For years, we’ve been advising organizations using Microsoft 365 services (formerly known as Office 365 services) like Exchange Online to create backups of their data stored in these services and/or to define their exit scenario.

Now, organizations using Veeam Backup for Microsoft Office 365 to this purpose are seeing errors with this product…

The situation

An organization leverages Microsoft 365 services.

To create backups of their data in these services and to restore this data to these services and/or other locations, they use Veeam Backup for Microsoft Office 365 version 5.

The issue

Since last week, admins receive an error when creating backups and/or restoring data:

The remote server returned an error: (403) Forbidden. Access denied

The cause

Recent changes made by Microsoft to their application programming interfaces (APIs) have impacted certain authentication queries that are used in versions of Veeam Backup for Microsoft Office 365 prior to version 5.0.1.225.

Impacted authentication configurations include:

• Backup operations for Veeam Backup for Microsoft Office 365 deployments with Organizations using these authentication types:
  • Basic Authentication
  • Modern Authentication and Legacy Protocols
• Restore operations for SharePoint, Microsoft Teams and OneDrive within Veeam Backup for Microsoft Office 365 deployments with Organizations using these authentication types:
  • Basic Authentication
  • Modern Authentication and Legacy Protocols
  • Modern App-Only Authentication

The solution

When using Veeam Backup for Microsoft Office 365, you must upgrade to latest version: Veeam Backup for Microsoft Office 365 5b cumulative patch KB4135 (version 5.0.1.225).

The newest product build leverages different API queries which help to avoid the permission issue which takes place in older builds.

Concluding

Microsoft 365 is a fluid platform. Changes can be implemented overnight that break functionality in the morning. Unintended, or not. Veeam has been working closely with Microsoft for several years.

Veeam had already created an update to remediate the situation last month. Check if you’re running version 5.0.1.225, or a newer version. If not, update your Veeam Backup for Microsoft Office 365 installation(s).

Further reading

KB4156: "The remote server returned an error: (403) Forbidden. Access denied" 
KB4106: Build numbers and versions of Veeam Backup for Microsoft Office 365 
KB4135: Veeam Backup for Microsoft Office 365 5b cumulative patch KB4135 
Configuring Veeam Backup for Microsoft Office 365 with Modern Authentication 
Microsoft 365 Backup in terms of your organization’s exit scenario 
Your Exchange Online Contingency Plan is here with Veeam Backup for Office 365