Requirements

Internet / Network Connection

In order to access the AhsayCBS backup server through the web-based management console, make sure you have an Internet connection or LAN access to the internal AhsayCBS server.

Supported Browsers

The AhsayCBS User Web Console runs in all major web browsers. Please make sure that you are using the latest version of the browser.

Login Credentials

To allow access to Microsoft 365 / cloud storage (backup source) in performing a backup, make sure to have the correct login credentials to Microsoft 365 / cloud storage service.

Ahsay License Requirement

Licenses are calculated on a per device basis for AhsayOBM and AhsayACB. For Run on Server, to be able to back up using the AhsayCBS User Web Console, one AhsayOBM or AhsayACB license is required.

Please contact your backup service provider for more details.

Add-on Module Requirement

Cloud File

The Cloud File Backup module is included in the basic AhsayOBM/AhsayACB license. There is no limit on the number of Cloud File backup sets in an AhsayOBM/AhsayACB user account.

Microsoft 365

Make sure that the Microsoft 365 Backup feature has been enabled as an add-on module in your AhsayOBM and AhsayACB user account and there is enough Microsoft 365 Backup license quota to cover the backup of the users.

Please contact your backup service provider for more details. Below are the sample screenshots of an AhsayOBM and AhsayACB user with an add-on module of Microsoft 365 with licenses.

AhsayOBM user with ten (10) licenses

AhsayACB user with two (2) licenses

The Ahsay licenses for the Microsoft 365 module are calculated by the number of unique licensed or unlicensed Microsoft 365 user accounts. If same Microsoft 365 account is backed up on multiple backup sets with an AhsayOBM user account, it would be counted as one Microsoft 365 license.

• Each licensed or unlicensed Microsoft 365 user account selected for backup requires one Microsoft 365 license.
• Each Equipment Mailbox, Room Mailbox, or Shared Mailbox selected for backup requires one Microsoft 365 license.
• If just only SharePoint Sites under the Site Collections and/or files of folders under Public Folder are selected for backup, this requires zero Microsoft 365 license but a minimum of one Microsoft 365 license is needed to perform a backup. The Microsoft 365 license is only needed to start the backup but it will not be counted as used license.

However, if any items from either Outlook, Items from OneDrive, or Personal Sites under Users are selected for backup, the Microsoft 365 license count will be calculated based on the number of user account selected.

For more detailed examples about the Microsoft 365 license requirement and usage, refer to the Appendices.

Backup Quota Requirement

Make sure that your AhsayOBM/AhsayACB user account has sufficient quota assigned to accommodate the storage of backup data and retention policy.

For Microsoft 365, to get an accurate estimate of the backup quota requirement, it is recommended to check the actual usage of the Microsoft 365 Organization in the Microsoft 365 Admin Centre. Please refer to this article for more information: View Item Count and Storage Used in Microsoft 365 Admin Center.

Microsoft 365 License Requirements

Microsoft 365 Subscription Plan

The following subscription plans with Microsoft 365 email services are supported to run backup and restore on AhsayCBS User Web Console.

• Microsoft 365 Business
• Microsoft 365 Business Essentials
• Microsoft 365 Business Premium
• Microsoft 365 Enterprise E1
• Microsoft 365 Enterprise E3
• Microsoft 365 Enterprise E4
• Microsoft 365 Enterprise E5
• Microsoft 365 Education

Microsoft 365 Subscription Status

Make sure your Microsoft 365 subscription with Microsoft is active in order to enjoy all privileges that come along with our backup services. If your account has expired, renew it with Microsoft as soon as possible so that you can continue to enjoy the Microsoft 365 backup services provided by Ahsay.

When your account is expired, depending on your role, certain access restrictions will be applied to your account. Refer to the article for more details, Microsoft 365 Subscription.

Restore Requirement

When restoring data of Microsoft 365 user, the account which the data will be restored to requires valid license(s):

• Requires Exchange License

  Example: Exchange Online Plan and Microsoft 365 E3 are required when restoring Outlook's / Public Folder's items.

• Requires SharePoint License

  Example: SharePoint Online Plan and Microsoft 365 E3 are required when restoring OneDrive's / Personal Site's items.

Microsoft 365 Permission Requirements

The basic permissions required by a Microsoft user account for authentication of an AhsayOBM/AhsayACB Microsoft 365 backup set is as follows:

• Global Admin Role

  The Microsoft 365 account used for authentication must have Global Admin Role, since Modern Authentication will be used. This is required for AhsayOBM and AhsayACB.

  This is to ensure that the authorization configuration requirements will be fulfilled (e.g. connect to Microsoft Azure AD to obtain the App Access Token). To assign the role, please refer to Assigning Global Admin Role to Accounts.

• Term Store Administrator Role

  The Term Store Administrator Role may be required for backup and restore of SharePoint items. This is required for AhsayOBM only. To assign the role, please refer to Granting Term Store Administrator Role.

• A member of Discovery Management security group

  The Discovery Management security group must be assigned the following roles. This is required for AhsayOBM and AhsayACB. To assign the role, please refer to Granting Permission to Discovery Management Group.

  • Legal Hold, required for AhsayOBM only
  • Mailbox Import Export, required for AhsayOBM only
  • Mailbox Search, required for AhsayOBM and AhsayACB
  • Public Folders, required for AhsayOBM and AhsayACB

Proceed to grant all necessary permissions to the Microsoft user account as instructed in the succeeding sections.

Assigning Global Admin Role to Accounts

1. Click the App launcher in the upper left side then click Admin to go to the Microsoft 365 admin center.

   

   

2. In the “Microsoft 365 admin center”, on the left panel click Users. Find the user you want to assign the Global Admin role and click Manage roles.

    

3. In the “Manage admin roles” window, select Admin center access then tick the box beside Global Administrator. Click Save changes to save the role you assigned.

   

Granting Term Store Administrator Role

1. In the “SharePoint admin center”, under “Content services”, click Term store.

   

2. In the tree view pane in the middle, click Taxonomy. Then click Edit in the “Term store” section on the right.

   

3. The “Edit term store admins” panel appears. Enter the names or email addresses of the Microsoft 365 user who you want to add as term store admins then click Save.

   

Granting Permission to Discovery Management Group

This permission allows users added under the Permissions section of the Discovery Management group (refer to Granting Permission to Accounts for Creating Backup Set for setup) to back up and/or restore user item(s) not only for their own account, but also the accounts of other users in the same Assigned section.

1. Open the Exchange admin center, then log in as an account administrator.

2. Click Admin roles which is under “Roles” on the left, then click Discovery Management.

   

3. Under Discovery Management, click on Permissions.

   

4. Tick the box beside the roles you want to add. These are the following roles:

   • Legal Hold, required for AhsayOBM only
   • Mailbox Import Export, required for AhsayOBM only
   • Mailbox Search, required for AhsayOBM and AhsayACB
   • Public Folders, required for AhsayOBM and AhsayACB

   

5. Click Save to confirm and click Close to exit the setting.

Granting Permission to Accounts for Creating Backup Set

1. Open the Exchange admin center, then log in as an account administrator.

2. Click Admin roles which is under “Roles” on the left, then click Discovery Management.

   

3. Under Discovery Management, click on Assigned then click Add.

   

4. You can now add users to this group. Search by name or email address then click Add once done.

   

5. Click Save to confirm and click Close to exit the setting.

Granting Permission to Restore All Share Link Types to Alternate Location in Microsoft 365

Allowing Anonymous Users to Access Application Pages

1. Click the App launcher in the upper left side. Then click SharePoint to go to the SharePoint page.

   

   

2. Click Settings > Site Settings.

   

3. Under “Site Collection Administration”, click Site collection features.

   

4. Scroll down and look for “Limited-access user permission lockdown mode”, click the Deactivate button.

   

5. Click Deactivate this feature.

   

   Once deactivated, the Deactivate button will no longer be available.

   

Allowing Sharing to External Users

1. Go to your Microsoft 365 Admin Center > All admin centers, in the right pane select SharePoint.

   

2. Go to Policies > Sharing.

   

3. Under “External sharing” the button must be in line with “Existing guests” and click Save.

   

    

Data Synchronization Check (DSC) Setup (For Microsoft 365 only)

To compensate for the significant backup performance increase, there is a tradeoff made by the Change Key API, which skips the checking of de-selected files in the backup source, which over time can result in a discrepancy between the items or files/folders selected in the backup sources and those in the backup destination(s). However, the Change Key API will continue to check for de-selected Microsoft 365 user accounts or Site Collections. Un-selected individual Microsoft 365 user accounts or Site Collections detected during a backup job will be automatically moved to the Retention Area.

To overcome this, it is necessary in some cases to run a Data Synchronization Check (DSC) periodically. The DSC is similar to a regular Microsoft 365 Change Key API backup job but with the additional checking and handling of de-selected files and/or folders in the backup source. So that it will synchronize the data in the backup source and backup destination(s) to avoid data build-up and freeing up of storage quota.

Here are the pros and cons of performing the DSC.

Authentication (For Microsoft 365 only)

To comply with Microsoft’s product roadmap for Microsoft 365, Basic Authentication (Authentication using Microsoft 365 login credentials) will no longer be utilized. Instead, all new Microsoft 365 backup sets created will use Modern Authentication.

Since the second half of 2021, it will be a mandatory requirement for organizations still using Basic Authentication or Hybrid Authentication to migrate to Modern Authentication.

Modern Authentication provides a more secure user authentication by using app token for authentication aside from using the Microsoft 365 login credentials. In order to use Modern Authentication, the Microsoft 365 account is registered under Global region and the Microsoft 365 backup is configured to use Global region. As both Germany and China region do not support Modern Authentication.

Existing backup sets using Basic Authentication created prior to AhsayCBS v8.3.6.0 can be migrated to Modern Authentication. However, once the authentication process is completed, the authentication can never be reverted back to Basic Authentication. For more information on how to migrate to Modern Authentication please refer to Re-Authentication of Microsoft 365 Backup Set. After the upgrade to AhsayCBS v9.1.0.0 or above, the backup and restore process of existing Microsoft 365 backup sets still using Basic Authentication will not be affected during this transition period since Modern Authentication is not yet enforced by Microsoft.

In order to migrate existing backup sets to Modern Authentication there are two (2) methods:

• The first method is the Microsoft 365 account used for the backup set is assigned the Global Admin.
• The second method is the Microsoft 365 account used for the backup set is an ordinary account. When changing the settings of the backup set, the user can ask a Microsoft 365 Global Admin to grant permission to authorize the migration of authentication. This is only required in migrating from Basic Authentication to Modern Authentication. This only needs to be done once per backup set.

To check the current authentication being used in your Microsoft 365 backup set, see criteria below:

• Basic Authentication

  If you click on the backup set and the following pop-up message is displayed, then the backup set is using Basic Authentication.

  

• Modern and Hybrid Authentication

  For backup set using Modern or Hybrid Authentication, there is no pop up authentication alert.