Organizations with Modern App-Only Authentication

In this article

You can add Microsoft 365 organizations with modern app-only authentication and enabled security defaults.

Request

POST https://<hostname>:4443/v6/Organizations

Request Headers

The request header must contain an authorization token of the current session.

Request Parameters

None.

Request Body

The request body must contain the following properties:

Property	Type	Description
isExchangeOnline	boolean	Defines whether to add an Exchange Online organization.
exchangeOnlineSettings	exchangeOnlineSettings Object	Specifies the exchangeOnlineSettings object.
isSharePointOnline	boolean	Defines whether to add a SharePoint Online organization.
sharePointOnlineSettings	sharePointOnlineSettings Objects	Specifies the SharePointOnlineSettings object.
isTeamsOnline	boolean	Defines whether the added organization uses Microsoft Teams. If set to true, indicates that you will be able to back up Microsoft Teams data for this organization.
userCode	string	Specifies the device code. For more information on how to get a device code, see Getting Device Code. Note: To sign in to Microsoft Azure, open the Microsoft authentication portal and specify this device code.
type	string	Specifies the type of the organization you add. The following types are available: Office365 OnPremises Hybrid
newApplicationName	string	Specifies the name for the Azure AD application. Veeam Backup for Microsoft 365 automatically creates a new Azure AD application with this name in Microsoft Azure Active Directory. Required only when registering a new Azure AD applications,
configureApplication	boolean	Defines whether you want to let Veeam Backup for Microsoft 365 automatically assign the certificate and required permissions (Sites.FullControl.All) to the specified Azure AD application. Required only when using an existing Azure AD application.
region	string	Specifies the Microsoft Azure region. The following values are available: Worldwide USGovernment Germany China USDefence Required only when using an existing Azure AD application without configuring required permissions.

exchangeOnlineSettings Object

Property	Type	Description
account	string	Specifies the account name of your Exchange Online organization. Required only when using an existing Azure AD application without configuring required permissions.
applicationId	string	Specifies the identification number of the Azure AD application.
useApplicationOnlyAuth	boolean	Defines whether to use Azure AD application authentication.
useMfa	boolean	Defines whether to use multi-factor authentication (MFA).
applicationCertificate	string	Specifies the Base64 string of an SSL certificate that you want to use to access the Azure AD application. For more information on how to obtain a Base64 string, see Converting Certificate to Base64 String.
applicationCertificatePassword	string	Specifies the password for the specified certificate.

sharePointOnlineSettings Objects

Property	Type	Description
sharePointSaveAllWebParts	boolean	Defines whether to change export mode for SharePoint Web Parts to back up a customized content of SharePoint Online sites. For more information, see the Adding Organizations with Modern App-Only Authentication section of the Veeam Backup for Microsoft 365 User Guide.
officeOrganizationName	string	Specifies the name of your SharePoint Online organization. You must use the format: <name>.onmicrosoft.com. Required only when using an existing Azure AD application without configuring required permissions.
applicationId	string	Specifies the identification number of the Azure AD application.
useApplicationOnlyAuth	boolean	Defines whether to use Azure AD application authentication.
useMfa	boolean	Defines whether to use multi-factor authentication (MFA).
applicationCertificate	string	Specifies the Base64 string of an SSL certificate that you want to use to access the Azure AD application. For more information on how to obtain a Base64 string, see Converting Certificate to Base64 String.
applicationCertificatePassword	string	Specifies the password for the specified certificate.

Converting Certificate to Base64 String

If you want to use a certificate to access an Azure AD application, you must provide the certificate as a Base64 string. To obtain a Base64 string, perform the following steps:

Get the certificate content from a PFX file.
Convert the certificate to a Base64 string.

To do this, you can use the following PowerShell cmdlets:

$pfx_cert = get-content '<path_to_cert>' -Encoding Byte

[System.Convert]::ToBase64String($pfx_cert) | Out-File '<path_to_file>'

where:

<path_to_cert> — path to the PFX file that you want to convert to a Base64 string.
<path_to_file> — path to a file that that will contain the resulting Base64 string. You will be able to copy the Base64 string from the file and provide the string in the body of a request to Veeam Backup for Microsoft 365 REST API.

For example:

$pfx_cert = get-content 'C:\cert.pfx' -Encoding Byte

[System.Convert]::ToBase64String($pfx_cert) | Out-File 'C:\base64.txt'

Registering New Azure AD Application

The following is an example of registering a new Azure AD application in Microsoft Azure Active Directory.

Request:

POST https://abc.tech.local:4443/v6/Organizations

Request Header:

Authorization: Bearer <Access-Token>

Request Body:

{

"isTeamsOnline": true,

"isExchangeOnline": true

"exchangeOnlineSettings": {

"useApplicationOnlyAuth": true,

"useMfa": true,

"applicationCertificate": "MIIKEgIBAzCCCc4GCSqGSIb3DQEHAaCCCb8Eggm7MIIJtzCCBggGCSqGSIb3DQEHAaCCBfkEggX1MIIF8TCCBe0GCyqGSIb3DQEMCgECoIIE/jCCBPowHAYKKoZIhvcNAQwBAzAOBAg7S8DZJqMJuwICB9AEggTYsQotlTjAJnBl4ssVRewseXE+zDTZgr8i0FwJdrUYaR4pnmD/eKkcjIMmxLgBXF/yEUEPpBOUxksmtABLADc6+sY9L7OOPJPPuB+XtMOW0xBlLPHrf4AM18gsAjW116BmMP8Haf4nYAQHJ39idxF+7haVDNSYJJTgs0ijmyNxOJLqYQElHJYE9KshqT0lLDtc007EhyG2fh5/fcMeRg7iQpENkkBhtC86FXS1qmNtkUXNVWy8tnXkY2jy5DTi3Aqvb+1fAJpfbGIQRakYyA6fDWhpg/5pYJWSJCmStrbGpMiUlvuqqiGp1Ivwi+3kou6/DFYxA0SJ5pjUOBaLbibcHNReYU/Rszo+rG2jCKfRaD8O8DSdVeqoXruNtSQtzg0wr7/revx9BSJnq0qfEJXD2j4XO99fbw8i6chHkJbY5ABFKWLGQbx6DOB5kjYQKqNKluoKSUctN0H5I8w+miDOUf9sDu5UoiuMbpXoVewaOo76ftijYLBRcTJVFNVvxXBkScGX0NaQoUUywFpDiD402Y/B2z84ikb+h4WSmJQYEtSQY6VgoO+XdONX5ApNvMsAWwqef8awn4DngKzzFgcyVA7O2UDV6bY6F4Dj9ewd0OUMpqgHGpUBQub+hUvVAUfDIegPXo+2juR7zniNe+TXIWEXyA5frNa47ESTt6BgD4jpfdeG8al7R1BA2J8K/GRnKgwqwRKvoOrgC7rwS81xk6qb9DKZEgQJNrC5w2UOAO505wM/RiFglt5dVSrXr3IrTonRBewWY/lfIGXPPiqPLnO4gQuCa9AD2XSpsQAstbdpWdIuHFwCsmIXCZrlaNYE9pJn1lbliB/rL3DvawHdYlxT+7uRBTiDM+oVynG0EXCIE5uFl0Y71odlXZGK62HeB/LcjmdYCdiRs1RU5hLGw04Ap2RI4aQR3MOlVHEo9nXsXvfYMLpbcvuU2hCMIrmBtUfGaz+YV8M2tkKovRujmhYhDIyO4vRouP/S3lI6WnhSmSBdgO9YNDMGxglMi4aXTGBG2g7Ue3XIEx1hj6Ef5cGaCDH7ZRChc3SEQcGf6JcQirzKPnyWwU8fN8+AO4I88LngyfzPiiDlkiHWZ9hQe7aFa50o8Pu4xxOMokNzZr/HPYhe+ltG0Iz7n/cjSkhLZhXcpyt+qGcrVVuiGpYC5OOZ2lWnZoqsHN1uSoApCTrKudGAMKJ7aWNLTWtDAQyGbHAsmNUBIJxdj8Lh83L9KkcbdNbsgFCaL2gF05lYNizzMG/Ua7NUtZz+lUhXWURbALx/o6slS8WqWsGyMk8u65LqAk/Zzli3oS7GkRaMw8ilYGy3XOzdC5F4PimalbLJK0J844ijvv4nqdH77g76HNylamvDcAt01akomjIqeXaIFeXUrugHypOdCM//y82rmtNYJeflehmtUk2VbGO+4KXnrEkmRUYhL8GY38V1cqN1c3lKp59JIsqrdzopcuGCAKgpUi+EMQ7FcVzCXFmFPgyqbPn5C6N5DATCxBhLKLZc/AcQN4X3MKkONE2U3l2khJg7PaL623cYXgC5K8HJK1DdfkZnS9iBnXPwarh7LpHfgEJ3xw/EVYbud3dUkiA20D90925v0TjQ+jUcZYmqnOmOgf4VghY5oUgLC9gVuKaPLxj4l6DYEjGB2zATBgkqhkiG9w0BCRUxBgQEAQAAADBXBgkqhkiG9w0BCRQxSh5IADEANgBmADcAMwAxADAAYQAtADkANAAzADEALQA0ADMANABkAC0AOAA1AGQAMwAtAGUAMwAzAGEAZQA2ADIAMgAyADcAZgAxMGsGCSsGAQQBgjcRATFeHlwATQBpAGMAcgBvAHMAbwBmAHQAIABFAG4AaABhAG4AYwBlAGQAIABDAHIAeQBwAHQAbwBnAHIAYQBwAGgAaQBjACAAUAByAG8AdgBpAGQAZQByACAAdgAxAC4AMDCCA6cGCSqGSIb3DQEHBqCCA5gwggOUAgEAMIIDjQYJKoZIhvcNAQcBMBwGCiqGSIb3DQEMAQMwDgQIUnOtZxD5VBYCAgfQgIIDYOHSBxukmjmDHzJKupc8NjDzUHOT5siLEhiFN7AFnbdnqZtM3fF11oCQ+uXMFlWNWv42SlKOz6Th0qUj5FsNz6YLCm7kKDAutx1CFAA+UiNXS7Ea15e4IjLS/Rdeo7iGbt15oiHNeOhR/OSK30cbrAjiVIIvIM3c51qoKNNy+t6Of5B1enD7m7c+4Vlfd3pZh1cZw1TLD7Ht9FgizDh2/FwlgsBbkvvkWFTWcIg/+wz8GEMkQZO60iUCwqekFh2KJO27xNF226QLhPiH6dz5TBZOnUbgtz29ehAxZ4ivFJ4aJWI3+L2u1Eu1FdQHKjC4XBp7jbT/1K5KGeqkGYQ4P+wHVdzZYUWmlg2fPshn2DVOLdMFRL9j9+XWdPB+NF1KeiOo2rENYBl0WMonYdn9vgKLXedsQhmpLHsNyLmSCVcaSTBEFyRR6hlxL77flFhpTn1aJ7TiOCqAI1T25npOAQxdMfhwTwhrwaq5lYGr7EyWaOHakxHBQQRuWHun26asGxyz6YPU2vpFj9K1lCZ+TrDmKQS2wYUv/L5kYzDo8T66GukR0XCgpavCC2gzP9stfbgct1uvgDnnDq8KJrR0sEA/v68A03NIUdnyH4wa6HQfMZ8SUfdIOvMYejNUzxqm3en15NAhiAcd3xN7D/EXk1SNn4agZhyPPiqOCSXDhL30AjyNPsPB6kEimGxQKHy+oI90xwtK86t69oOkhGaJTVNulFH2G+mg2end+XeOAcR0Jj8JxGOcuFbhQVAZDGgljCEm94DmCHtYzz6ZP9GwVmgJGuRNGtJn8/5brv+ibL+Zpqe7dG5YY+BXDY2KoRnZSn2QMOKrQOgTu+/oQKspx4o5NCL2dOypP1pFjBNvSqXCxIu4nqOr9dCXc2f63XJ0S7HejUj4Ep3D1Vi6/Nh2mkZWNhiqtI7Cc9QAjo5DRd+OqjCIfP9s8FIXYnA5znyuQFNFVWDJ37AL2y/DFxPQTCosGCKnztZ/Ycurob+/FufJW7/gwmuFD6lgirWaSMaqc5JK2FZVvLS5VDd4k92/WKk+luxUdzEzGn4/PZfGrNJJcbQ6pLZS5c8QRc8rGYormvJIFUn2u4RJaRZGhLzRu2fpmIhWqWgwXtt8XVvrGJ3sdl1lHxPH+Cl+saXK0TTD7jA7MB8wBwYFKw4DAhoEFKcrbAfmDaDdM8n0qonvDola5JVsBBSOBZavEN2v/i1YfP42r9vRTMqXTwICB9A=",

"applicationCertificatePassword": "XXXXXX"

"isSharePointOnline": true,

"sharePointOnlineSettings": {

"sharePointSaveAllWebParts": true,

"useApplicationOnlyAuth": true,

"useMfa": true,

"applicationCertificatePassword": "XXXXXX"

"userCode": "C6A9DB737",

"type": "Office365",

"newApplicationName": "appcert"

}

Using Existing Azure AD Application

The following is an example of using an existing Azure AD application in your Microsoft Azure Active Directory.

Request:

POST https://abc.tech.local:4443/v6/Organizations

Request Header:

Authorization: Bearer <Access-Token>

Request Body:

{

"isTeamsOnline": true,

"isExchangeOnline": true,

"exchangeOnlineSettings": {

"applicationId": "eefb5987-1430-4768-a545-84c6abd1dbca",

"useApplicationOnlyAuth": true,

"useMfa": true,

"applicationCertificatePassword": "XXXXXX"

"isSharePointOnline": true,

"sharePointOnlineSettings": {

"sharePointSaveAllWebParts": true,

"applicationId": "eefb5987-1430-4768-a545-84c6abd1dbca",

"useApplicationOnlyAuth": true,

"useMfa": true,

"applicationCertificatePassword": "XXXXXX"

"userCode": "C5934W2HP",

"configureApplication": true,

"type": "Office365",

}

Using Existing Azure AD Application without Configuration

The following is an example of using an existing Azure AD application in your Microsoft Azure Active Directory without assigning required permissions or overwriting an existing certificate.

Request:

POST https://abc.tech.local:4443/v6/Organizations

Request Header:

Authorization: Bearer <Access-Token>

Request Body:

{

"isTeamsOnline": true,

"isExchangeOnline": true

"exchangeOnlineSettings": {

"account": "administrator@tech.club",

"applicationId": "eefb5987-1430-4768-a545-84c6abd1dbca",

"useApplicationOnlyAuth": true,

"useMfa": true,

"applicationCertificatePassword": "XXXXXX"

"isSharePointOnline": true,

"sharePointOnlineSettings": {

"sharePointSaveAllWebParts": true,

"officeOrganizationName": "tech.onmicrosoft.com",

"applicationId": "eefb5987-1430-4768-a545-84c6abd1dbca",

"useApplicationOnlyAuth": true,

"useMfa": true,

"applicationCertificatePassword": "XXXXXX"

"region": "worldwide",

"type": "Office365",

}

Response

The server returns the following response to the client.

Response Codes

A successfully completed operation returns a response code 200 OK.

Response Headers

The response to this request contains the following headers. The response may also include additional standard HTTPS headers.

Header	Description
Content-length	The length of the response body.
Content-type	The media type and syntax of the response body message: application/json; charset=utf-8

Response Body

The response body contains the following properties:

Property	Type	Description
exchangeOnlineSettings	object	Specifies the configuration of the Exchange Online organization.
sharePointOnlineSettings	object	Specifies the configuration of the SharePoint Online organization.
type	string	Specifies the type of the organization. The following types are available: Office365 OnPremises Hybrid
region	string	Specifies the Microsoft Azure region.
isExchangeOnline	boolean	Defines if the Exchange Online organization is added.
isSharePointOnline	boolean	Defines if the SharePoint Online organization is added.
isTeamsOnline	boolean	Defines if the added organization uses Microsoft Teams. If set to true, indicates that you will be able to back up Microsoft Teams data for this organization.
id	string	Specifies the identification number of the Microsoft 365 organization.
name	string	Specifies the name of the organization.
officeName	string	Specifies the Microsoft 365 Online name.
isBackedup	boolean	Defines if the organizations has backups.
firstBackuptime	string	Specifies when the first backup was created for the organization.
lastBackuptime	string	Specifies when the last backup was created for the organization.
_links	Dictionary of string [key] and Object [value]	Links to related resources (navigation property).

Response Example

Response:

200 OK

Response Body:

{

"isTeamsOnline": true,

"exchangeOnlineSettings": {

"useApplicationOnlyAuth": true,

"officeOrganizationName": "tech.onmicrosoft.com",

"account": "administrator@tech.club",

"grantAdminAccess": false,

"useMfa": true,

"applicationId": "eefb5987-1430-4768-a545-84c6abd1dbca",

"applicationCertificateThumbprint": "8F0B564280FBDD3B41C8AED9B5628AEE91BD319D"

"sharePointOnlineSettings": {

"useApplicationOnlyAuth": true,

"officeOrganizationName": "tech.onmicrosoft.com",

"sharePointSaveAllWebParts": false,

"account": "administrator@tech.club",

"grantAdminAccess": false,

"useMfa": true,

"applicationId": "eefb5987-1430-4768-a545-84c6abd1dbca",

"applicationCertificateThumbprint": "8F0B564280FBDD3B41C8AED9B5628AEE91BD319D"

"type": "Office365",

"region": "Worldwide",

"isExchangeOnline": true,

"isSharePointOnline": true,

"id": "2bf82204-7b65-43a5-a0ab-8579acaf1ac0",

"name": "tech.onmicrosoft.com",

"officeName": "abc.onmicrosoft.com",

"isBackedup": true,

"firstBackuptime": "2020-04-10T08:23:06.34196Z",

"lastBackuptime": "2020-04-15T22:00:18.7448159Z",

"_links": {

"self": {"href": "v6/organizations/2bf82204-7b65-43a5-a0ab-8579acaf1ac0"},

"jobs": {"href": "v6/organizations/2bf82204-7b65-43a5-a0ab-8579acaf1ac0/jobs"},

"groups": {"href": "v6/organizations/2bf82204-7b65-43a5-a0ab-8579acaf1ac0/groups"},

"users": {"href": "v6/organizations/2bf82204-7b65-43a5-a0ab-8579acaf1ac0/users"},

"sites": {"href": "v6/organizations/2bf82204-7b65-43a5-a0ab-8579acaf1ac0/sites"},
"teams": {"href": "v6/organizations/2bf82204-7b65-43a5-a0ab-8579acaf1ac0/teams"},

"usedRepositories": {"href": "v6/organizations/2bf82204-7b65-43a5-a0ab-8579acaf1ac0/usedRepositories"}

"_actions": {}

}