Quickstart
Four steps get a tenant from zero to a verified first backup: connect Microsoft 365, attach your own storage, choose workloads and a schedule, then confirm the backup actually landed.
1. Connect your M365 tenant
Authorize BYOVault against your Microsoft 365 tenant through a standard Microsoft Entra OAuth consent grant. No admin passwords are entered into BYOVault at any point — access is scoped to the Microsoft Graph permissions the consent grant lists.
2. Attach your storage
Point BYOVault at the Azure Blob container or S3 bucket you want backups written into. This is the account that will actually hold your data — see Storage Credentials for how those credentials are stored on BYOVault’s side.
3. Set workloads and a schedule
Choose which workloads to protect — SharePoint, OneDrive, Exchange, or a combination — and set a backup schedule. The schedule picker offers daily, weekly, or monthly cadence with a time of day, per workload.
4. Verify your first backup
Once the first scheduled (or manually triggered) job completes, confirm it landed by browsing to Version History for a known file or mailbox item. Every restore is checksum-verified against the SHA-256 recorded at backup time, so a successful restore is also proof the backup itself is intact.
Next steps
Read what each workload actually captures before relying on it for anything you haven’t tested, and review Retention Policy if you plan to enable retention-vault archiving.