Veeam Backup M365 – Exchange Backup fails with: “Failed to get folder properties. Not allowed to access Non IPM folder”

Introduction

This blog post discusses an issue with Veeam Backup for Microsoft 365 where Exchange backup fails with the error: “Failed to get folder properties. Not allowed to access Non IPM folder”.
This problem affects all versions of Veeam Backup for Microsoft 365, but solutions are only available for specific versions:

• Veeam Backup for Microsoft 365 6a P20230322 (build 6.1.0.1015
• Veeam Backup for Microsoft 365 7 (builds 7.0.0.2911 – 7.0.0.4901)
• Veeam Backup for Microsoft 365 7a (builds 7.1.0.1301 – 7.1.0.1501)

(If you don’t have those versions installed, that will support the solution, update your software!)

For customers using Veeam Data Cloud for Microsoft 365, no actions are required, as all necessary actions were implemented in the Veeam Data Cloud backend on 4th of April 2024.

Cause

The issue arises during Exchange backup when Veeam Backup for Microsoft 365 requests the properties of all mailbox folders, including hidden and legacy folders like ‘TeamsMessagesData’. A recent change in Microsoft 365 prevents the properties of the ‘TeamsMessagesData’ folder from being retrieved using the EWS API, which Veeam Backup for Microsoft 365 uses to process Exchange data backup.

Solution

The issue can be resolved by configuring the software to skip processing the ‘TeamsMessagesData’ folder. There are three options to achieve this:

1. PowerShell Script to Automate Modification of the Config.xml file (Recommended Solution by Veeam): This solution involves running the provided PowerShell script as an Administrator on the Veeam Backup for Microsoft 365 server. The script modifies the Config.xml file to skip the ‘TeamsMessagesData’ folder during backup.
   $configFilePath = “C:\ProgramData\Veeam\Backup365\Config.xml”
   $xmlContent = [xml](Get-Content $configFilePath)
   if ($xmlContent.SelectSingleNode(“//Archiver/Proxy[@SkipTeamsMessagesDataFolders=’True’]”)) {
   Write-Output “SkipTeamsMessagesDataFolders setting already exists. No changes made.”
   } else {
   Copy-Item -Path $configFilePath -Destination “$configFilePath$($(Get-Date -Format ‘.yyyyMMdd’)).old”
   $newElement = $xmlContent.CreateElement(“Proxy”)
   $newElement.SetAttribute(“SkipTeamsMessagesDataFolders”, “True”)
   $archiverNode = $xmlContent.SelectSingleNode(“//Archiver”)
   $archiverNode.AppendChild($newElement)
   $xmlContent.Save($configFilePath)
   Write-Output “SkipTeamsMessagesDataFolders setting added.”
   Restart-Service -Name “Veeam.Archiver.Service”
   }
2. Manually modify the Config.xml file: This solution involves manually updating the Config.xml file located in the C:\ProgramData\Veeam\Backup365\ folder.
   The line needs to be added within the section of the file. After saving the changes, the Veeam Backup for Microsoft 365 service needs to be restarted.
3. Install a hotfix to change the software default behavior: This solution is for customers who do not wish to make configuration modifications or cannot access PowerShell. A hotfix is available for build 7.1.0.1501 that changes the default hardcoded value of the SkipTeamsMessagesDataFolders setting from False to True. This essentially does the same thing as the Config.xml setting, but at the program code level. Here is the download link: https://www.veeam.com/download_add_packs/backup-microsoft-office-365/kb4569
   1. After downloading the hotfix, extract the fix to: C:\Temp\KB4569\
   2. Stop the following services on the Backup server:
      Veeam Backup for Microsoft 365
      Veeam Backup Proxy for Microsoft 365
   3. After extraction, unblock the files using the following PowerShell cmdlet: Get-ChildItem -Path “C:\Temp\KB4569\” -Recurse -Force | Unblock-File
   4. Backup the original DLL and replace it with the one from the fix in the following locations:
      C:\Program Files\Veeam\Backup365\Veeam.Archiver.Controller.dll
      C:\Program Files\Veeam\Backup365\Veeam.Exchange.Interfaces.dll
   5. Start the services that were stopped in Step b.
   6. Retry the jobs.

Source: KB4569: Exchange Backup Fails With: “Failed to get folder properties. Not allowed to access Non IPM folder” (veeam.com)