Configure Druva inSync for Microsoft 365

Before you begin

Before you initiate Druva inSync configuration to protect Microsoft 365 data, ensure the following -

• You have a Microsoft 365 global administrator account with a valid Microsoft 365 license.

Create a user with Global admin role

If you wish to create a user with the global admin role from the Microsoft 365 Admin Center, perform the following steps:

1. Login to admin.microsoft.com ( Microsoft 365 admin center ) as an admin.
2. In the Microsoft 365 admin center, under the Users section, create a user. This user need not be associated with any existing employee of the organization.
3. Assign a Global admin role to this new user.

Once the new user is assigned a Global admin role, login to the inSync Management Console, and configure inSync for Microsoft 365 with this new user having a Global admin role. See Configure inSync to protect Microsoft 365.

Revoke Global admin role of the user

If you wish to revoke the global admin role of a user from the Microsoft 365 Admin Center, perform the following steps:

1. Login to admin.microsoft.com ( Microsoft 365 admin center ) as an admin.
2. Remove the global admin role of the user used for authorization and configuration of  Microsoft 365 in inSync.
3. Ensure that this user is not deleted or blocked from signing in to the Microsoft Office 365 account.

Know your Microsoft 365 app status

• Not Configured: Configure Microsoft 365 app
• Not Connected: Reconfigure Microsoft 365 app
• Not Licensed: Get a new license or renew the license if expired
• Connected: Configure Cloud App settings to define user attributes.

Configure Druva inSync to protect Microsoft 365 apps

Log in to the inSync Management Console as a Druva inSync Cloud administrator and perform the following steps to set-up Druva inSync to protect Microsoft 365 apps.

Step 1: Provide Druva inSync permissions to access Microsoft 365 app data

To protect and backup Microsoft 365 app data, Druva inSync requires authorization from Microsoft 365. Also, the Druva inSync Cloud administrator must accept the Microsoft 365 app permissions to access Microsoft 365 app data.

Druva inSync uses OAuth 2.0 to communicate with services like Microsoft 365. OAuth is an open protocol for token-based authentication and authorization on the internet. For more information on OAuth 2.0, see the OAuth website.

Procedure

To establish the connection with Microsoft 365 and provide required permissions to Druva inSync:

1. On the inSync Management Console menu bar, click Data Sources > Microsoft 365. Click Add Microsoft 365 Account.

2. On the confirmation message, click Configure to proceed with the configuration.

3. On the Microsoft 365 login page, enter the Microsoft 365 global administrator's user name and password, and then click Sign in. 
4. Click Accept to grant Druva inSync app the required permissions to access Microsoft 365 data.

 

Druva inSync gets connected to Microsoft 365 data of all users in your organization.

The permissions displayed is a combined list for all Microsoft 365 apps. If you want to know more about specific permissions applicable for each app, see:

• For Exchange Online: Required permissions for access to Exchange Online
• For OneDrive: Required permissions for access to OneDrive
• For SharePoint Online: Required permissions for access to SharePoint Online 

Verify Configuration

After you complete the configuration of Druva inSync with Microsoft 365 app, you can use the Verify Configuration option to check if Druva inSync can access your users. 

Procedure

To verify the configuration:

1. On the inSync Management Console menu bar, click Data Sources > Microsoft 365.

2.  On the Overview page,  click   and then click Verify.

3. In the Verify Configuration dialog that appears, select a user. 

• Provide an email address in the Select a user field. 
• Druva inSync recommends that you enter an organization user email address to check if the configuration works instead of an administrator user. 

4. When you select a user, Druva  inSync performs the following checks as a part of verification: 

• App authentication: This step checks if Druva inSync can generate refresh tokens and access tokens for the application. This step detects changes related to Microsoft 365  permissions.
• User and user’s endpoints existence: This step checks if the user exists at the Microsoft 365 end.

5. If any of the authentication steps fail, you are prompted with an error message. Click the error message to view the error details.

Step 2: Configure Cloud Apps settings for Microsoft 365

 Define the user attribute that you want Druva inSync to use to map user account to their Microsoft 365 app account.

• Configure user accounts access using the inSync email ID or Active Directory(AD) attribute
• Configure the User custom domain for Microsoft 365

Configure user accounts access using the inSync email ID or Active Directory(AD) attribute

By default, inSync uses the email address of inSync users to map users to their Microsoft 365 app account.

If you have integrated Active Directory (AD) or LDAP with inSync to manage user information, you can configure Druva inSync to use the User Principal Name (UPN) of users for identifying and associating them to their Microsoft 365 app account.

Druva inSync gets the UPN information through AD Mapping configured to fetch user accounts from configured AD/LDAP with Druva inSync. 

Druva inSync then automatically gets user details and identifies the user accounts with the configured Cloud Apps account.

Note: To configure Shared Mailbox as part of  Microsoft 365 backup,

• Ensure Druva inSync is configured to use inSync Email ID to access user accounts for Microsoft 365.
• Druva inSync does not support AD Attribute - User Principal Name (UPN) for Shared Mailbox backup.

Procedure

1. On the inSync Management Console menu bar, click Data Sources > Microsoft 365.
2. On the Overview page,  click   and then click Settings. The Cloud App Settings dialog box appears.
3. By default, inSync Email ID is configured for accessing user accounts. To configure Druva inSync to use User Principal Name (UPN) for accessing user accounts, select AD Attribute.

4. Click OK.

Configure the User custom domain for Microsoft 365

An organization may have a custom domain associated with different cloud applications such as Microsoft 365. Druva inSync Cloud administrator must map the Druva inSync user IDs of the users using the Microsoft 365 apps with the custom domain.

Configuring the user custom domain for Microsoft 365 enables the administrator to allow Druva inSync to access the user's details.

Procedure

1. On the inSync Management Console menu bar, click Data Sources > Microsoft 365.
2. On the Overview page,  click   and then click Settings. The Cloud App Settings dialog box appears.
3. To configure a custom domain for the selected Cloud App, enter a valid and unique User custom domain name. The custom domain specified in this field replaces the inSync user's existing domain and is used to access the user's details for the configured cloud application.

4. Click OK.

Step 3: Get user data encryption key(ekey)

To ensure that the Microsoft 365 data that is backed up is secure, you must configure Druva inSync to get the data encryption key(ekey). 

Use one of the following methods to enable Druva inSync to get the user data encryption key(ekey):

• Deploy inSync Connector
• Connect a user device
• Enable Cloud Key Management

Deploy Druva inSync Connector 

At least one Druva inSync Connector is configured and connected to the Druva inSync Cloud (default option). For more information, see: 

• Install inSync connector
• Configure the inSync Connector

Note: 

• Druva inSync Connector acts as a Cloud Apps connector to provide the ekeys without requiring users to have their devices connected for the Cloud Apps backup .
• If the registered Druva inSync Connectors are not connected, backup of the configured Cloud Apps data fails.
• Druva inSync Connector does not need to have any domains or AD mappings added to it.
• Druva inSync generates a Not Connected alert if Druva inSync Connector is not connected.

Connect a user device 

If the Druva inSync Connector is not configured, then, at least one endpoint device (desktop or laptop) for every user in Druva inSync is configured for backup.

Enable Cloud Key Management 

If none of the earlier mentioned deployment options are used, you must have the Cloud Key Management feature enabled. For more information, see Configure Key Management for Cloud Apps.

Step 4: Configure a profile to protect Microsoft 365 app data

To back up Microsoft 365 app data, you must specify the Microsoft 365  backup settings in an existing profile or in a new profile. inSync will start backing up the user data from Microsoft 365 as per the backup schedule that is defined for a profile with Cloud Apps feature enabled.

Create a new profile

1. On the Druva inSync Management Console menu bar, click Profiles.
2. Click Create New Profile. The profile creation wizard appears. 
3. On the General tab, provide the required details for the Summary and User Privacy & Access sections and click Next. 

Field	Action
Summary
Profile name	Type the name for this profile.
Max. # users	Type the maximum number of users that you want to assign to this profile. If you do not want to set any restriction on the number of users, type 0 (zero).
Description	Type a short description for this profile.
Data Preservation Note: By default, Data Preservation settings are not inherited from the Default profile. You must specify Data Preservation settings as per your preference.
Auto delete preserved users	Select this check box if you want inSync to automatically delete preserved users after a particular duration.
Auto delete after	Specify the duration, in the number of days, when inSync should automatically delete preserved users. Note: The users to be auto-deleted must be in preserved state for a minimum of 30 days and maximum 366 days. Once the user is auto-deleted, data of that user is also deleted from inSync. You cannot recover this deleted data again. User data is retained or deleted based on the backup retention policy you have defined through profiles. If a preserved user is under Legal Hold, such user will not be deleted.
Backup Inactivity Alert
Alert if user's data sources are not backed up for	Druva inSync will raise the user Backup Inactivity Alert if a user device is not backed up for more than the days specified in this field.  You can specify from 1 to 365 days in this field.
User Privacy & Access
Allow admin access to user data	By default, this check box is selected. Clear this check box if you do not want administrators to access and restore user data. Once you have cleared this check box, you cannot change your preference later.
Allow users to edit privacy settings	By default, this check box is selected. If you do not want to allow Microsoft 365 Cloud Apps users to edit the privacy settings, click to clear this check box.  If you allow users to edit their privacy settings, Microsoft 365 Cloud Apps users can prevent administrators from: Viewing or downloading user data. Performing data restores for the users. Performing analytic search for the users. Viewing files and folder names that users have restored or downloaded in the user audit trail. Downloading log files pertaining to a user's inSync activities. Downloading data that users share with others. However, Druva inSync Cloud administrator can view the share activities for the users irrespective of the privacy settings. Note: If you want to disallow the users to disable administrators to view/download their backup and share data through inSync Client, clear the 'Allow users to edit privacy settings' check box.
Allows restores from a Web browser	By default, this checkbox is selected. Clear this checkbox if you do not want to allow users to restore data by accessing their Druva inSync account through a web browser.
Login using	From the dropdown, click a preferred method that you want users to use to activate Druva inSync and to log in to Druva inSync Web. The available options are as follows: If you want users to use the password that inSync assigns, click inSync Password. If you want users to user their Single Sign-On username and password, click Single Sign-On. If you want users to use their AD/LDAP username and password, click AD/LDAP Account. When you click AD/LDAP Account, the Select AD/LDAP Server field appears. Select the IP address or the fully qualified domain name (FQDN) of the Druva inSync Master that contains the AD or LDAP server. Single Sign-On (SSO) option is available only if SSO is configured in inSync. To configure SSO, see  Configure inSync for SSO.
Allow access from mobile devices	You can allow users to backup data from their iOS and Android devices. Select this checkbox if you want to allow users to access Druva inSync data from their mobile devices. For more information on how you can update this permission, see Enable backup from mobile devices.
Allow users to log on only through the MDM managed app	This option is displayed only if you check the Allow access from mobile devices. Select this checkbox if you want to allow users to log in using only the Druva inSync for MobileIron app from iOS devices.
Enforce PIN for mobile access	Select this checkbox if you want to make it mandatory for users to set a four-digit security code to open the Druva inSync mobile app.

4. Click the Enable the Cloud Apps Backup setting option to enable Microsoft 365 app.

The setting options on the Cloud Apps screen are displayed.

Field	Description
Backup Cloud Apps
Microsoft 365	On the Select Backup Content page, click the Microsoft 365 tab if you want to backup all the Microsoft 365 web applications. For backup of specific Microsoft 365 web applications, select your preference: OneDrive, Exchange Online, or SharePoint Online. For more information, see: Enable Cloud Apps for Exchange Online Enable Cloud Apps for OneDrive Enable Cloud Apps for SharePoint Online
Global Exclusions	The fields for Global Exclusions are displayed based on the selections within Microsoft 365 Cloud Apps. OneDrive If you have selected the checkbox to backup only OneDrive data, then, you have the option to exclude certain file types from getting backed up. In the Exclude Files box, type the file types that you want to exclude from the backup. The file extensions are automatically added to the adjacent field. If you want to remove a file type, click the file type. Exchange Online Global Exclusions for files is not applicable for emails. For more information on how you can configure the global exclude list, see Configure the global exclude list.
Schedule & Retention: Backup Schedule
Backup frequency	Select how frequently you want Druva inSync to back up Microsoft 365 apps data. By default, Druva inSync performs the backup operation once a day. For more information, see Define the backup interval for Cloud Apps.
Schedule & Retention: Data Retention for Cloud Apps
Retain all backups for	Type the number of days that you want to retain all backups. At the end of the backup period, Druva inSync deletes the data from the storage. For example, if you specify that you want to retain all backups for 5 days and Druva inSync completed the backup operation on January 6, 2019. Druva inSync then deletes the backup data from the storage on January 11, 2019.
Retain weekly backups for	Type the number of weeks that you want to retain all backups. At the end of the weekly backup period, Druva inSync deletes the data from the storage. Note: The weekly backup is the last backup in a calendar week. The calendar week starts on Sunday.
Retain monthly backups for	Type the number of months that you want to retain all backups. At the end of the monthly backup period, Druva inSync deletes the data from the storage. Note: The monthly backup is the last backup in a calendar month.
Email Retention
Automatically delete old emails	Type the number of months after which you want Druva inSync to delete all backed up emails.   For example, if you type 6, Druva inSync will automatically delete all emails across all snapshots whose sent or received timestamp is more than 6 months old.

After you configure to enable backup from Cloud Apps, the Manage Users page displays the number of Cloud Apps associated with the users. If you click the Cloud Apps associated with a user, the Cloud Apps tab displays the backup status of Cloud Apps data.

Note: Click Disable Cloud Apps Backup to disable the Cloud Apps backup associated to this profile at anytime.

Alternatively, you can update the existing profile to enable the Cloud App feature. For more information, see Update Profile.

Step 5: Associate and add users to Microsoft 365 enabled Cloud Apps profile

The procedure to associate and add users depends on the Cloud Apps settings configuration set in Step 2.

Cloud Apps settings	Procedure
inSync Email ID	Add users individually or add a group of users by importing their information from a CSV file. To learn more about each option, see: Add users individually Add a group of users by importing user details from a CSV file  If you have not created a Cloud Apps enabled profile, you may add the users to the Default profile and then enable Cloud Apps feature for this profile.
AD attribute	Druva inSync users are automatically imported and mapped to their Microsoft 365 account. If your preferred method to map users is AD attribute option, then you must have the Active Directory (AD) or LDAP  integrated with inSync. To learn more about how to integrate Active Directory (AD) or LDAP  integrated with inSync, see Create an AD/LDAP mapping.

Next Steps

• Configure Druva inSync to protect Exchange Online data
• Configure Druva inSync to protect OneDrive data
• Configure Druva inSync to protect SharePoint Online data