Authorization for Organizations with Modern Authentication and Legacy Protocols or Basic Authentication
To explore and restore backups using Veeam Backup for Microsoft 365 REST API, clients from tenant Microsoft 365 organizations added using modern authentication with legacy protocols allowed or basic authentication must authenticate themselves.
Tenants must use the same Microsoft organization credentials that they use to connect to the Veeam Backup for Microsoft 365 server on a service provider side for self-restore procedures using Veeam Explorers.
Veeam Backup for Microsoft 365 REST API authorization process is based on the OAuth 2.0 Authorization Framework and involves obtaining an access token and refresh token:
- Access token is a string that represents authorization issued to the client and must be used in all requests during the current session.
- Refresh token is a string that represents authorization granted to the client and can be used to obtain a new access token when the current access token expires.
Veeam Backup for Microsoft 365 REST API authorization process involves the following procedures:
To obtain a pair of tokens, a client sends the POST HTTPS request to the Veeam Backup for Microsoft 365 REST API token path. The request body must contain credentials for authenticating to the tenant Microsoft organization.
A successfully completed operation returns the 200 OK response code and an access and refresh tokens in the response body. The client inserts the access token in headers of further requests to Veeam Backup for Microsoft 365 REST API. The refresh token must be saved locally.
For more information on how to authorize your access using a client application, see Example Requests and Responses. Alternatively, you can use Swagger UI. For more information, see Evaluation in Swagger UI.
To obtain a new pair of tokens in case the access token expires or becomes invalid, the client sends the POST HTTPS request with the refresh token in the request body to the Veeam Backup for Microsoft 365 REST API token path. A successfully completed operation returns the 200 OK response code and a new pair of tokens in the response body.
The given access token expires in 60 minutes once issued. When the client finishes working with the Veeam Explorer for Microsoft Exchange, Veeam Explorer for Microsoft SharePoint, Veeam Explorer for Microsoft OneDrive for Business or Veeam Explorer for Microsoft Teams, they can stop the restore session manually. Otherwise, the session will be stopped automatically. For more information, see Stopping Restore Sessions.
The following example illustrates how the client and server communicate using requests and responses.
- To obtain access and refresh tokens, send the POST HTTPS request to the Veeam Backup for Microsoft 365 token path. In the request body, enter the credentials for authenticating to the tenant Microsoft organization.
Wait for the response from the server. A successfully completed operation returns the response code 200 OK.
".issued": "Mon, 13 Dec 2021 13:18:43 GMT",
".expires": "Mon, 13 Dec 2021 14:18:43 GMT"
The response body contains access and refresh tokens. Copy both tokens, insert an access token in headers of further requests. A refresh token must be saved locally.
- When an access token expires you can either obtain it again or renew using a refresh token. To renew the access token, send POST HTTPS request to the Veeam Backup for Microsoft 365 token path. In the request body, enter the refresh token.
Wait for the response from the server. A successfully completed operation returns response code 200 OK and a new pair of tokens in the response body.