Kiến Trúc Bảo Vệ Cloud & M365

[VBR Main (VSA Cluster)]
        │
        ├── [Veeam Backup for M365 Server] (separate VM – NOT shared with VBR)
        │       ├── Exchange Online ──────────→ S3-M365-Bucket (immutable 90d)
        │       ├── SharePoint Online ─────────→ S3-M365-Bucket (immutable 90d)
        │       ├── OneDrive ─────────────────→ S3-M365-Bucket (immutable 90d)
        │       └── Teams ────────────────────→ S3-M365-Bucket (immutable 90d)
        │               Auth: Modern Auth (OAuth 2.0) via Azure App Registration
        │
        └── [VBR Agent Jobs] → Cloud VMs (AWS / Azure)
                ├── AWS EC2 instances  ──────→ SOBR-Enterprise (same as on-prem)
                ├── Azure VMs ───────────────→ SOBR-Enterprise (same as on-prem)
                └── Reports to: VBR Main Console (unified management)

Legend:
  VSA Cluster  = VBR HA Cluster (Phase 01–02)
  SOBR-Enterprise = Scale-Out Backup Repository (Phase 04)
  S3-M365-Bucket  = Dedicated S3 bucket, NEVER shared with SOBR

So Sánh Phương Thức Xác Thực M365

VM Requirements — Veeam Backup for M365 Server

Storage Sizing Formula — S3 Bucket for M365

# Formula
S3 Bucket Size = users × data_per_user_GB × growth_factor × retention_years

# Example: 500 users, 1-year retention, 30% annual growth
= 500 × 5 GB × 1.3 (growth factor) × 1 year
= 500 × 5 × 1.3
= 3,250 GB ≈ 3.25 TB

# Example: 500 users, 3-year retention (compliance)
= 500 × 5 GB × 1.3 × 3
= 9,750 GB ≈ 9.75 TB

# Rule of thumb:
#   Plan 5–8 GB per user per year (email heavy: use 8 GB)
#   Add 30% growth buffer
#   Compliance retention (3+ years): multiply accordingly

Các Bước Triển Khai

Installation type: Custom (not Express)
Components:
  ✅ Veeam Backup for Microsoft 365 Server
  ✅ Veeam Backup for Microsoft 365 REST API
  ✅ Veeam Explorers (Exchange, SharePoint, Teams, OneDrive)
Web UI default port: 4443
Service account: DOMAIN\svc-veeam-m365 (local admin)
SQL: Connect to existing SQL Server (recommended) or SQL Express

AWS Console → S3 → Create bucket:
  Bucket name: veeam-m365-backups-[company]  ← SEPARATE from SOBR bucket!
  Region: ap-southeast-1 (same region as VBR)
  Versioning: Enabled (required for immutability)
  Object Lock: Enabled, Compliance mode, 90 days
  Encryption: SSE-S3 (AES-256)
  Block Public Access: All enabled
  Access: Create dedicated IAM user with S3 permissions only

Quy Trình Kết Nối M365 Tenant

Organization name: Company Corp M365
Region: Worldwide (or specific if GCC/DoD)
Authentication type: ● Modern Authentication (OAuth 2.0)  ← SELECT THIS
App registration: ● Create new Azure AD application automatically  ← RECOMMENDED

Azure Portal → Azure Active Directory → App Registrations
→ Find: "Veeam Backup for Microsoft 365 - [timestamp]"
→ API Permissions → Grant admin consent for [YourDomain]
→ Confirm: All permissions show green checkmark ✓
→ Copy: Application (client) ID  ← save for troubleshooting

Tổng Quan 4 Backup Jobs

Exchange Online Job — Cấu Hình Chi Tiết (Hourly)

Jobs → Add Job → Microsoft Exchange
→ Name: M365-Exchange-Hourly
→ Organization: Company Corp M365
→ Objects: ● All mailboxes (include shared mailboxes ✅, resource mailboxes ✅)
→ Backup repository: S3-M365-Backup
→ Schedule:
    Run job automatically: ✅
    Schedule type: ● Periodically every: 1 Hours
    Start at: 00:00 (midnight, first run)
    → Job will run at: 00:00, 01:00, 02:00 ... 23:00
→ Retention:
    Restore points to keep: 365 (1 year of daily)
    Keep legal hold items: ✅ (never delete items on legal hold)
→ Notification:
    Email on failure: [email protected]
    Email on warning: [email protected]
→ Advanced:
    Item-level indexing: ✅ (enables search in individual emails)
    Backup public folders: ✅
    Include archive mailboxes: ✅

# COMPLIANCE NOTE:
# Hourly backup = worst case email loss = 1 hour
# Required for ISO 27001 and GDPR compliance in most frameworks
# Each restore point allows recovering individual emails

Cấu Hình Veeam Restore Portal

# Veeam M365 Console → Restore Portal
Console → Settings → Restore Portal

Step 1 - Enable Portal:
  Restore Portal: ● Enable
  URL: https://veeam-m365.domain.local:4443/restore
  Certificate: [upload SSL cert or use self-signed for internal]

Step 2 - Add Restore Operators (Helpdesk accounts):
  → Add Restore Operator:
    User/Group: DOMAIN\helpdesk-tier1 (AD group)
    Roles: ● Restore Operator
    Scope: Exchange mailboxes in OU=HCM-Users (limit to their region)

  → Add Restore Operator:
    User/Group: DOMAIN\it-manager
    Roles: ● Restore Operator
    Scope: All objects (unrestricted for manager)

Step 3 - Configure Allowed Restore Operations:
  ✅ Restore to original location
  ✅ Export to PST/EML
  ✅ Send to user's mailbox as attachment
  ❌ Restore to different user's mailbox (security risk - disable)
  ❌ Delete items permanently (disable)

Step 4 - Branding (optional):
  Company name: [Your Company] IT Support
  Logo: upload company logo
  Support email: [email protected]

So Sánh Lựa Chọn Bảo Vệ Cloud VMs

Cấu Hình Azure Cloud Credentials

# Step 1: Add Azure Account to VBR
VBR Console → Backup Infrastructure → Cloud Credentials → Add
→ Type: Microsoft Azure
→ Authentication: ● Microsoft Azure Active Directory
→ Subscription ID: [your-azure-subscription-id]
→ Tenant ID: [your-azure-tenant-id]
→ Client ID: [app-registration-client-id]
→ Client Secret: [app-registration-secret]
→ Display Name: Azure-DR-Account

# Required Azure RBAC permissions for VBR service principal:
az role assignment create \
  --assignee [client-id] \
  --role "Contributor" \
  --scope /subscriptions/[subscription-id]

# Step 2: Configure default restore settings
→ Resource Group: rg-veeam-dr-restore
→ Virtual Network: vnet-dr-isolated (ISOLATED from production!)
→ Subnet: snet-dr-testing
→ Storage Account: stveaamdrtesting (for temp disks)
→ Region: Southeast Asia (or closest to on-prem)