BackupRestore-Configuration.ReadWrite.All

Allows the app to read and update the backup configuration, and list of Microsoft 365 service resources to be backed-up, on behalf of the signed in user.

Merill's Note

For an app to access data in Microsoft Graph, the user or administrator must grant it the permissions it needs. This article lists all the Microsoft Graph APIs and your tenant data that can be accessed by the application (vendor/developer) if you consent to the BackupRestore-Configuration.ReadWrite.All permission.

If you need to create an audit report of the permissions granted to all the apps in your tenant, you can run the Export-MsIdAppConsentGrantReport command. See How To: Run a quick OAuth app audit of your tenant

Category	Application	Delegated
Identifier	18133149-5489-40ac-80f0-4b6fa85f6cdc	a0244d16-171c-4496-8ffb-7b9b6954d339
DisplayText	Read and edit all backup configuration policies	Read and edit backup configuration policies
Description	Allows the app to read and update the backup configuration, and list of Microsoft 365 service resources to be backed-up, without a signed-in user.	Allows the app to read and update the backup configuration, and list of Microsoft 365 service resources to be backed-up, on behalf of the signed in user.
AdminConsentRequired	Yes	Yes

Graph Methods

→ API supports delegated access (access on behalf of a user)
→ API supports app-only access (access without a user)

	Methods
	DELETE /solutions/backupRestore/exchangeProtectionPolicies/{exchangeProtectionPolicyId}/mailboxInclusionRules/{mailboxProtectionRuleId}
	DELETE /solutions/backupRestore/oneDriveForBusinessProtectionPolicies/{oneDriveForBusinessProtectionPolicyId}/driveInclusionRules/{driveProtectionRuleId}
	DELETE /solutions/backupRestore/protectionPolicies/{protectionPolicyBaseId}
	DELETE /solutions/backupRestore/sharePointProtectionPolicies/{sharePointProtectionPolicyId}/siteInclusionRules/{siteProtectionRuleId}
	GET /solutions/backupRestore/exchangeProtectionPolicies/{exchangeProtectionPolicyId}/mailboxInclusionRules
	GET /solutions/backupRestore/exchangeProtectionPolicies/{exchangeProtectionPolicyId}/mailboxInclusionRules/{mailboxProtectionRuleId}
	GET /solutions/backupRestore/oneDriveForBusinessProtectionPolicies/{oneDriveForBusinessProtectionPolicyId}/driveInclusionRules
	GET /solutions/backupRestore/oneDriveForBusinessProtectionPolicies/{oneDriveForBusinessProtectionPolicyId}/driveInclusionRules/{driveProtectionRuleId}
	GET /solutions/backupRestore/sharePointProtectionPolicies/{sharePointProtectionPolicyId}/siteInclusionRules
	GET /solutions/backupRestore/sharePointProtectionPolicies/{sharePointProtectionPolicyId}/siteInclusionRules/{siteProtectionRuleId}
	PATCH /solutions/backupRestore/exchangeProtectionPolicies/{exchangeProtectionPolicyId}
	PATCH /solutions/backupRestore/oneDriveForBusinessProtectionPolicies/{oneDriveForBusinessProtectionPolicyId}
	PATCH /solutions/backupRestore/sharePointProtectionPolicies/{sharePointProtectionPolicyId}
	POST /solutions/backupRestore/exchangeProtectionPolicies/
	POST /solutions/backupRestore/exchangeProtectionPolicies/{exchangeProtectionPolicyId}/mailboxInclusionRules
	POST /solutions/backupRestore/exchangeProtectionPolicies/{exchangeProtectionPolicyId}/mailboxInclusionRules/{mailboxProtectionRuleId}/run
	POST /solutions/backupRestore/oneDriveForBusinessProtectionPolicies
	POST /solutions/backupRestore/oneDriveForBusinessProtectionPolicies/{oneDriveForBusinessProtectionPolicyId}/driveInclusionRules
	POST /solutions/backupRestore/oneDriveForBusinessProtectionPolicies/{oneDriveForBusinessProtectionPolicyId}/driveInclusionRules/{driveProtectionRuleId}/run
	POST /solutions/backupRestore/protectionPolicies/{protectionPolicyBaseId}/activate
	POST /solutions/backupRestore/protectionPolicies/{protectionPolicyBaseId}/deactivate
	POST /solutions/backupRestore/sharePointProtectionPolicies/
	POST /solutions/backupRestore/sharePointProtectionPolicies/{sharePointProtectionPolicyId}/siteInclusionRules
	POST /solutions/backupRestore/sharePointProtectionPolicies/{sharePointProtectionPolicyId}/siteInclusionRules/{siteProtectionRuleId}/run

→ API supports delegated access (access on behalf of a user)
→ API supports app-only access (access without a user)

	Methods
	DELETE /solutions/backupRestore/exchangeProtectionPolicies/{exchangeProtectionPolicyId}/mailboxInclusionRules/{mailboxProtectionRuleId}
	DELETE /solutions/backupRestore/oneDriveForBusinessProtectionPolicies/{oneDriveForBusinessProtectionPolicyId}/driveInclusionRules/{driveProtectionRuleId}
	DELETE /solutions/backupRestore/protectionPolicies/{protectionPolicyBaseId}
	DELETE /solutions/backupRestore/sharePointProtectionPolicies/{sharePointProtectionPolicyId}/siteInclusionRules/{siteProtectionRuleId}
	GET /solutions/backupRestore/exchangeProtectionPolicies/{exchangeProtectionPolicyId}/mailboxInclusionRules
	GET /solutions/backupRestore/exchangeProtectionPolicies/{exchangeProtectionPolicyId}/mailboxInclusionRules/{mailboxProtectionRuleId}
	GET /solutions/backupRestore/oneDriveForBusinessProtectionPolicies/{oneDriveForBusinessProtectionPolicyId}/driveInclusionRules
	GET /solutions/backupRestore/oneDriveForBusinessProtectionPolicies/{oneDriveForBusinessProtectionPolicyId}/driveInclusionRules/{driveProtectionRuleId}
	GET /solutions/backupRestore/sharePointProtectionPolicies/{sharePointProtectionPolicyId}/siteInclusionRules
	GET /solutions/backupRestore/sharePointProtectionPolicies/{sharePointProtectionPolicyId}/siteInclusionRules/{siteProtectionRuleId}
	PATCH /solutions/backupRestore/exchangeProtectionPolicies/{exchangeProtectionPolicyId}
	PATCH /solutions/backupRestore/exchangeProtectionPolicies/{exchangeProtectionPolicyId}/mailboxInclusionRules/{mailboxProtectionRuleId}
	PATCH /solutions/backupRestore/oneDriveForBusinessProtectionPolicies/{oneDriveForBusinessProtectionPolicyId}
	PATCH /solutions/backupRestore/oneDriveForBusinessProtectionPolicies/{oneDriveForBusinessProtectionPolicyId}/driveInclusionRules/{driveProtectionRuleId}
	PATCH /solutions/backupRestore/sharePointProtectionPolicies/{sharePointProtectionPolicyId}
	POST /solutions/backupRestore/exchangeProtectionPolicies/
	POST /solutions/backupRestore/exchangeProtectionPolicies/{exchangeProtectionPolicyId}/mailboxInclusionRules
	POST /solutions/backupRestore/exchangeProtectionPolicies/{exchangeProtectionPolicyId}/mailboxInclusionRules/{mailboxProtectionRuleId}/deleteAndUnprotect
	POST /solutions/backupRestore/exchangeProtectionPolicies/{exchangeProtectionPolicyId}/mailboxInclusionRules/{mailboxProtectionRuleId}/run
	POST /solutions/backupRestore/oneDriveForBusinessProtectionPolicies
	POST /solutions/backupRestore/oneDriveForBusinessProtectionPolicies/{oneDriveForBusinessProtectionPolicyId}/driveInclusionRules
	POST /solutions/backupRestore/oneDriveForBusinessProtectionPolicies/{oneDriveForBusinessProtectionPolicyId}/driveInclusionRules/{driveProtectionRuleId}/deleteAndUnprotect
	POST /solutions/backupRestore/oneDriveForBusinessProtectionPolicies/{oneDriveForBusinessProtectionPolicyId}/driveInclusionRules/{driveProtectionRuleId}/run
	POST /solutions/backupRestore/protectionPolicies/{protectionPolicyBaseId}/activate
	POST /solutions/backupRestore/protectionPolicies/{protectionPolicyBaseId}/deactivate
	POST /solutions/backupRestore/protectionUnits/{protectionUnitBaseId}/cancelOffboard
	POST /solutions/backupRestore/protectionUnits/{protectionUnitBaseId}/offboard
	POST /solutions/backupRestore/sharePointProtectionPolicies/
	POST /solutions/backupRestore/sharePointProtectionPolicies/{sharePointProtectionPolicyId}/siteInclusionRules
	POST /solutions/backupRestore/sharePointProtectionPolicies/{sharePointProtectionPolicyId}/siteInclusionRules/{siteProtectionRuleId}/run

→ Command supports delegated access (access on behalf of a user)
→ Command supports app-only access (access without a user)

	Commands
	Get-MgSolutionBackupRestoreExchangeProtectionPolicyMailboxInclusionRule
	Get-MgSolutionBackupRestoreOneDriveForBusinessProtectionPolicyDriveInclusionRule
	Get-MgSolutionBackupRestoreSharePointProtectionPolicySiteInclusionRule
	Initialize-MgSolutionBackupRestoreProtectionPolicy
	Invoke-MgDeactivateSolutionBackupRestoreProtectionPolicy
	New-MgSolutionBackupRestoreExchangeProtectionPolicy
	New-MgSolutionBackupRestoreOneDriveForBusinessProtectionPolicy
	New-MgSolutionBackupRestoreSharePointProtectionPolicy
	Remove-MgSolutionBackupRestoreProtectionPolicy
	Update-MgSolutionBackupRestoreExchangeProtectionPolicy
	Update-MgSolutionBackupRestoreOneDriveForBusinessProtectionPolicy
	Update-MgSolutionBackupRestoreSharePointProtectionPolicy

→ Command supports delegated access (access on behalf of a user)
→ Command supports app-only access (access without a user)

	Commands
	Get-MgBetaSolutionBackupRestoreExchangeProtectionPolicyMailboxInclusionRule
	Get-MgBetaSolutionBackupRestoreOneDriveForBusinessProtectionPolicyDriveInclusionRule
	Get-MgBetaSolutionBackupRestoreSharePointProtectionPolicySiteInclusionRule
	Initialize-MgBetaSolutionBackupRestoreProtectionPolicy
	Invoke-MgBetaDeactivateSolutionBackupRestoreProtectionPolicy
	Invoke-MgBetaOffboardSolutionBackupRestoreProtectionUnit
	New-MgBetaSolutionBackupRestoreExchangeProtectionPolicy
	New-MgBetaSolutionBackupRestoreOneDriveForBusinessProtectionPolicy
	New-MgBetaSolutionBackupRestoreSharePointProtectionPolicy
	Remove-MgBetaSolutionBackupRestoreProtectionPolicy
	Stop-MgBetaSolutionBackupRestoreProtectionUnitOffboard
	Update-MgBetaSolutionBackupRestoreExchangeProtectionPolicy
	Update-MgBetaSolutionBackupRestoreOneDriveForBusinessProtectionPolicy
	Update-MgBetaSolutionBackupRestoreSharePointProtectionPolicy

Resources

Granting this permission allows the calling application to access (and/or update) the following information in your tenant.

Graph reference: driveProtectionRule

Property	Type	Description
id	String	The unique identifier of the protection rule associated with the policy.
createdBy	identitySet entitySet	The identity of the person who created the rule.
createdDateTime	DateTimeOffset	The date and time that the rule was created.
driveExpression	String	Contains a drive expression. For examples, see driveExpression examples.
error	publicError	If the operation fails, contain the details of the error.
isAutoApplyEnabled	Boolean	`true` indicates that the protection rule is dynamic; `false` that it's static. Static rules run one time while dynamic rules listen to all changes in the system and update the protection unit list. Currently, only static rules are supported.
lastModifiedBy	identitySet	Identity of the person who last modified this rule.
lastModifiedDateTime	DateTimeOffset	The timestamp of the last modification to this rule.
status	protectionRuleStatus	The status of the protection rule. The following are the possible values: `draft`, `active`, `completed`, `completedWithErrors`, `unknownFutureValue`.

Graph reference: driveProtectionUnit

Property	Type	Description
createdBy	identitySet	The identity of person who created the protection unit. Inherited from protectionUnitBase.
createdDateTime	DateTimeOffset	The time of creation of the protection unit. Inherited from protectionUnitBase.
directoryObjectId	String	ID of the directory object.
displayName	String	Display name of the directory object.
email	String	Email associated with the directory object.
error	publicError	Details of the error if the enablement/disablement of the protection unit fails. Inherited from protectionUnitBase.
id	String	Unique identifier of the protection policy associated with this protection unit.
lastModifiedBy	identitySet	The identity of person who last modified the protection unit. Inherited from protectionUnitBase.
lastModifiedDateTime	DateTimeOffset	The time of last modification of the protection unit. Inherited from protectionUnitBase.
policyId	String	Unique identifier of the protection policy associated with this protection unit. Inherited from protectionUnitBase.
status	protectionUnitStatus	The individual enablement/disablement/removal status of the protection unit. Inherited from protectionUnitBase. The possible values are: `protectRequested`, `protected`, `unprotectRequested`, `unprotected`, `removeRequested`, `unknownFutureValue`.

Graph reference: exchangeProtectionPolicy

Property	Type	Description
id	String	The unique identifier of the protection rule associated to the policy.
displayName	String	Name of the policy to be created.
createdDateTime	DateTimeOffset	The time of creation of the policy.
createdBy	identitySet	The identity of person who created the policy.
lastModifiedBy	identitySet	The identity of the person who last modified the policy.
lastModifiedDateTime	DateTimeOffset	The timestamp of the last modification of the policy.
status	protectionPolicyStatus	Status of the policy. This value is an aggregated status of the protection units. The possible values are: `inactive`, `activeWithErrors`, `updating`, `active`, `unknownFutureValue`.

Graph reference: mailboxProtectionRule

Property	Type	Description
id	String	The unique identifier of the protection rule associated with the policy.
createdBy	identitySet	The identity of the person who created the rule.
createdDateTime	DateTimeOffset	The date and time that the rule was created.
error	publicError	Contains error details if an operation on a rule expression fails.
isAutoApplyEnabled	Boolean	`true` indicates that the protection rule is dynamic; `false` that it's static. Static rules run one time while dynamic rules listen to all changes in the system and update the protection unit list. Currently, only static rules are supported.
lastModifiedBy	identitySet	Identity of the person who last modified this rule.
lastModifiedDateTime	DateTimeOffset	Timestamp of last modification to the rule.
mailboxExpression	String	Contains a mailbox expression. For examples, see mailboxExpression examples.
status	protectionRuleStatus	Status of the protection rule. The possible values are: `draft`, `active`, `completed`, `completedWithErrors`, `unknownFutureValue`. The `draft` member is currently unsupported.

Graph reference: mailboxProtectionUnit

Property	Type	Description
createdBy	identitySet	The identity of person who created the protection unit. Inherited from protectionUnitBase.
createdDateTime	DateTimeOffset	The time of creation of the protection unit. Inherited from protectionUnitBase.
directoryObjectId	String	The ID of the directory object.
displayName	String	Display name of the directory object.
email	String	Email address associated with the directory object.
error	publicError	Contains error details if enabling or disabling the protection unit fails. Inherited from protectionUnitBase.
id	String	Unique identifier of the protection policy associated with this protection unit.
lastModifiedBy	identitySet	The identity of person who last modified the protection unit. Inherited from protectionUnitBase.
lastModifiedDateTime	DateTimeOffset	The time the protection unit was last modified. Inherited from protectionUnitBase.
policyId	String	Unique identifier of the protection policy associated with this protection unit. Inherited from protectionUnitBase.
status	protectionUnitStatus	The individual enable, disable, or removal status of the protection unit. Inherited from protectionUnitBase.The possible values are: `protectRequested`, `protected`, `unprotectRequested`, `unprotected`, `removeRequested`, `unknownFutureValue`.

Graph reference: oneDriveForBusinessProtectionPolicy

Property	Type	Description
id	String	The unique identifier of the protection rule associated with the policy.
displayName	String	The name of the policy to be created.
createdDateTime	DateTimeOffset	The time of creation of the policy.
createdBy	identitySet	The identity of person who created the policy.
lastModifiedBy	identitySet	The identity of the person who last modified the policy.
lastModifiedDateTime	DateTimeOffset	The timestamp of the last modification of the policy.
status	protectionPolicyStatus	Status of the policy. The value is the aggregated status of the protection units. The possible values are: `inactive`, `activeWithErrors`, `updating`, `active`, `unknownFutureValue`.

Graph reference: protectionPolicyBase

Property	Type	Description
id	String	The unique identifier of the protection rule associated with the policy.
displayName	String	The name of the policy to be created.
createdDateTime	DateTimeOffset	The time of creation of the policy.
createdBy	identitySet	The identity of person who created the policy.
lastModifiedBy	identitySet	The identity of the person who last modified the policy.
lastModifiedDateTime	DateTimeOffset	The timestamp of the last modification of the policy.
retentionSettings	retentionSetting collection	Contains the retention setting details for the policy.
status	protectionPolicyStatus	The aggregated status of the protection units associated with the policy. The possible values are: `inactive`, `activeWithErrors`, `updating`, `active`, `unknownFutureValue`.

Graph reference: protectionRuleBase

Property	Type	Description
id	String	The unique identifier of the protection rule associated with the policy.
createdBy	identitySet	The identity of person who created the rule.
createdDateTime	DateTimeOffset	The time of creation of the rule.
error	publicError	Contains error details if an operation on a rule fails.
lastModifiedBy	identitySet	The identity of the person who last modified the rule.
lastModifiedDateTime	DateTimeOffset	Timestamp of the last modification made to the rule.
status	protectionRuleStatus	The status of the protection rule. The possible values are: `draft`, `active`, `completed`, `completedWithErrors`, `unknownFutureValue`. The `draft` member is currently unsupported.

Graph reference: protectionUnitBase

Property	Type	Description
id	String	The unique identifier of the protection unit.
policyId	String	The unique identifier of the protection policy based on which protection unit was created.
createdBy	identitySet	The identity of person who created the protection unit.
createdDateTime	DateTimeOffset	The time of creation of the protection unit.
error	publicError	Contains error details if an error occurred while creating a protection unit.
lastModifiedBy	identitySet	The identity of person who last modified the protection unit.
lastModifiedDateTime	DateTimeOffset	Timestamp of the last modification of this protection unit.
status	protectionUnitStatus	The status of the protection unit. The possible values are: `protectRequested`, `protected`, `unprotectRequested`, `unprotected`, `removeRequested`, `unknownFutureValue`.

Graph reference: sharePointProtectionPolicy

Property	Type	Description
id	String	The unique identifier of the protection rule associated to the policy.
displayName	String	The name of the policy being created.
createdDateTime	DateTimeOffset	The time of creation of the policy.
createdBy	identitySet	The identity of person who created the policy.
lastModifiedBy	identitySet	The identity of person who modified the policy.
lastModifiedDateTime	DateTimeOffset	The timestamp of the last modification of the policy.
retentionSettings	retentionSetting collection	Retention settings for the policy.
status	protectionPolicyStatus	The status of the policy. The value is an aggregated status of the protection units. The possible values are: `inactive`, `activeWithErrors`, `updating`, `active`, `unknownFutureValue`.

Graph reference: site

Property	Type	Description
createdDateTime	DateTimeOffset	The date and time the item was created. Read-only.
description	string	The descriptive text for the site.
displayName	string	The full title for the site. Read-only.
eTag	string	ETag for the item. Read-only.
id	string	The unique identifier of the item. Read-only.
isPersonalSite	bool	Identifies whether the site is personal or not. Read-only.
lastModifiedDateTime	DateTimeOffset	The date and time the item was last modified. Read-only.
name	string	The name/title of the item.
root	root	If present, provides the root site in the site collection. Read-only.
sharepointIds	sharepointIds	Returns identifiers useful for SharePoint REST compatibility. Read-only.
siteCollection	siteCollection	Provides details about the site's site collection. Available only on the root site. Read-only.
webUrl	string (url)	URL that displays the item in the browser. Read-only.

Graph reference: siteProtectionRule

Property	Type	Description
id	String	The unique identifier of the protection rule associated with the policy.
createdBy	identitySet	The identity of the person who created the rule.
createdDateTime	DateTimeOffset	The date and time that the rule was created.
error	publicError	Contains error details if any operation on a rule expression fails.
isAutoApplyEnabled	Boolean	`true` indicates that the protection rule is dynamic; `false` that it's static. Static rules run one time while dynamic rules listen to all changes in the system and update the protection unit list. Currently, only static rules are supported.
lastModifiedBy	identitySet	Identity of the person who last modified the rule.
lastModifiedDateTime	DateTimeOffset	Timestamp of the last modification to the rule.
siteExpression	String	Contains a site expression. For examples, see siteExpression example.
status	protectionRuleStatus	Status of the protection rule. The possible values are: `draft`, `active`, `completed`, `completedWithErrors`, `unknownFutureValue`. The `draft` member is currently unsupported.

Graph reference: siteProtectionUnit

Property	Type	Description
createdBy	identitySet	The identity of person who created the protection unit. Inherited from protectionUnitBase.
createdDateTime	DateTimeOffset	The time of creation of the protection unit. Inherited from protectionUnitBase.
error	publicError	Contains error details if enabling or disabling the protection unit fails. Inherited from protectionUnitBase.
id	String	Unique identifier of the protection policy associated with this protection unit.
lastModifiedBy	identitySet	The identity of the person who last modified the protection unit. Inherited from protectionUnitBase.
lastModifiedDateTime	DateTimeOffset	The time the protection unit was last modified. Inherited from protectionUnitBase.
policyId	String	Unique identifier of the protection policy associated with this protection unit. Inherited from protectionUnitBase.
siteId	String	Unique identifier of the SharePoint site.
siteName	String	Name of the SharePoint site.
siteWebUrl	String	The web URL of the SharePoint site.
status	protectionUnitStatus	The individual enable, disable, or removal status of the protection unit. Inherited from protectionUnitBase. The possible values are: `protectRequested`, `protected`, `unprotectRequested`, `unprotected`, `removeRequested`, `unknownFutureValue`.

Table of Contents

BackupRestore-Configuration.ReadWrite.All

Graph Methods

Resources