TERRA CLOUD Veeam Data Protection/en

Introduction

Product presentation TERRA CLOUD Veeam Data Protection

The Software-as-a-Service product TERRA CLOUD Veeam Data Protection offers you the opportunity to build or expand your own cloud backup platform.
At the heart of this platform is the multi-tenant portal protection.terracloud.de, which grants you access to various Veeam backup products.
TERRA CLOUD provides you with the necessary resources, such as Veeam Backup for M365 servers or TERRA CLOUD S3 storage.
At launch, you can operate a complete cloud backup solution for Microsoft 365 data for your end customers.
Additional data backup products (Veeam Agents, Backup and Replication) and storage targets will be added later.

Facility

Setup process overview

Setting up the data backup consists of four steps, with steps 2-4 being repeated for each end customer.

Deployment of the TERRA CLOUD Veeam Data Protection Platform

You can have your TERRA CLOUD Veeam Data Protection Platform created with a one-time order in the TERRA CLOUD Center.
Upon completion of the deployment, you will receive a confirmation email. Your initial login credentials will be displayed in the TERRA CLOUD Technical Center.
Further setup of your customers and data backups is done in the technical administration portal protection.terracloud.de.

Establishment of the portal "protection.terracloud.de"

First login and change of initial access data

First Login:
You will receive a confirmation email after the deployment is complete.
You can retrieve your initial login credentials for protection.terracloud.de via the Technical Center.
Note: The user role "Reseller Admin" is required to access the login credentials.

The login is structured as follows:
(Wortmann Customer Number)\(Wortmann Customer Number-Administrator)
Example:
111490\111490-Administrator

Changing the Initial login credentials and multi-factor authentication: '
We recommend making the following adjustments to your initial administrator access (Service Provider Global Administrator) after logging in for the first time:

1. Changing the password
2. Activating and configuring multi-factor authentication
3. Verifying the stored email address ("Forgotten password" function)

Editing a user:
Option 1:
Please go to the settings using the "Configuration" gear in the upper right corner.
In the "Roles & Users" section, select the Service Provider Global Administrator using the checkbox and edit it using the pencil icon.

without

Option 2:
The currently logged in user can also be edited using the drop-down menu next to the username.

without

Adjusting the Administrator Profile:
Please assign a new password for this Service Provider Global Administrator user.
Check the email address stored in the "User Info" section; this is required for the "Forgot Password" function.
The address of the Cloud Master Account is stored by default. Change the address stored there if necessary.

without

We recommend enabling multi-factor authentication for all users in the Protection Portal.

without

Further configuration will be performed the next time you log in.
In the final step, you will receive a summary of the configured changes.

Configure email notifications

Please follow the steps below to configure email notifications:

1. Configuring the TERRA CLOUD SMTP server
Please open the portal settings using the "Configuration" gear and select the "Notifications" menu item.
Check whether an SMTP server has already been configured by TERRA CLOUD. If so, you can skip this step.
If no SMTP server has been configured, please click "Configure."
Please enter "mail.protection.terracloud.de" for the server and set the "Encryption protocol" to "None."
Since this SMTP server is located in the management infrastructure, encryption up to the SMTP server is not required.
Outgoing emails are encrypted if the receiving mail server requests it.

without

2. Setting up notifications
First, change the "Default sender" to "no-reply@protection.terracloud.de".
Select whether you want to be notified of every event or only receive summaries.
Enter the sender address and the desired recipient address again in the "Alarms" section.
The "Discovery Rules" and "Billing" sections are not required.

without

Configuration of Alarm Management

The Protection Portal offers its own monitoring function, which can be configured in the "Configuration --> Notifications --> Alarms Management" area.

Deactivating the "Managed companies quota" alarm

Please enter "Managed companies quota" in the search bar and disable this alarm.
TERRA CLOUD uses the Company Quota function to manage the provisioning of end customers via the TERRA CLOUD Technical Center.
For this purpose, the quota is set to the current number of managed end customers and only increased by +1 when a new end customer is provisioned automatically.
This automation causes the "Managed companies quota" alarm to be triggered incorrectly and should be disabled beforehand.
Email notification when a Managed companies quota alarm is triggered.
If the alarm has not yet been deactivated, the following message will be displayed in the Protection Portal and/or sent to you via email.

Create and link end customers

General:
In the Protection Portal, end-customer organizations are represented by a "Company." Your "Reseller" organization can manage any number of companies and thus end customers.
Companies can only be created automatically via the TERRA CLOUD Technical Center and not manually in the Protection Portal.
This enables the clear assignment of TERRA CLOUD Veeam Data Protection usage data to an end customer from the TERRA CLOUD Center/Technical Center.

Deploy TERRA CLOUD Veeam Data Protection for an end customer

1. Please navigate to the "Customer Management" section in the TERRA CLOUD Technical Center
2. Select the desired end customer and go to the "SERVICE SETTINGS" tab
3. Start the deployment by clicking "CREATE AND LINK END CUSTOMER" (see screenshot below)

The automated deployment performs the following steps in the background:

1. Create a company based on the end customer information from the Technical Center
2. Assign your resources for data backup (Veeam Backup for M365 Server and Repository)
3. Create a user account for the company

After successful completion, the created user account and a green check mark will be displayed.
The The displayed user access is a default of the Veeam Service Provider Console and is not required for setting up and managing data backups.
This provides insight into the data backup configuration within the company.

Setting up a Microsoft 365 data backup

Connect and link Microsoft 365 organizations

To configure data backup, please go to the Protection Portal.

The link between a created company (end customer) and a Microsoft 365 tenant can be configured in the "Veeam Backup for Microsoft 365 Plugin."
You can find this in the plugin library list in the "Configuration" section.

Go to the "Organizations" menu item and add a new one using "New."
First, select the company you want to link, and then select the object types you want to protect ("Protected Services").
This selection determines which permissions the Entra ID application requires for tenant data backup.

The Microsoft 365 region must then be specified if it differs from the "Default" default.

Please register a new Entra ID application in the tenant to be backed up.
The abbreviation TCVDP in the example stands for TERRA CLOUD Veeam Data Protection and facilitates identification within Entra ID.

To create the Entra ID application and grant it the required permissions, you must log in and authorize it as a Global Administrator.
Please copy the code and log in to M365 using the link provided.

Confirm your login to the Microsoft Azure CLI to create and authorize the Entra ID application.

After successful login and confirmation, the "Verification" status should change to "Verified."
If not, you can generate a new code using "Refresh code" and log in again.

Finally, the status of the M365 Organization and the VSPC Company should be set to "Mapped."

Create a Microsoft 365 backup job

To configure a backup job, select the "Backup Jobs" tab in the left menu bar in the "Management" section.
You can create a new backup job using "Create Job."
First, enter a name for the backup job and, optionally, a description.
We recommend choosing a name that reflects the job's backed-up content, as in our example.

without

Please select the already linked Microsoft 365 tenant that you want to back up.
The backup scope of your job is configured under the Backup Mode. The backup of the entire organization is preselected.

without

You can also customize the scope and define granular exclusions.
The next step is to add the schedule. Here, you can define the frequencies, days, and retries.
Optionally, you can allow or prohibit data backups within a backup window (e.g., during business hours).

without

In the final summary, you can run the data backup immediately using the "Start the job when I click finish" option.

Recovering Microsoft 365 data

Requirements

1. Active Entra ID Backup Application, which is already created during setup
2. Microsoft 365 credentials (affected user or global administrator)
3. TERRA CLOUD Veeam Data Protection Restore Portal Application added to the tenant

Add Restore Portal Application in the tenant

The TERRA CLOUD uses a Microsoft Entra ID Enterprise Application to perform restores in the backed-up tenants.
To enable this, the application must be added and authorized once per tenant.
Please use the "Connect-VB365RestorePortal" application, which is described in the following section.

Connect-VB365RestorePortal Application

Download

You can download the "Connect-VB365RestorePortal" application via this Link.

Grant restore permission for a tenant

Step 1: Start the application "Connect-VB365RestorePortal.exe" on an administrative system.
In process steps 1 and 2, this checks whether the required Azure AD (now Entra ID) PowerShell modules are installed and installs them automatically if necessary.
Step 2: After checking the PowerShell modules, a Microsoft 365 login dialog opens in a new window.
Please log in with a global administrator account of the tenant for which you want to perform the restore.

Step 3: Please confirm the authorization of the Entra ID Restore Portal Application of the TERRA CLOUD via Azure CLI using the second Microsoft 365 login dialog.
After successful configuration, you should receive the following result:
"The backup application 'TERRA CLOUD Veeam Data Protection - Restore Portal (V8.2)'[...] has been granted admin consent."

Restore as user

Step 1:
Under the "Protected Data" menu item, you can open a new tab with the "Restore Portal" link to access the Restore Portal.
Please log in with the Microsoft 365 user for whom you want to restore something.

without

Step 2:
Select the desired restore point from the calendar.

without

Step 3:
Now compile the restore set from the required files.
You can navigate through the backup and the various object types, as well as use the search function.
You can select individual files directly and restore them using the "Restore" function or add them to the restore set using "Add to Restore List."

without

Step 4:
Please check whether all the desired files are included in the restore list under "Items."
You can then specify the "Restore Mode" to determine whether the files should be overwritten or retained in their original location.
Click the "Finish" button to start the restore.

without

Performing a restore as an administrator for other or multiple users

Prerequisite:
You can authorize one or more users as "Restore Operators" through TERRA CLOUD Support.
Please provide us with the desired tenant, e.g., contoso.onmicrosoft.com, and the desired user, e.g., admin@contoso.onmicrosoft.com.
As a "Restore Operator," you can use the "Scope" to change your identity and perform the restore for other or multiple users.
The procedure is identical to restoring as a user.

---

Consumption data

Determine consumption values ​​via the TERRA CLOUD Technical Center

Das TERRA CLOUD Technical Center bietet Ihnen eine Übersicht je Endkunde und ein Zusammenfassung der Verbrauchsdaten für den ausgewählten Monat.
Innerhalb der Tabellenansicht können Sie die Werte wie gewohnt über die jeweilige Funktion filtern und als CSV exportieren.
Die Verbrauchsübersicht zeigt Ihnen die folgenden Werte an:

Datum

• Gibt den abgeschlossenen und abrechnungsrelvanten Monat an der im Drop-Down Menü „Report Monat" ausgewählt wurde.
• Sofern nichts ausgewählt wurde wird Ihnen der letzte abgeschlossene Monat angezeigt.

Endkunde

• Gibt den Endkunden an der mit dem gesicherten Microsoft 365 Mandanten verknüpft wurde.

Anzahl gesicherte M365-Benutzer

• Summe aus den neuen und berechneten M365-Benutzern.

Anzahl neue gesicherte M365-Benutzer

• Benutzer die im ausgewählten Monat neu in die Sicherung aufgenommen wurden, werden nicht berechnet.
• Dies gilt sowohl für die Ersteinrichtung des Mandanten als auch für neu hinzugefügte Benutzer bei Bestandskunden.

Anzahl berechnete M365-Benutzer

• Benutzer die im ausgewählten Monat in Rechnung gestellt werden.

Unter der Tabelle mit den Verbrauchswerten je Endkunde erhalten Sie noch Ihre summierten Verbrauchswerte als Partner.

Wann verbraucht ein Microsoft 365 Benutzer eine Lizenz für das Backup?

Ein Microsoft 365 Benutzer verbraucht im Abrechnungsmonat eine Lizenz für das TERRA CLOUD Veeam Data Protection Microsoft 365 Backup wenn die folgenden Kriterien erfüllt sind:

1. Die Onlinedienste Exchange Online und/oder SharePoint Online/OneDrive for Business werden verwendet und durch das Produkt gesichert
   
2. Der Benutzer war Bestandteil mindestens einer Datensicherung innerhalb der letzten 31 Tage

Wichtiger Hinweis:
Die Wiederherstellung aus bereits erstellten Datensicherungen ist auch ohne aktive Lizenz möglich.

Wenn beide Kriterien zum ersten Mal erfüllt sind, wird der Benutzer als „neu“ hinterlegt.
Sofern ein Benutzer in den letzten 31 Tagen nicht gesichert wurde, wird keine Lizenz mehr verbraucht.

Was verbraucht keine Lizenz für das Microsoft 365 Backup?

Die folgenden Objekte können Teil der Sicherung sein, verbrauchen jedoch keine Lizenz.

1. Microsoft Teams Objekte
2. Gruppen und nicht persönliche SharePoint Sites
3. Freigegebene Postfächer
4. Ressourcen Postfächer
5. Öffentliche Ordner
6. Externe SharePoint Benutzer
7. Microsoft Teams Gastbenutzer

FAQ

Microsoft Teams

Können Microsoft Teams Chats gesichert werden?

Die Chats zwischen einzelnen Benutzern und Gruppenchats können nicht gesichert werden.
Weitere Informationen zu den Einschränkungen der Veeam Backup für Microsoft 365 Teams Sicherung finden Sie hier.

Was würde gesichert werden wenn unter den „Protected Services" die Option „Teams chats" ausgewählt wird?

Die Option „Teams chats" erfordert die kostenpflichtige Nutzung der Microsoft Teams Export APIs und sichert die Beiträge in öffentlichen Teams Kanälen.

Welche Kosten entstehen für die Nutzung der Microsoft Teams Export APIs?

Eine Übersicht über die Kosten finden Sie in diesem Microsoft Beitrag.
Veeam wird als zertifizierter Partner in das Model B eingeordnet.