SharePoint site; tick messages, events, files or folders and download them — one file as is, several as a ZIP. Open the
.emlfiles in Outlook or drag them into a mailbox. - Restore into a folder on any agent: messages as
.eml, events as.ics, contacts as.vcf, OneDrive and SharePoint files as they were, below<folder>/<account>/…and<folder>/SharePoint/….
Limits to know
- Restoring directly into a mailbox or OneDrive is not available yet (planned; it will write only into a new folder and never overwrite). Today you download or restore into a folder.
- Not included: Teams chats and channel messages, SharePoint lists and pages (only document libraries), attachments of calendar events, contact photos, single changed occurrences of a series, and shared mailboxes without a user account.
- Times of calendar events are stored in UTC.
Troubleshooting
- AADSTS7000215 / invalid client secret: the secret's ID was copied instead of its Value, or the secret expired — create a new one and enter it in the job.
- Missing application permissions / Authorization_RequestDenied: add the permissions as application permissions and click Grant admin consent.
- The account has no Exchange Online mailbox: the account has no Exchange licence (or is a contact); remove it from the job.
- A run with warnings lists messages or files that could not be read (e.g. a OneNote notebook); the rest of the backup is complete.
Next steps
Download BackupZit, see all Microsoft 365 features, or read the chapter Microsoft 365 in the user guide in the console. The same console also backs up servers and virtual machines — see the guides for Proxmox VE and Hyper-V. Questions are welcome in GitHub Discussions; companies can get commercial support from MaxZit.