Download a File
Download retrieves a backed-up file exactly as it was stored, without touching the live Microsoft 365 tenant or file server at all. It is the only restore path in BYOVault that completes synchronously.
What makes download different
Every other restore action in BYOVault — restoring a SharePoint or OneDrive file back into its original drive, restoring an Exchange message back into a mailbox — runs as a background job you can check on. The operator or end user submits the request, gets back a job ID, and checks status until the job finishes.
Download does none of that. The request is handled immediately: the file is fetched, decrypted, and returned directly in the response. There is no job and nothing to check on.
What happens during the request
BYOVault first confirms that the requested file belongs to the tenant making the request, then locates the copy that needs to be retrieved.
A file’s current location depends on whether it has ever been moved into a locked retention vault:
- Most files are read from the tenant’s regular backup storage.
- A file that has already been archived into a retention vault is read from that vault instead.
This resolution happens automatically — there is nothing for the operator or end user to specify.
BYOVault then decrypts the file and verifies its integrity against a checksum recorded at backup time, failing the request if the file does not verify.
If the stored file was compressed at backup time, it is decompressed after decryption. Large files are reassembled automatically before being returned.
The browser downloads the file directly, with its original filename, rather than displaying it inline.
Which key decrypts the file
If the file belongs to a tenant using a customer-managed key, BYOVault decrypts that file using the key configuration that was active at the time the file was backed up — not whatever key configuration is active for the tenant today.
This matters if a key has since been rotated to a new configuration: an older file is still decrypted with the configuration that was used to protect it.
Tenants without a customer-managed key are decrypted with a key BYOVault manages on their behalf. See Customer-Managed Keys (BYOK) for how this works.
Auditing
Every download is recorded in the audit log, capturing the file location and filename downloaded and the email address of whoever downloaded it.