Error & Failure Reference

When a Microsoft 365 backup item fails or is skipped, the raw error BYOVault receives is a Microsoft Graph HTTP status code and, sometimes, a Graph error.code value. BYOVault translates a defined set of these into plain-English sentences wherever customers see job results.

How the translation works

A raw error string looks like OneDrive for “jane@x.com” skipped: graph API error 404 for https://graph.microsoft.com/...: {“error”:{“code”:“ResourceNotFound”,...}}.

The raw string is always kept for real debugging and is what support works from when you provide a job ID.

Translation to a plain-English sentence happens separately, at display time, by layering two levels of matching:

HTTP status code first. Microsoft documents a finite, fixed set of HTTP status codes for Graph errors. Every status code BYOVault has mapped gets a correct, if generic, sentence — this is the real coverage guarantee, since every possible Graph failure carries one of these codes even when its more specific error.code value is one BYOVault has never seen before.
A Graph error.code override, when recognized. Microsoft does not publish a finite list of error.code string values — its own documentation for the Graph error format states that no dependency should be taken on the contents of the error object beyond its shape. BYOVault maintains a short, deliberately non-exhaustive list of specific codes actually observed in production, each with a more precise sentence than the status-code fallback alone would produce.

A small third category covers conditions generated entirely by BYOVault that never reach Graph at all — an interrupted large-file download or upload session, or a stored copy found to be incomplete on the next backup — matched on their own fixed wording rather than a status code.

This translation applies where customers actually look, not everywhere

Plain-English translation is applied at the main places customers review backup results — job history in the BYOVault UI and CSV exports. A small number of other, less commonly viewed surfaces may still show the raw underlying string instead of a translated sentence. Treat any specific claim of “BYOVault explains this in plain English” as scoped to job history and exports, not as a guarantee covering every place an error can appear in the product.

HTTP status code translations

Below is a representative selection of the documented HTTP status codes BYOVault translates, and the sentence shown in place of the raw code.

The bracketed placeholder shown below ({label}) is filled in with the specific file, user, or site the error affected.

Status	What it actually means	What BYOVault tells the customer
`400`	Graph rejected the request as malformed.	“Microsoft 365 rejected the request for {label} as malformed — this will be reviewed; contact support with the job ID above if it keeps happening.”
`401`	The stored Graph credential is no longer valid.	“BYOVault’s connection to this Microsoft 365 tenant needs to be re-authorized — check the tenant’s connection status in BYOVault.”
`402`	The Microsoft 365 plan behind this tenant doesn’t include the feature being used.	“This Microsoft 365 feature requires a payment/plan BYOVault doesn’t currently have configured for {label} — contact support.”
`403`	The Graph app registration lacks permission for this resource.	“BYOVault doesn’t currently have permission to access {label} — check that admin consent is still granted for this Microsoft 365 tenant.”
`404`	The resource was not found.	“{label} could not be found — it may have been deleted, moved, or not fully set up. This will be re-checked automatically on the next backup.”
`405`	Graph rejected the specific way BYOVault tried to access the resource.	“Microsoft 365 rejected how BYOVault tried to access {label} — contact support with the job ID above.”
`406`	Graph rejected the format of the request.	“Microsoft 365 rejected the request format for {label} — contact support with the job ID above.”
`409`	The resource changed concurrently with the backup attempt.	“{label} changed while BYOVault was backing it up — this will be retried automatically on the next backup.”
`410`	The resource is permanently gone.	“{label} is no longer available in Microsoft 365 — it may have been permanently deleted.”
`411`	Graph rejected the request as malformed.	“Microsoft 365 rejected the request for {label} — contact support with the job ID above.”
`412`	A precondition (typically an ETag match) failed because the item changed.	“{label} changed while BYOVault was backing it up — this will be retried automatically on the next backup.”
`413`	The payload exceeded a size limit Graph enforces on this request type.	“{label} is too large for Microsoft 365 to process in one request — contact support if this keeps happening.”
`415`	Graph did not recognize or accept the file’s format.	“Microsoft 365 didn’t recognize the file format for {label} — contact support if this keeps happening.”
`416`	A requested byte range could not be satisfied while reading the item.	“Part of {label} could not be read correctly — this will be retried automatically on the next backup.”
`422`	Graph could not process the request as sent, even though it was well-formed.	“Microsoft 365 rejected the request for {label} — contact support with the job ID above.”
`423`	The resource is locked — for example, checked out or actively being edited.	“{label} is currently locked in Microsoft 365 (e.g. checked out or being edited) — this will be retried automatically on the next backup.”
`429`	Graph throttled the request.	“Microsoft temporarily slowed down requests for {label} — this will be retried automatically on the next backup.”
`500`	An internal Graph server error.	“Microsoft 365 had a temporary internal error while backing up {label} — this will be retried automatically on the next backup.”
`501`	The requested operation is not implemented for this resource type.	“This Microsoft 365 feature isn’t available for {label} yet.”
`503`	Graph was temporarily unavailable.	“Microsoft 365 was temporarily unavailable while backing up {label} — this will be retried automatically on the next backup.”
`504`	Graph did not respond within its own timeout.	“Microsoft 365 took too long to respond for {label} — this will be retried automatically on the next backup.”
`507`	The tenant is out of Microsoft 365 storage.	“{label}’s Microsoft 365 storage is full, so the request was rejected — freeing up space will allow backups to continue.”
`509`	BYOVault was rate-limited by Microsoft 365 at the bandwidth level.	“BYOVault was temporarily rate-limited by Microsoft 365 while backing up {label} — this will be retried automatically on the next backup.”

A status code that reaches this translation step but is not one of the mapped values still never surfaces raw JSON: it falls back to a generic sentence naming the HTTP status and pointing the customer to support with the job ID.

Graph error.code overrides

When the embedded Graph error object carries one of the following error.code values, this more specific sentence replaces the generic status-code sentence above it.

This list is intentionally short and grows only as new codes are actually observed in production — it is not, and is not intended to be, an exhaustive catalog of every code Graph can return.

error.code	What it actually means	What BYOVault tells the customer
`ResourceNotFound`	The user’s OneDrive (their “mysite”) does not exist yet in Graph.	“OneDrive isn’t set up for {label} yet — they likely haven’t signed into OneDrive or don’t have a license assigned. Nothing to back up here until that happens.”
`quotaLimitReached`	The specific user or site is over its Microsoft 365 storage quota.	“{label}’s Microsoft 365 storage is full, so Microsoft rejected the request — freeing up space for this user/site will allow backups to continue.”
`malwareDetected`	Microsoft’s own malware scanner flagged the file and blocked the download.	“{label} was flagged by Microsoft’s malware scanner and could not be downloaded — this needs to be reviewed directly in Microsoft 365.”
`notAllowed`	A tenant-level Microsoft 365 policy blocked the specific request.	“Microsoft 365 blocked this request for {label}, likely due to a tenant policy restriction — check Microsoft 365 admin settings if this persists.”

BYOVault-generated conditions

Some skip reasons are raised entirely by BYOVault and never involve a Graph status code or error code — these are matched on fixed wording instead.

Condition	What BYOVault tells the customer
A large file download was interrupted partway through.	“A large file transfer for {label} was interrupted partway through and will be retried automatically on the next backup.”
A large file upload session expired or could not be found.	“A large file upload for {label} was interrupted and will be retried automatically on the next backup.”
The stored blob is missing, or its encryption metadata is missing.	“{label}’s stored copy is incomplete or missing and needs to be re-backed up — it will be picked up automatically on the next backup.”

Multiple failures in one job

A single job can encounter more than one skip reason. When that happens:

Each problem is translated and shown as its own correctly-labeled sentence, rather than being combined into one block — so a job affected by two unrelated failures clearly shows both.
Identical resulting sentences are de-duplicated. Each still retains its own resource label, so two genuinely different resources never collapse into one line by mistake.

The raw error is never discarded

Translation only changes what is displayed. The underlying raw string — the full Graph JSON object, HTTP status, and related context — remains stored against the job or event and is what support actually works from when a job ID is provided.

For the states a job or request can be in while these errors are recorded, see Job & Request States.

For the timeout and retry behavior that determines whether a failed item is retried automatically, see Quotas & Limits: Timing & Retry.

PreviousQuotas & Limits: Retention & Policy Constraints NextJob & Request States