There is an upcoming Microsoft 365 change that may affect your Teams chat backups and incur additional charges.

A few months ago, Microsoft introduced a new set of Teams Export APIs designed to access Teams chats directly from the underlying Cosmos DB service that hosts the chats. Cirrus for Microsoft 365 will support the backup of Teams chats by using the newly released Teams Export APIs – Microsoft.

As of 31^st of January 2023, Microsoft will gradually start to deprecate any access to the hidden folder: TeamsMessageData within Outlook that currently saves Teams chats. Going forward, Teams Export APIs will be the only way to backup Teams chats with Cirrus for Teams Channel (posts & comments). Groups, Channel, and metadata will continue to be protected regardless of you opting to enable this feature or not.

A new feature in Cirrus has been released and will allow you to manually switch to the new Teams Export APIs.

If you do not wish to backup Teams chat, please ignore and Cirrus will function as it did before by backing up Groups, Channel, and metadata in Teams.

 

The following steps will cover the cost and pre-requisites steps in Microsoft Azure AD and Cirrus.

Cost?

The cost to backup chats in Teams will be calculated on a per tenant/per message basis, relative to the license model. Cirrus for Microsoft 365 will support Model B, which means that the protection of Teams chats data will cost you $0.00075 per message/per tenant. Microsoft will invoice you at the end of the month if you choose to opt in to enable this feature.

(Note: Cirrus costs will remain the same, as it won’t charge any additional cost)

You can also estimate costs in Microsoft 365 admin centre by Usage Reports.

Who/How to be eligible?

Step 1. Ensure you have an active Azure subscription (PAYG/CSP).

If you don’t have an active subscription, you will need to create one to be able to use this feature as Microsoft will be invoicing straight to the Azure subscription of your tenancy.

Configuration in Microsoft (how to apply for access to the protected APIs)

Step 2. To configure this process in Microsoft, you will need to fill in this special form and submit.

Please read the Microsoft documentation for more information how to access Teams Export APIs.

Following are the steps to fill in the Microsoft form:

• Email Address
  • Your tenancy’s Global Admin/Azure admin email (user submitting the request form)
• Publisher name
  • CT4: Cirrus
• Application name
  • Put the name of the app that you use to add your Microsoft 365 organization to the Cirrus for Microsoft 365. You can find it in the Azure Active Directory admin centre > App registrations
• Application ID(s) to enable permissions for (GUID, semicolon separated)
  • Put the application (client) ID of the app that you use to add your Microsoft 365 organization to the Cirrus for Microsoft 365. You can find it in the Azure Active Directory admin centre > App registrations > Overview of your app:
• Which category best describes your application (select one)
  • Select “Backup/restore”
• Why does your application need read access to all messages in the tenant? (If you don’t, you don’t need access to protected APIs)
  • To allow for backup/protection of Teams message data
• Data retention (select one):
  • Select “It is obvious to any admin installing this app that it will make a copy of Microsoft Teams messages”
• What are the tenant IDs that this application needs to run in? (GUID, semicolon separated. If you’re writing software for other organizations to use, include “all”).
  • Put the tenant ID of your Microsoft 365 organization that you protect with Cirrus for Microsoft 365. You can find it in the Azure Active Directory admin centre > Overview of your tenant:
• Does your organisation own all those tenants? (Answer may vary depending on your Microsoft 365 setup)
  • Select Yes
• May we contact you about your app’s use of non-protected APIs?
  • Select Yes
• I have read and agree to the Terms and Conditions for Licensing and payment requirements that apply to these APIs (Service specific terms in the link below)

https://aka.ms/Product_terms_for_Microsoft_Azure_services

(Note: selecting “no” will reject your request.)

• • Select Yes

 

Configuration in Cirrus Backup

Feature coming soon, we will be in contact when it is released.

Please contact [email protected] if you have any questions.

Please see below the beta release of the screens in Cirrus we will use to enable Teams Chat backup.

 

Step 1. Open the Cirrus app.

Step 2. Select Settings > System > Setup Teams Chats.

Step 3. Tick the box to agree to enable this feature.

Step 4. Follow the steps to reauthenticate (this will allow Cirrus to access those requested APIs).

1. Copy the code 
2. Open the second link (which will open in another tab) 
3. Paste the code 
4. Select the M365 admin account to finish the next step 
5. Authentication complete 

Step 5. Select to automatically enable or manually enable the option

Help & Support

If you have any questions please contact our support team via [email protected] or lodge a ticket on our Support portal.

In simple terms, the Cirrus application connects to your Microsoft 365 account and takes frequent backups of your data, storing them securely in a Microsoft Azure storage account.

Click below for a demonstration video of Cirrus in action.

Cirrus Backup – Features from CT4 on Vimeo.

Click below for a demonstration video of the simple sign up process.

Cirrus Backup – Getting Started from CT4 on Vimeo.

Cirrus can backup all of your data stored in your Microsoft 365 account, including SharePoint sites, Teams channels, Outlook and OneDrive, as well as group mailboxes and sites.

Yes.

Cirrus can always be accessed from it’s web page, but you can access it from app launcher in Microsoft 365 once the sign up process is done. Browse to office.com and login to access the App launcher.

To ensure all of your data is backed up, you will need to provide an account with the Global Admin role assigned.

The Enterprise version of Cirrus supports branding to suit your company, also known as “white-labelling”. Please contact our sales team for more information.

Disabled User data is backed up in point of time backups, all data is stored for 7 years by default although other retention periods are available.

The Cirrus service account requires Global Administrator permissions in order to be able to backup all objects.

No, Cirrus can only be used for Work / School accounts not personal accounts. To understand the difference, please read the following FAQ which explains the difference in detail.

When you sign into Microsoft 365 you must always choose if you are using a personal account or a work or school account. Personal accounts are designed for individual users and can group together individual Microsoft personal accounts by family, but personal accounts use a very different authentication method that at this time cannot be backed up by the Veeam software that powers the Cirrus Backup Solution.

Please read the following article from Microsoft that goes into more details about the different between these types of Microsoft 365 Accounts: https://techcommunity.microsoft.com/t5/itops-talk-blog/what-s-the-difference-between-a-personal-microsoft-account-and-a/ba-p/2241897

Please visit https://cirrusbackup.ideas.aha.io/ to submit ideas and feature requests, all submissions will be considered by our product team.

Veeam does not provide an out of the box backup solution, you still need to build it. While the approximate Veeam cost per license per month is $1.70 AUD, this does not include cloud storage costs, cloud storage ingress and egress costs and the ongoing costs to maintain and monitor your backup solution, including restores. While Veeam can take weeks or months to setup depending upon the level of IT expertise in your organisation, Cirrus automatically deploys all infrastructure, provisions your storage and licenses and can be backing up in 5 minutes without any IT expertise required or potential 3^rd party implementation costs. Cirrus also removes all requirement for ongoing maintenance and monitoring, our support team constantly monitors your backups and can remediate any issues before you are aware of them.

We’ve invested in technical, physical and administrative safeguards to do our part to help keep your data safe and secure. While we’ve taken steps to help protect your data, no method of electronic storage is completely secure and we cannot guarantee absolute security. We will notify you if there appears to be unauthorised access to your account and we may also restrict access to certain parts of our services until you verify that access was by an authorised user. Examples of security safeguards we have in place are:

• • Front end Web application has been externally verified by 3rd party penetration testing.
  • Cirrus Support is based on RBAC (Role Based Access Controls).
  • Multi Factor Authentication is used for all support access.
  • All Support actions are logged.
  • Cirrus Support engineers only has access to backup logs via the web application with no ability to browse backup content.
  • Admin access to Veeam Server is highly restricted; Support teams are provided admin credentials only for priority one events.

• Cirrus is underpinned by a Veeam Certified Solution, Veeam Backup for Microsoft Office 365.
• All granting of admin access is logged.
• In exceptional circumstances, Senior Cirrus Support engineers may require access to view customer data to resolve a support incident. This will only be granted with written authorisation from the customer. Internal Security audit procedures are in place to ensure that access to customer data is always backed up by written authority and that the access was only provided for the time required to resolve the incident and then immediately revoked.
• Cirrus users can only restore to their own Microsoft 365 instance or optionally download to their PC (downloads can be turned off using Role Based Access Control settings).
• All company backup data is held in a dedicated Azure Cool Storage Account, storage accounts are never shared.
• Veeam’s advanced 256-bit TLS encryption is used for all inflight and at rest data.
• Protection is provided against ransomware as deleted files are automatically moved to an air-gapped location that is not visible or accessible to the customer or available to public routing. This service is exclusive to select Veeam Cloud Service Providers running Veeam Cloud Connect.
• PCI Compliance.
• All credit card transaction are processed by Stripe LLC, all credit card data is encrypted and monthly charges are made by Cirrus based on the provision of a secure token from Stripe LLC.

Cirrus Support only has access to backup logs via the web application which they can access for the purposes of providing issue resolution. They have no ability to browse any files stored by the service.

In exceptional circumstances, Senior Cirrus Support engineers may require access to view customer data to resolve a support incident. This will only be granted with written authorisation from the customer. Internal Security audit procedures are in place to ensure that access to customer data is always backed up by written authority and that the access was only provided for the time required to resolve the incident and then immediately revoked.

All data will be encrypted while in transit between your site and the backup store, and while at rest in the backup store.

Yes, the backup solution is MFA compatible.

As a SaaS provider, the CT4 groups of companies holds a number of certifications for controlling and managing our applications, specifically our operations companies hold ISO27001, ISO20000 & ISO9001. The Cirrus M365 Cloud Backup application is deployed in Microsoft Azure which holds certifications to numerous security standards, including ISO27001:2013 and SOC II and the Azure Blob storage accounts we use are certified against multiple security standards including: FINRA 4522 (US) – The Financial Industry Regulatory Authority. For more details on certifications held, please visit the Microsoft Azure Compliance page, or please contact our support ([email protected]) or sales team ([email protected]).

Cirrus encrypts client data at two points, leveraging Veeam’s advanced 256-bit TLS encryption for all inflight and at rest data.

When connected to Cirrus, you will receive a designated storage account exclusively for your tenancy in an Azure Datacentre in your region. Storage account level encryption is utilized in Azure, we can also enable infrastructure level encryption for your storage account (which acts as a double encryption) if a support ticket is raised. Cirrus uses the LRS redundancy, where three copies of your data are saved in three different disks within the primary region.

Our support staff are located in the United Kingdom and Australia.

Backups are stored in Azure storage accounts in the same region as your customer account.

* New Zealand customer data is currently held in Australian data centres due to a lack of data centres in New Zealand. Microsoft are building a data centre in New Zealand, which future customer data will be held in.

Our Standard Service Levels are:

• 6 hour response on all support tickets
• 6 hour automatic backup failure remediation
• Online Support 24 x 7
• System Availability 99.9%
• Enhanced support response times are available for Enterprise customers

After a subscription is cancelled or terminated, backups will be held for up to 30 days. In order to access this data, you must contact Cirrus support to request provision of local backup copies. Cirrus Support will advise you of any charges payable to provide copies of stored data after subscription cancellation.

All credit card transaction are processed by Stripe LLC. All credit card data is encrypted and service charges are made by Cirrus based on the provision of a secure token from Stripe LLC.

The price includes unlimited storage.

Yes. Please contact our sales team to arrange annual payment methods.

As Cirrus M365 backup is powered by Veeam, there are some Considerations and Limitations of the Veeam Backup for Microsoft Office. For full details, please view the details from Veeam: https://helpcenter.veeam.com/docs/vbo365/guide/vbo_considerations.html?ver=50.

• To back up user mailboxes, make sure that a mailbox has a valid Microsoft 365 license. Otherwise a backup job will fail with the following error: “Error: Mailbox doesn’t have a valid Microsoft 365 license”.
• To back up public folder mailboxes, the Veeam Backup account must have a valid Exchange Online license and an active mailbox within the Microsoft 365 organiSation.
• To back up SharePoint and OneDrive for Business objects, make sure that a user account has a valid Microsoft 365 license with SharePoint plan enabled. Otherwise a backup job will fail with the following error: “User %name% does not have a valid Microsoft 365 license with SharePoint plan enabled”.
• Project Web Apps are not supported for backup.
• If you modify a retention policy tag for a folder, Veeam Backup for Microsoft 365 will perform full synchronisation of that folder during the subsequent backup job session. For more information, see this Microsoft article.
• SharePoint site collection recycle bin is not supported for backup.
• When you perform backup of Microsoft Teams data, Veeam Backup for Microsoft 365 does not back up the following objects:
  • Private channels,
  • One-on-one and group chats,
  • For more information about chats in Microsoft Teams, see this Microsoft article. You can use Veeam Explorer for Microsoft Exchange to explore data from user mailboxes and view chat messages as MSG files,
  • Audio and video calls,
  • Video recordings,
  • Contacts,
  • Calendar: information about meetings and meeting chats,
  • Code snippets in posts,
  • Banner notifications in posts,
  • Data of applications added as channel tabs that does not reside in the SharePoint document library of the channel.
• As part of Microsoft Teams data backup, Veeam Backup for Microsoft 365 backs up only the following types of channel tabs: Website, Planner, Word, Excel, PowerPoint, Visio, PDF, Document Library, OneNote, SharePoint, Stream, Forms, Power BI, Flow and Azure DevOps.
• Veeam Backup for Microsoft 365 may not backup OneNote notebooks if their size is more than 2 GB. For more information, see this Microsoft article.