Backup Data Restored, Copied, Downloaded, or Exported

Sent when a user restores, copies, downloads, or exports backed-up data.

General Information

Event ID: vdc.workload_v0.tenant_v0.restore.execution_v0.config_v0

Event message details: Sent with data.config.destinationKind set to RESTORE, COPY, DOWNLOAD or EXPORT.

Severity: Info

Workloads: Veeam Data Cloud for Microsoft 365

Parameters

The parameter set is the same for every source that sends this event.

Parameters
Parameter Name	Description	Example
specversion	Event schema version.	ev20260814
source	System that sent the event. Possible values: CONTROLPLANE, M365.	M365
timestamp	Time when the event happened, in RFC3339Nano format and the UTC time zone.	2026-08-04T09:18:42Z
type	Event ID.	vdc.workload_v0.tenant_v0.restore.execution_v0.config_v0
severity	Event severity. Possible values: INFO, LOW, MEDIUM, HIGH, CRITICAL.	INFO
visibility	Intended visibility scope of the event. Only events with the CUSTOMER_ACCESSIBLE value are forwarded to SIEM platforms, so a forwarded event always carries this value.	CUSTOMER_ACCESSIBLE
category	Event category. Possible values: BACKUP, RESTORE, LOGIN, USER_MANAGEMENT, TENANT_MANAGEMENT, ORGANIZATION_MANAGEMENT, SUBSCRIPTION_MANAGEMENT, SECURITY_ALERT, INTERNAL.	RESTORE
actor.identifier	Actor identifier.	alice@example.com
actor.kind	Actor type that triggered the event. Possible values: user, system, service_account.	user
organizationReference.workloadTenantId	Workload tenant ID.	tenant_12345
orgId	ID of the Veeam Data Cloud organization that the event belongs to. Resolved during event processing, so it is present even when the event references only a workload tenant.	org_12345
data.workload.type	Workload type.	M365
data.tenant.id	Tenant ID.	tenant_12345
data.execution.id	Restore execution ID.	execution_12345
data.config.collisionHandling	How the restore behaves if an item-level collision is detected. Possible values: SKIP, REPLACE, DUPLICATE.	SKIP
data.config.destinationKind	Restore operation type. Possible values: RESTORE, COPY, DOWNLOAD, EXPORT.	RESTORE
data.config.destinationTenantId	Destination tenant ID. May be the same as the tenant that sourced the restored data.	tenant_12345
data.config.objectTypes	Set of object types being restored.	["Exchange", "OneDrive"]
data.config.reason	Explanation of why the restore was run, provided by the user that started the execution.	Recovering items deleted in error.
data.config.scope	High-level details about the objects and items selected for restore. The property has no fixed schema; each workload provides the details it considers necessary.

Event Example

{
  "specversion": "ev20260814",
  "source": "M365",
  "timestamp": "2026-08-04T09:18:42Z",
  "type": "vdc.workload_v0.tenant_v0.restore.execution_v0.config_v0",
  "severity": "INFO",
  "visibility": "CUSTOMER_ACCESSIBLE",
  "category": "RESTORE",
  "actor": {
    "identifier": "alice@example.com",
    "kind": "user"
  },
  "organizationReference": {
    "workloadTenantId": "tenant_12345"
  },
  "orgId": "org_12345",
  "data": {
    "workload": {
      "type": "M365"
    },
    "tenant": {
      "id": "tenant_12345"
    },
    "execution": {
      "id": "execution_12345"
    },
    "config": {
      "collisionHandling": "SKIP",
      "destinationKind": "RESTORE",
      "destinationTenantId": "tenant_12345",
      "objectTypes": [
        "Exchange",
        "OneDrive"
      ],
      "reason": "Recovering items deleted in error."
    }
  }
}