NinjaOne SaaS Backup: Organization End-User Portal Guide

Topic

This article will discuss optimal use of the Organization Email Portal to manage backups for your email services and their users. 

Environment

NinjaOne SaaS Backup  End-User Portal

Description

NinjaOne SaaS Backup is a cloud backup platform that helps businesses securely backup, manage, recover, and protect their business information. The automated and incremental backups simplify the backup, recovery, and compliance experience. It works with Microsoft 365 (Hosted Exchange, Groups and Teams, SharePoint, OneDrive), Gmail (including Calendars, Contacts, and Tasks), and other IMAP email servers. NinjaOne uses 256-bit (AES) encryption at rest and in transit, supporting multifactor authentication (MFA).

Index

• Adding an M365 Tenant to Backups
  • Adding the M365 tenant to your organization
  • Adding users to Backup
  • Adding SharePoint Sites to Backup
• Backup Status
  • Email Backup Success Notifications
  • Dashboard Backup Status
  • System Status > Backup
  • System Status > Download
  • System Status > Restore
  • System Status > Migrate
•  User Management
  • How to Manage User Access
  • User Access Levels
  • Enabling Access for External (Delegated) Users
  • Disabling the Login for a User
  • Enabling Azure or Google SSO
  • Assigning Users to Departments
• Groups & Teams
  • Groups & Teams Restore
  • Groups & Teams Download
• Mail Restore, Download, and Migrate
  • Restore Backed-Up Email
  • Download Backed-Up Email
  • Migrate Backed-Up Data
• Delete and Deactivate Mailboxes
  • Delete Mailboxes
  • Deactivate Mailboxes
• Contact, Calendar, and Task Restore and Download

Adding an M365 Tenant to Backups
 

This section will discuss the process for adding a new M365 tenant to your organization and then adding users from that organization to be backed up.

Adding the M365 tenant to your organization

1. Sign into the Organization Email Portal for the organization in question, either by logging in directly or by using the Login as Client option from the Partner Portal.
2. Once at the Dashboard within the Organization Email Portal you can click the Add Backup button. 
   
   • If you already have backups running, you will see the option to Add From Existing with the already added tenants listed after you click Add Backup.
   • You will also see the option to add new tenants.
3. For this scenario, we will use the Sign in with Microsoft 365 option.  If you are looking to set up GWS backups, please see this article. Once you click this button you will be presented with the choice to authorize with Global Admin or Service Principal. For this guide we will use the Global Admin option.
   

4. After clicking the Authorize with Global Admin, you will be prompted to sign into your Microsoft 365 account.

   Important Note: You will need to sign in with an admin account for the tenant to grant NinjaOne the needed permissions to create the backup admin account.
5. If you have not already set up MFA on the tenant, it will prompt you to set up an MFA method of your choice.
6. The next screen will prompt you to accept the permissions for the global admin account to be created. You can scroll down and click Accept. 
   At this point, the backup admin account will be created within the tenant
7. Once the account is created, you will be provided with the email address and password for the account.  Take note of these for the next step.
8. Click on Sign in with Microsoft 365 under step 2.  When prompted, sign in with the backup admin account that was just created.  You will likely be prompted to set up 2FA for this account as well.
9. Accept the permissions requested on the next screen.
10. During this last step, you will have the ability to set Autodiscover settings for SharePoint.  Leaving this enabled will detect and add all SharePoint sites.  If you don't want to backup SharePoint or only want to backup specific sites, you can disable Autodiscover and manually select which sites to add. See SaaS Organization Email Account Basics for more information.
11. Under step 3, sign in one more time with the newly created backup admin account and accept the permissions one final time. This will complete the setup of the tenant and will take you to the page to add users from that tenant to your backups.

Adding users to Backup

1. The Add Users page will be brought up automatically after setting up the tenant with the above steps.  It can also be accessed using the Add From Existing option when clicking on + Add Backup from the dashboard.
   When first accessing the page, it will auto-populate with all the mailboxes that we detect existing within the tenant.
2. Use the Select All option or select the individual users that you want to add and an Add to Backup option will appear at the bottom of the screen.  Note that you will also see an Exclude option for cases when you want to specifically exclude the selected users from backups.
   
3. From this page, you can also enable Autodiscover and/or AD Sync.
   • Autodiscover will automatically detect and add new users, provided you have sufficient seats available in the organization.  When used in conjunction with Autolicensing (set from the Organization Settings within the Partner Portal), you can automatically adjust licenses in order to add any new users without any manual action.
   • AD sync will update things like name changes as they are detected within Active Directory.
     

Adding SharePoint Sites to Backup

By default, Autodiscover will be enabled for SharePoint sites.  However, if this was disabled during the initial setup or if disabled later, you can still manually add desired SharePoint sites to backups.

1. The Add Users page will be brought up automatically after setting up the tenant with the above steps. You can switch to the sites view by clicking Sites at the top of the page next to the Accounts button. 
   
   It can also be accessed using the Add From Existing option after clicking Add Backup from the dashboard.
2. When first accessing the page, it will auto-populate with all the sites that we detect existing within the tenant.
3. Use the Select All option or select the individual sites that you want to add and an Add to Backup option will appear at the bottom of the screen.  Note that you will also see an Exclude option for cases when you want to specifically exclude the selected SharePoint sites from backup.
4. From this page, you can also re-enable Autodiscover.
   Enabling this allows automatic discovery and backup of all available sites. To enable or disable AutoDiscover for SharePoint, navigate to Add Backup page then open the Sites tab. You can find AutoDiscover option under Site Information on the right panel.

Backup Status

Email Backup Success Notifications

All admin notifications will be sent to the email addresses added in the Notified Admin List.

In the Organization Email Portal: 

1. Click your profile icon in the top right corner of the page.  
2. Click Account Settings.
   
3. Select the Notifications tab.
4. Register additional recipients by clicking Add more.
5. Click Save Changes.

Admin notifications include:

• Notify when their email is successfully added to the backup.
• Notify when backup/archiving is completed.
• Notify when the system detects an error in the backup process.
• Notify when there is a successful email addition via the auto-discover feature.
• Notify when there are no sufficient cPanel seats available for auto-discover (cPanel Integration only).
• Notify when there are tips available that can show me how to make the most out of the system.
• Notify me of new product features.

All user notifications will be sent to only related users, which include:

• Email sent to user when a download is ready.
• Email sent to user after successfully added credential.

Dashboard Backup Status

Backup statuses can be viewed on the Dashboard page under Account List.

Status Definitions

System Status > Download

System Status > Restore

System Status > Migrate

User Management

With NinjaOne, users who are added to be backed up can sign in and interact with their backup. You have the ability via the User Management page to allow certain users to have elevated access to interact with the organization and other user accounts or to grant permissions to external users who do not have an active backup within the organization. 

How to Manage User Access

1. Please login to your business backup/archive account.  
2. Click on the account bubble in the upper right corner of the page and select User Management.
3. Go to the Grant Permission tab. In this tab, you will see all users that are currently included in the backup.

4. From the Grant Permission tab, you have the ability to assign the role to each user from the dropdown and toggle on/off log in. 
   

   Important Note: A given role can only assign a user a role that is hierarchically below its own. 
   • If selecting Group Supervisor, please also select the department they are admins of in the box that will appear just below the role.  
5. Click Save Changes.

User Access Levels

We allow 10 access levels for the Business Archiving + Backup product and five access levels for Business Backup.

• Full Admin: They have all accesses and capabilities. They can view, download, restore, migrate, and search emails from all email accounts. They can also set user permissions and compliance policies, view logs, set legal holds, and set up review processes.
• IT Admin: They can view info, and delete, and deactivate email for all accounts. They can also set up all user settings but can’t access the compliance tab. They can also restore emails from other accounts. 
• Restricted IT Admin: This role grants access to nearly all features available to an IT Admin, with specific restrictions to ensure data privacy. Users with this role can:
  • View the list of backed-up accounts.
  • Access account details, including status and the last backup date.
  • Deactivate or reactivate accounts.
  • Add new backups.
  • Configure all user settings.
    However, they cannot access any metadata, and their permissions exclude the ability to use the Advanced Search and Insight tabs.
• Group Supervisor: They have full access to users within the departments in which they are a supervisor. They can restore, migrate, download, search, and view all email accounts within their allotted department. They can set user permissions but can’t access all compliance policies.
• User: They can only view, download, restore, migrate, and search their emails and no one else’s email account. They cannot access the compliance tab.
• User View and Restore: They can only view, restore, and search their emails and no one else’s email account. They cannot access the compliance tab or download or migrate emails.
• Compliance and Review Officer (NinjaOne Archiving + Backup Product only): They can access eDiscovery Search, Alerts, View Audit Logs, Retention Policy, Legal Hold, and Review Process tabs. Additionally, they have access to view email for all accounts.
• Reviewer (Archiving + Backup product only): They can access the Review Process tab to review emails. However, they cannot set up a new review process.
• Limited Reviewer (Archiving + Backup product only): They have access to the Review Process menu but can only review emails within the selected list in the Review Process.
• Data Protection Officer (Archiving + Backup product only): This user can access the Review Process Tab and delete messages marked for deletion. They also can create tags to classify messages. They can add notes to messages marked for deletion for the audit log. Additionally, they have access to view email for all accounts.

Enabling Access for External (Delegated) Users

If you have users you want to access your organization but are not backed up, you can add them as external users. A delegated user can be someone from outside the organization or someone that is part of the organization that is not included in the backup.

Only admins who have access to the User Management Page can give access to external users

1. From the User Management page, go to the Grant Permission tab.
2. Click on Add User.
   
3. Enter the email address of the user you want to invite and select a role for the user.
4. Check the box stating I agree with this Term and then click invite.

The user that you added will receive an email with a link to log in and reset their password.

Disabling the Login for a User

1. Go to the User Management page and select the Grant Permission tab.
2. From the list of users, locate the user you want to disable.
   • Under the Login Status column, switch the toggle to off (will show red).
   • A disabled user can be re-enabled by switching this toggle to on (will show green).

Enabling Azure or Google SSO

You can now enable M365 Azure Active Directory SSO or Google SSO, which will enable the users to log in to their backup dashboard using their M365 or Google credentials. This way, they don’t have to keep a separate password for the backup End-User portal.  When Azure or Google SSO is enabled in the "Grant Permissions" tab of the End-User Portal, it will enable for all users that have access granted to log in.

1. Go to the User Management page and select the Grant Permission tab.
2. On the right side of the page, enable the Enforce Azure AD SSO Log in or Enforce Google SSO Log In access for all users.
   
   Once enabled, all users will have to use their M365 or Google credentials to log in to their backup dashboard once their access is enabled in the above step. They would select the option to sign in with either M365 or GWS instead of putting in their NinjaOne username and password.
3. You also can disable the user login from the same page.

Assigning Users to Departments

Assigning users to departments can be useful when you have a lot of users and want to manage them based on specific groups you set up. For example, you could set up a finance department and then add all your finance users to that so that you can manage them all at once.

1. From the User Management page, click on the Assign Department tab.
2. Click on the Department Management option.
   
3. If a needed department is not already on the list, you can add it to the bottom of the list.
4. Click Add More to add as many departments as needed.
5. Click Save Changes.
6. Under Assign Department, you can assign one or multiple departments to a user by clicking into the Assign department(s) dropdown and selecting the applicable option.
   

If you would like to sync the existing departments from your tenant, that is also possible.

1. From the Assign Department tab, you will see an option for each tenant domain to enable Azure AD Department Sync on the right side of the page. This option will be turned off by default.
   
2. Click on the toggle to turn this option on. You will see a pop-up warning letting you know that the departments will be automatically synced and assigned to the user accounts. Select either Yes, Continue or Cancel.
   Once enabled, it will show a “syncing” status while it scans the tenant and retrieves the information

As long as the option is enabled, NinjaOne will check once a week for new departments or changes to users' department assignments. If you need to force a sync, you can use the “Sync Now” option to have it run immediately.

Groups & Teams

Groups & Teams Restore

1. Log into the Organization Email Portal for your organization and navigate to the dashboard.
2. Under Account List, open the Groups & Teams tab and expand the site to reveal all the groups.
   
3. Expand each group, and you can see the different Teams items there.
4. Hover our cursor over the Group/Team in question and select the Restore option. If you only need a specific type of item restored, you can choose instead that item type and then select the individual items (or all items in that category) to restore.
   
5. Select your desired options and click Next. Click Yes on the final confirmation popup.
6. You can track the progress of the restore from the System Status > Restores page (access from the left navigation pane).

Groups & Teams Download

1. Log into the Organization Email Portal for your organization and navigate to the dashboard.
2. Go to the Groups & Teams tab and expand the site to reveal all the groups.
   
3. Expand the groups, and you can see the different Team items.
   
4. Select the specific item types that you want to download. You must select a document type to download chat and mailbox data.
   • Team chats can be downloaded as EML, CSV, or PDF.
   • Mailbox data can be downloaded as EML or PST.
5. Click Next.
6. On the next screen, you will see the option to select
   • Backup Date: Download the data as of that date.
   • Backup Time: Select the version you want to download on the backup date. Backups are performed three times a day. 
7. Select Generate Download, and click Yes, Continue.

Mail Restore, Download, and Migrate

Once you’ve backed up your email, you can access it through three main options: Restore, Migrate, and Download. Each feature allows you to retrieve data based on your needs.

Restore Backed-Up Email

1. Log into the Organization Email Portal for your organization and go to the dashboard.
2. Under Account List, locate and hover over the mailbox that you wish to restore.
   
3. Click Restore. In the pop-up screen, users can select the folder they want to restore.
   • There are three ways to do a restore:
     • Restore to their original folder: All messages selected will be restored to the same folder that they were backed up from.
     • Restore to a new folder: All messages will be restored to a folder with the name that you specify. This folder will be created within the mailbox.
       • The maximum length for a folder name is 60 characters.
       • To create a sub-folder, use the separator forward slash “/”.
       • Special characters are not allowed (!@#$%^&*()_+-=[]{};':”).
       • Text encoding uses UTF-8.
       • All blank space before and after text will be trimmed.
     • Restore to an existing folder: This will restore the items to a different folder that already exists within the mailbox. When selecting this option, you can choose the folder from a dropdown menu showing all the existing folders we detect.
       
4. Once selected, click Start Restore, and restore begins.
   You can check the status of your restore by clicking on System Status > Restores on your dashboard.
   

If you want to restore just an individual folder or individual items, you can also do that:

1. From the dashboard, locate the user and click on their email name.
2. In the upper left side of the page, select the folder that you want to look at.
   
3. Select individual messages you want to restore by clicking the box to the left of the From column or use the Select All option to get all items in the selected folder.
   
4. Click Restore in the bottom right corner of the page.
5. Follow the same steps outlined above to select the destination for the restore.

Download Backed-Up Email

1. Log into the Organization Email Portal for your organization and go to the dashboard.
2. Hover on the mailbox you wish to download and select Download. Technicians must have full permissions to see this option. 
3. Select the folders that you want to download.
4. Click Generate Download.
5. Once the download is ready, you will receive an email notification letting you know. You can also monitor the download status from the System Status > Downloads page. This page is also where you will go to download the file.

Migrate Backed-Up Data

This option will allow you to restore the data to a mailbox other than the one it was backed up from. Please note that this other mailbox needs to be within the same tenant as the backed-up user.

1. Log into the Organization Email Portal for your organization and go to the dashboard.
2. Hover on the mailbox you wish to migrate from and click the Migrate option.
3. If you want all the backed-up data in the new mailbox, click on the date range and select “all.” Likewise, if you only want items from a specific date range, select that range.
4. Select the destination for the data.
   • If the mailbox already exists, select Existing Account and select the desired account dropdown menu.
   • If you want to migrate to a new user mailbox, select New Account. Then select the type of tenant from the dropdown. For options 1 and 2, you will be prompted to sign into the mailbox you want to migrate to. For option 3, enter the username and password for the mail and the IMAP settings for that mailbox.
     • Select Gmail for GWS accounts.
     • Select O365 for Microsoft 365 accounts.
     • For all others (including Microsoft Exchange), select Other Email.
5. Click on Start Migrate.
   You can check on the status of the migration from the System Status > Migrations page.

Delete and Deactivate Mailboxes

Delete Mailboxes

When a mailbox is deleted, the backed-up data is purged. Deleting mailboxes is only available in the End-User portal for our Backup plan. If you use our Archiver plan, contact NinjaOne Support for assistance with manual deletion.

1. From the End-User portal dashboard, select the mailbox you wish to delete.
2. Click the Delete button corresponding to the mailbox.
3. Click Yes to confirm.

Deactivate Mailboxes

When a mailbox is deactivated, the account’s backup is stopped, the user’s login access is disabled, and the previously backed-up data for the account is retained. 

1. From the End User Portal Dashboard, select the mailbox that you want to Deactivate.
2. Under the More option, click De-Activate.
3. Click Confirm to finish.

Contact, Calendar, and Task Restore and Download

1. Log in to the Organization Email Portal for your account and go to your Dashboard.
2. Go to the tab for Contact, Calendar, or Task.
   
    
3. Hover your cursor over the user in question and select either Restore or Download.
   • If you want to restore/download all the data, click on the Restore or Download button.
   • If you only want specific items to be restored/downloaded, click on the name of the mailbox in question and select the specific date you want. Then click on Restore or Download.
4. Click on Yes to start the restore/download.
   You can check on the status of the restore or download from the System Status > Restore or System Status > Download page.