Creating a new connection to Exchange Online (Microsoft 365)

To be able to back up your Exchange Online data in CodeTwo Backup, you first need to configure a connection to your environment. The program allows you to configure multiple connections to Microsoft 365 (Exchange Online).

You can configure a new connection to Exchange Online when creating a new backup job or directly from the program’s Dashboard, by clicking the Manage server connections button () on the Defined server connections card and selecting New > Exchange connection (Fig. 1.). Either way, the connection is configured in the Exchange connection wizard, as shown in Fig. 2.

Fig. 1. Creating a new Exchange connection.

Connecting to Microsoft 365 (Exchange Online)

CodeTwo Backup uses Modern Authentication (OAuth 2.0) to connect to Exchange Online. Because of that, you need to register the program in Microsoft Entra ID (Azure Active Directory) of the Microsoft 365 tenant whose Exchange Online data (mailboxes and public folders) you want to back up. The registration can be performed:

• Automatically by CodeTwo Backup,
• Manually in the Microsoft Entra admin center.

Automatic registration

In the Application registration step of the connection wizard, select Automatic registration and click Sign in as Microsoft 365 admin (Fig. 2.).

Fig. 2. Automatic registration of CodeTwo Backup in Entra ID.

On the Microsoft sign-in page, enter the credentials of your Microsoft 365 admin. Remember that your account must be assigned the Global Administrator or Privileged Role Administrator role. When prompted, grant the required permissions to CodeTwo Backup. These are necessary for the program to be able to back up and restore data from and to your Exchange Online environment (Fig. 3.).

Fig. 3. Granting the necessary permissions to CodeTwo Backup.

CodeTwo Backup will be registered as CodeTwo Backup Exchange Graph Edition in your Entra ID and signed with a unique certificate.

Manual registration

You can register CodeTwo Backup manually in your Microsoft Entra ID by following the steps provided in this Knowledge Base article. Once done, select Manual registration in the Application registration step of the Exchange connection wizard (Fig. 4.) and click Next.

Fig. 4. Select this option if you want to register CodeTwo Backup in your Entra ID by yourself.

In the Application details step, provide the following information:

• Dedicated application account – the email address of any user from your Microsoft 365 tenant. This account is used get the necessary information about the tenant (name, domain, etc.).
• Client ID – a unique identifier (GUID) assigned to CodeTwo Backup after the program has been registered in your Entra ID. To get this ID, sign in to the Microsoft Entra admin center, go to Entra ID > App registrations, click the All applications tab, and select the entry under which you have registered CodeTwo Backup. The ID is found on the Overview page, next to Application (client) ID (Fig. 5.).
• Tenant ID – a unique identifier (GUID) assigned to your Microsoft 365 tenant. You can find it on the same Overview page as shown in Fig. 5., next to Directory (tenant) ID.
• Certificate thumbprint or Client secret generated in Entra ID to authenticate CodeTwo Backup. You need to provide only one of these credentials. You can add or view certificates and client secrets (app passwords) in the Microsoft Entra admin center, on the Certificates & secrets page of the registered application (Fig. 6.).

Fig. 5. The client and tenant ID assigned to CodeTwo Backup in Entra ID.

Fig. 6. The location of a certificate thumbprint (A) and client secret (B) in Entra ID.

To be able to use a certificate, it needs to be signed with a 2048 bits key and placed in the personal certificate store of the currently logged in user and the account under which the CodeTwo Backup Service runs. You can use the Import button to install the certificate in the correct store (use the Import certificate window for that purpose, as shown in Fig. 7.). If the certificate is already installed in that store, you can simply provide its thumbprint in the Certificate thumbprint field.

Fig. 7. Importing the certificate associated with CodeTwo Backup.

Client secret is generated in the Microsoft Entra admin center for each registered application, on the Certificates & secrets page (see Fig. 6. above). Be sure to copy it to the clipboard and paste in the right field in the Exchange connection wizard (Fig. 8.). You will not be able to see (or copy) that credential once you leave the Certificates & secrets page.

Fig. 8. Application registration details filled out in the Exchange connection wizard.

Connection configuration

In the Configuration step, the program will attempt to connect to your Microsoft 365 tenant based on the data provided in the previous step(s) of the wizard. Click Configure and wait for the results (Fig. 9.). During this process, the program is registered in your Entra ID / Azure AD (if you have chosen the Automatic registration option) and verifies the connection with the Microsoft Graph API (used to perform backup and recovery tasks).

Fig. 9. Verifying the connectivity to Microsoft 365 (Exchange Online).

If you have successfully connected to Microsoft 365, click Finish to close the wizard. If you get any errors instead, consult the Troubleshooting section.

After confirming your connection settings, you will be able to use this connection to create backups of mailboxes and public folders residing in this Microsoft 365 tenant. Furthermore, you can also use this connection to restore backed-up Exchange Online data to that tenant.