The process (and cost) of backing up your organization’s Microsoft Teams Channel chat data has changed. Ensure your organization is prepared and protected with 11:11 and Veeam Backup for Microsoft 365.
As Microsoft takes steps to continually improve the security posture of its Microsoft 365 platform, we have seen several changes introduced over the past 12 months. The first was the deprecation of Basic Authentication and now access to certain data types via Exchange Web Services (EWS). These are welcome changes, but do require some consideration when it comes to integration with your backup solution.
For this article we will focus on the changes being made to Exchange Web Service access. Up until recently, backing up your favorite Microsoft 365 services, such as SharePoint Online, OneDrive for Business, Exchange Online, and Microsoft Teams, required you to simply create a backup job for those workload types and call it a day. However, beginning on Feb. 1, 2023, Microsoft has restricted access to data via Exchange Web Services and has made an alternative available, Microsoft Graphs Teams Export API. That is not necessarily a problem, but how to get access to the API — and the cost associated with it — can be.
What Are We Talking About?
Let’s set the scene here: To gain access to the Graph Teams Export API, one must complete a Microsoft Form requesting access. (Fun fact: This form has changed at least four times at time of writing this article.) The second, more crucial, point to consider is that there is a cost associated with using this API, which at time of writing, sits at $0.00075 per message.
Now, I hear you asking: What will this ultimately give me?
The changes implemented by Microsoft on Feb. 1, mean that if you wish to protect chat data, specifically Teams Channel chat data, then each message accessed and protected has an API call cost of $0.00075. That is all the API access and costs associated gives you.
Instant messages in Teams were never protected by Veeam Backup for Microsoft 365. All other features that were previously protected by Veeam Backup for Microsoft 365 continue to be protected, including all other items associated with Microsoft Teams. For a full list of what is and is not protected, check out this Veeam article.
Our advice is that if you do not need to protect Teams Channel Chat data, then do not request access to the Graph Teams Export API at this time.
Cost
However, if you do need to protect Teams Channel chat data, the first question is always: How much is it going to cost? There is no definitive way to gather this information, but we can make some assumptions based on number of Teams messages that exist in the Microsoft 365 organization and the cost of the API call at $0.00075 per message.
To do this, log into the Microsoft 365 admin portal at https://admin.microsoft.com and browse to reports/usage.
Select the Teams report usage.
From here we can see Channel message usage, which is the statistic we are looking for. This example shows none. Yours will be different.
Now multiply the number of channel messages by $0.00075 and you have an estimated cost to backup the messages.
Configuring Access to Graph Teams Export API
The next thing to consider is, of course: How are those API calls going to be paid? A Microsoft 365 license does not cover these API costs. You may have M365 Business Premium, E3, Azure AD P2 bolt on, etc. NONE of these will cover the API license cost. To do so, an Azure subscription is required. There is a good explanation on the differences between Subscriptions and Licenses from Microsoft here.
There are different ways to purchase a subscription for Azure, this could be Pay-As-You-Go backed by a credit card, it may be bundled with an Enterprise License Agreement, or you may purchase it from your Microsoft Cloud Solution Provider alongside your Microsoft 365 licenses. The point is, there are several ways a subscription can exist and that is for you to figure out the most appropriate method to purchase.
Checking Azure Subscriptions
To check if a subscription already exists, log into https://portal.azure.com with an account that has sufficient privileges to managed subscriptions and search for subscriptions.
If a subscription exists, it will be listed here. In this example there are no subscriptions.
Example: Pay-as-You-Go Subscription Creation
Click to add a subscription on the subscription page and choose Pay-As-You-Go.
If a profile has not already been created, you will be asked to create one.
And “agree” to Microsoft agreement.
Next you will be asked for payment details.
And finally, if you would like to bolt on technical support.
Once complete a subscription can be created.
Requesting Access to Graph Teams Export API
Once a subscription is in place, request access to the API by using this form: https://aka.ms/teamsgraph/requestaccess.
Please note, this section assumes that a Microsoft 365 organization has been set up with Veeam Backup for Microsoft 365 using Modern Authentication. Please check out our Success Center article for the steps to complete this task. This process creates an Application ID which is required to complete the form.
Complete the form. Steps are correct at time of writing.
- Your e-mail address
- Publisher name = Veeam Software
- Application name = Your Azure Application registration name
- Application ID = Your Application ID
Finding Application Name and Application ID
Log into https://portal.azure.com and find Azure Active Directory.
Locate “App Registrations.”
Find the name of the Application and the Application ID.
- Which category best describes your application = Backup / Restore
- Why does your application need read access to all messages in the tenant? = To allow for backup/protection of Teams message data
- Data Retention = It is obvious to any admin installing this app that it will make a copy of Microsoft Teams messages
- What are the tenant ID’s where this application needs to run = Your Tenant ID. See how to below
- Does your organisation own all these tenants = For you to answer
- May we contact you about your app’s use of non-protected APIs = For you to answer
Finding Tenant ID
Back into https://portal.azure.com navigate to the root of Azure Active Directory. The Tenant Id is displayed here.
- I have read and agree to the Terms and Conditions for Licensing and payment requirements that apply to these APIs (Service Specific Terms in the link below) = Yes
Click Submit.
An email like the below will be received once the form has been submitted. It can take up to one week for this form to be processed by Microsoft.
Once Access is Granted to Graph Teams Export API
Please contact 11:11 support who will be more than happy to assist you with enabling Teams Channel chat backups.
Conclusion
Please bookmark this page for future updates. As 11:11 integrates this functionality with its award-winning 11:11 Console, we will enable you to manage the Teams Channel Chat backup functionality yourself.
Update: For additional troubleshooting tips, including how to enable protections for Microsoft Teams Channel Chat data via Azure CLI on a Windows Server, check out this follow-up post from Jim Jones, titled, “The Saga Continues: VB365 and Microsoft Teams Graph Export API.”
