The legacy approach to Teams backup is ending
CloudCover 365 will soon bring a new change in the way we ensure the data from Microsoft Teams chats are kept secure. By using CloudCover 365 we will back up your Microsoft Teams Data by using the just released Teams Export APIs. So, what does this mean for you and how can you prepare for this upcoming release.
The legacy approach to Teams backup is ending.
It has always been a challenge to backup Teams’ channel chats due to there being no distinct APIs to access and get messages from. Since Teams support was put in the place, we could only keep chats secure by backing up the messages from the TeamsMessageData folder of the Exchange group mailbox. Microsoft used this unseen folder to archive messages that had been sent between groups, specific users, or Teams channels. Over the past months, Microsoft has begun to apply additional restrictions to gain access to this folder which has occasionally caused issues with Teams protection for our customers. In a few months, these additional restrictions will be applied to everyone.
The future – Teams Export APIs
A couple of months ago, Microsoft brought a new set of Teams Export APIs in place which was designed to allow access to Team Chats directly. From 31st January 2023, Microsoft will completely deprecate any access to the TeamsMessageData folder, this means Team Export APIs will be the only way to go for working with Teams message data in the future.
In order to enable and protect these APIs in your Microsoft 365 tenant, you will need to be provided with special access and permissions to do so, In addition to this Microsoft will be applying charges to their customers for using these APIs
How will the upcoming changes affect your Team’s backup?
Once the upcoming changes are in place, your Teams channel chats will no longer be backed up. It is important to note this only applies to your chats, the rest of Teams’ data, including memberships, metadata, channels, tabs, and files will continue to be protected.
We have done this to ensure you don’t get any unexpected costs or errors/ warning notifications in your jobs. Backing up chats will now have necessary preparations on your side which will come with extra costs which will need to be paid to Microsoft. You can find out more about this as you read on.
We will be adding processing options for Microsoft Teams in order to make it clear for you. When configuring your backup Jobs there will be a separate option that will allow you to enable or disable chats per team.
In addition to this, if you would like to continue protecting Team chats you will need to reconfigure your organisation and specifically select the option to back up Team Chats.
Teams chat backup requires the use of a chargeable Microsoft API. For pricing see this Microsoft article.
Teams chats backup is only supported for organisations that use the modern app-only authentication and is in the Default region. Within the next steps of the wizard, CloudCover 365 will verify whether or not your organisation meets the authentication and region requirements and if the provided app has the required permissions.
The cost
These new charges for using the Teams Export APIs will be applied per user per message and will be dependent on the license model used. CloudCover 365 will support Model B, this means protection of Teams message data will cost you $0.00075 per message. Each month the amount spent will be included on your invoice from Microsoft- CloudCover 365 will not apply any charges.
“How can I estimate my costs?” – At present, the best way to estimate what your costs will be is to determine what team chats are the most important to your organisation, find the average usage statistics and do some calculations. In the Microsoft Teams admin center you can find your usage reports on the number of channel messages sent and the replies which you can use as a basis for your calculations:
How to apply for access to the protected APIs
A form is provided by Microsoft that you will need to fill out to apply for access to the Teams Export APIs:
The below will help you fill out the form quickly:
- Publisher Name: CloudCover 365
- Application Name: Put the name of the app that you use to add your Microsoft 365 organisation to the CloudCover365 Backup portal. You can find it in the Azure Active Directory -> App registrations
- Application ID(s) to enable permissions for (GUID, semicolon separated): Put the application (client) ID of the app that you use to add your Microsoft 365 organisation to the CloudCover 365 Backup portal. You can find it in the Azure Active Directory -> App registrations -> Overview of your app:
- Azure billing subscription ID as GUID – This is not a mandatory field but if you have an Azure subscription or want to setup a new one, there are instructions on the form itself. Please note you will need to provide your Azure subscription ID in order to go beyond the evaluation mode limit (500 messages).
- Which category best describes your application (select one): Select “Backup/restore”
- Why does your application need read access to all messages in the tenant? (If you don’t, you don’t need access to protected APIs): To allow for backup/protection of Teams message data
- Data retention (select one): Select “It is obvious to any admin installing this app that it will make a copy of Microsoft Teams messages”
- What are the tenant ID’s that this application needs to run in? (GUID, semicolon-separated. If you’re writing software for other organisations to use, include “all”): Put the tenant ID of your Microsoft 365 organisation that you protect with CloudCover365. You can find it in the Azure Active Directory -> Overview of your tenant:
Does your organisation own all those tenants? Yes. If you do not then you will be required to supply the Homepage, Terms of Service or Privacy Statement URL registered for the application ID.
May we contact you about your app’s use of non-protected APIs? Select Yes or No
When the form has been submitted, an email confirmation will be sent to the requestor.
Check-list
To continue protecting your Teams channel chats, you need to
- Be prepared for extra costs
- Apply for access to APIs from Microsoft (follow the form completion instructions above) please note that application requests can take 5-7 business days.
Once the application has been granted and the features are released in the latest version of CloudCover365:
- Grant permission for the CloudCover 365 Backup application to the ‘ChannelMessage.Read.All’ API within Microsoft Azure Portal
- Reconfigure your organisation in CloudCover 365 for Microsoft (Enable Teams Chat Backup)
- Reconfigure your Teams backup jobs.
If you have any questions about the new changes you can contact us here