Every click from a brand-new account to your first verified backup. Most organizations finish in about 15 minutes — no agents, no consultants, no PowerShell.
Go to backup365now.com/app and choose Create organization. Enter your company name, your email address, and a password, then complete the image captcha.
Click the verification link we email you, then sign in. Your account is the owner of the organization — you can invite admins, backup users, and viewers later from Portal users. Your free 15-day trial starts now; no credit card is needed.
Backup365 reads your tenant through Microsoft Graph using an app registration that stays in your tenant, under your control.
Sign in to the Azure portal as a Global Administrator and go to Microsoft Entra ID → App registrations → New registration.
Backup365Click Register. On the app's Overview page, copy two values you'll paste into Backup365 later: the Directory (tenant) ID and the Application (client) ID.
| Display name | Backup365 |
| Application (client) ID | 4f8a12de-93b1-47c6-a1e0-… ⧉
copy #1 |
| Directory (tenant) ID | b2c94a07-5d28-4f11-90c3-… ⧉
copy #2 |
| Object ID | 7d31c5f9-…
not needed |
Open API permissions → Add a permission → Microsoft Graph → Application permissions (not "Delegated"). Search for and add each of these:
| ☑ | Mail.ReadRead mail in all mailboxes |
| ☐ | Mail.ReadBasic.AllRead basic mail in all mailboxes |
What they're for:
User.Read.All — list the users you can protectMail.Read — mailboxes and in-place archivesFiles.Read.All — OneDrive filesCalendars.Read / Contacts.Read — calendars and contactsSites.Read.All — SharePoint document librariesGroup.Read.All — Teams enumeration and group mailboxesChat.Read.All / ChannelMessage.Read.All — Teams chats and channel messagesNotes.Read.All — OneNote notebooksOptional — only if you want in-place Restore: also
add Mail.ReadWrite, Files.ReadWrite.All,
Calendars.ReadWrite, and Contacts.ReadWrite.
Backups never write to your tenant; these are used solely when an
owner or admin runs a restore. You can add them later at any time.
Still on API permissions, click Grant admin consent for <your organization> and confirm. Every permission's status should change to a green "Granted" check mark. This is the step people miss most often — without it, the connection test will fail.
| API / Permission name | Type | Status |
|---|---|---|
Mail.Read | Application | ✓ Granted for Contoso |
User.Read.All | Application | ✓ Granted for Contoso |
Files.Read.All | Application | ✓ Granted for Contoso |
Sites.Read.All | Application | ✓ Granted for Contoso |
Teams note: Microsoft additionally gates Teams message export behind a separate protected API approval. Everything else works immediately; submit that form only if you need Teams chat and channel-message backup.
Go to Certificates & secrets → Client secrets → New client secret. Give it a description, pick an expiry (12–24 months is typical), and click Add.
Copy the "Value" column immediately — it is shown only once. Do not copy the "Secret ID" column; that is a different string and the most common cause of a failed connection test. Set a calendar reminder before the secret expires: you'll create a new one and paste it into Backup365 the same way.
| Description | Value | Secret ID |
|---|---|---|
| Backup365 secret | 3dQ8Q~kV2xr… ⧉
copy this |
a91c47e2-…
not this |
Back in Backup365, open Connect Microsoft 365 and paste the Directory (tenant) ID, the Application (client) ID, and the client secret value. Click Save connection, then Test connection.
On success you'll see how many directory users are visible. Your secret is encrypted at rest, and Backup365 never stores Graph access tokens.
Open Protected users. Every directory user is listed with checkboxes for Mail, OneDrive, Calendar, Contacts, and Teams chats. Tick what you want per user — or use "Select everything for everyone" to enable all sources for all selected users in one click.
Open Company backups to protect shared content: SharePoint sites, Teams channel messages, Microsoft 365 group mailboxes, in-place archive mailboxes, and OneNote notebooks. Each item is selectable individually.
Open Schedule and pick a cadence from hourly to weekly — after the first full run, backups are incremental and only transfer changes. To start immediately, go to Backup jobs and click Run backup now (you can also run it for specific users only). Watch live progress on Backup status; every object is SHA-256 hashed and verified automatically.
The four issues that cause nearly every failed setup:
You most likely pasted the client secret's Secret ID instead of its Value. Create a new secret, copy the Value column this time, and paste it in. Also double-check the tenant and client IDs for stray spaces.
Grant admin consent wasn't clicked (or was clicked by a non-admin). Return to API permissions in the Azure portal and confirm every row shows a green "Granted" check mark, then test again.
Teams message APIs are protected. Apply for protected API access with your app's client ID, or simply leave Teams messages unselected — all other sources work without it.
Client secrets expire. Create a new secret in Certificates & secrets, paste the new Value into Connect Microsoft 365 (leave the other two fields as they are), save, and run Test connection.
Start your free 15-day trial — full access to every feature, no credit card required.
Start your free 15-day trial