Common parameters

Bacula Enterprise Only

This solution is only available for Bacula Enterprise. For subscription inquiries, please reach out to sales@baculasystems.com.

These parameters are common and applicable to all the modules of the M365 Plugin.

Option	Required	Default	Values	Example	Description
abort_on_error	No	No	No, Yes	Yes	If set to Yes, abort the job as soon as any error is found with any element. If set to No, jobs continue even if they find problems with some elements, and warnings are reported.
config_file	No		Path pointing to a file containing any combination of plugin parameters	/opt/bacula/m365.settings	Define a config file so parameters do not need to be set directly in the Fileset plugin line.
log	No	/opt/bacula/working/m365/m365-debug.log	Existing path where File Daemon can create the file	/tmp/m365.log	Generate additional logs in addition to the job log.
debug	No	0	0, 1, 2, 3, 4, 5, 6, 7, 8, 9	3	Set debug level. Higher values generate more detailed debug information.
path	No	/opt/bacula/working	Existing path where File Daemon can create internal plugin files	/mnt/my-vol/	Path used to store metadata and temporary files.
tenant	Yes		Valid tenant id string	57uia43-d107-17a2-a2g2-aa53c10tdahc	Tenant ID where plugin backup and restore operations are executed.
objectid	Yes		Object ID related to bacula-m365-plugin app and tenant	56ddf1h9-eb5d-42nf-bac7-7b019fd284g5	Object ID of the plugin app service principal in Azure/Entra.
appid	No		App ID associated to bacula-m365-plugin-standalone in tenant	89tt4hu7-r4h7-kied-56gu-0895kf94jr9d	App ID used with standalone authorization model.
secret	No		Secret associated to appid	Jn8.lU-B.3P5gIRTGY6M.Xl3e29oQ6Xaf~	Secret used with the configured appid.
token_cache_file	No	token_cache.json	File name in a valid path	my_cache_file.json	File used to store device-code-flow token cache for delegated sessions.
service	No		email, drive, sharepoint, contact, calendar, onenote, tasks, teams, chat, activity	drive	Select one or more services to protect. If not set, plugin attempts all supported services.
owner_restore_protection	No	No	Yes, No	Yes	Enable owner restore protection, requiring owner confirmation for cross-user restores.
proxy_host	No		DNS name or IP of HTTP(S) proxy	myproxy.example.com	Configure proxy endpoint for plugin HTTP connections.
proxy_port	No		Integer	3981	Configure proxy port.
proxy_user	No		Proxy user string	admin	Configure proxy username.
proxy_password	No		Proxy password string	myPass123	Configure proxy password.

Note

The path option is adjustable while M365 jobs are in progress. The running jobs will continue to use the current spool area, and new jobs will use the new spool area defined by the path option. If specifying more than one service in the fileset, note that they will run in parallel. Because of that, we suggest reducing the concurrency slightly.

Note

Activity module is available since Bacula 18.0.1.

Below some multi-services fileset examples:

Fileset for all data belonging to a user

Fileset {
   Name = fs-m365-adelev-user
   Include {
      Options { signature = MD5 }
      Plugin = "m365: service=drive,email,calendar,contact,onenote,tasks,chat tenant=57uia43-d107-17a2-a2g2-aa53c10tdahc objectid=56ddf1h9-eb5d-
   42nf-bac7-7b019fd284g5 user=adelev@baculaenterprise.onmicrosoft.com concurrent_threads=2"
   }
}

Fileset for all data belonging to a group

Fileset {
   Name = fs-m365-devteam-group
   Include {
      Options { signature = MD5 }
      Plugin = "m365: service=drive,calendar,onenote,tasks,teams tenant=57uia43-d107-17a2-a2g2-aa53c10tdahc objectid=56ddf1h9-eb5d-
   42nf-bac7-7b019fd284g5 group=DevTeam concurrent_threads=2"
   }
}

Fileset for all data belonging to a site

Fileset {
   Name = fs-m365-mysite-site
   Include {
      Options { signature = MD5 }
      Plugin = "m365: service=sharepoint,drive,onenote tenant=57uia43-d107-17a2-a2g2-aa53c10tdahc objectid=56ddf1h9-eb5d-
   42nf-bac7-7b019fd284g5 site=MySite sharepoint_include_drive_items=no sharepoint_system_include=yes drive_system_include=yes concurrent_threads=2"
   }
}

Note

Activating proxy mode will route all requests through the proxy. However, DNS resolution must work separately. Therefore, the client where the FD is running needs a properly configured DNS server. Another option is to set up the /etc/hosts file manually with the IP addresses of Microsoft authentication servers, but they could change over time. At the time of writing they are: 40.126.31.2 login.microsoftonline.com 20.190.160.131 login.microsoft.com