ESC
Type to search...

BackupRestore-Configuration.ReadWrite.All

Export JSON
Export CSV
Copy URL
Print
ApplicationDelegated Read/Write All Resources

Allows the app to read and update the backup configuration, and list of Microsoft 365 service resources to be backed-up, without a signed-in user.

Permission data: April 6, 2026 at 4:06 AM UTC
Delegated Access App-Only Access

Permission Details

Application Permission

Read and edit all backup configuration policies

Allows the app to read and update the backup configuration, and list of Microsoft 365 service resources to be backed-up, without a signed-in user.

Delegated Permission Admin consent required

Read and edit backup configuration policies

Allows the app to read and update the backup configuration, and list of Microsoft 365 service resources to be backed-up, on behalf of the signed in user.

Properties

Microsoft Graph v1.0 endpoint-derived-docs

Properties is shown from stable Microsoft Graph v1.0 metadata.

Property Type Description
id String The unique identifier of the protection rule associated to the policy.
displayName StringNullable Name of the policy to be created.
createdDateTime DateTimeOffsetNullable The time of creation of the policy.
createdBy identitySet The identity of person who created the policy.
lastModifiedBy identitySet The identity of the person who last modified the policy.
lastModifiedDateTime DateTimeOffsetNullable The timestamp of the last modification of the policy.
status protectionPolicyStatus Status of the policy. This value is an aggregated status of the protection units. The possible values are: inactive, activeWithErrors, updating, active, unknownFutureValue.
isEnabled boolean
mailboxInclusionRules mailboxProtectionRule collection The rules associated with the Exchange protection policy.
mailboxProtectionUnits mailboxProtectionUnit collection The protection units (mailboxes) that are protected under the Exchange protection policy.
mailboxProtectionUnitsBulkAdditionJobs mailboxProtectionUnitsBulkAdditionJob collection
protectionPolicyArtifactCount object
retentionSettings retentionSetting collection Contains the retention setting details for the policy.

JSON Representation

Microsoft Graph v1.0 endpoint-derived-docs

JSON representation is shown from stable Microsoft Graph v1.0 metadata.

JSON representation
{
  "@odata.type": "#microsoft.graph.exchangeProtectionPolicy",
  "id": "String (identifier)",
  "displayName": "String",
  "status": "String",
  "createdDateTime": "String (timestamp)",
  "createdBy": {
    "@odata.type": "microsoft.graph.identitySet"
  },
  "lastModifiedDateTime": "String (timestamp)",
  "lastModifiedBy": {
    "@odata.type": "microsoft.graph.identitySet"
  }
}

Relationships

Microsoft Graph v1.0 endpoint-derived-docs

Relationships is shown from stable Microsoft Graph v1.0 metadata.

Relationship Type Description
mailboxInclusionRules mailboxProtectionRule collection The rules associated with the Exchange protection policy.
mailboxProtectionUnits mailboxProtectionUnit collection The protection units (mailboxes) that are protected under the Exchange protection policy.
mailboxProtectionUnitsBulkAdditionJobs mailboxProtectionUnitsBulkAdditionJob collection Related mailboxProtectionUnitsBulkAdditionJobs data exposed by this resource.
retentionSettings retentionSetting collection Contains the retention setting details for the policy.

Graph Methods

Delegated access App-only access
Exact Microsoft Learn match

Microsoft Graph v1.0 endpoints are mapped directly from refreshed Microsoft Learn permissions tables.

Methods
GET /solutions/backupRestore/exchangeProtectionPolicies/{exchangeProtectionPolicyId}/mailboxInclusionRules
GET /solutions/backupRestore/exchangeProtectionPolicies/{exchangeProtectionPolicyId}/mailboxInclusionRules/{mailboxProtectionRuleId}
GET /solutions/backupRestore/oneDriveForBusinessProtectionPolicies/{oneDriveForBusinessProtectionPolicyId}/driveInclusionRules
GET /solutions/backupRestore/oneDriveForBusinessProtectionPolicies/{oneDriveForBusinessProtectionPolicyId}/driveInclusionRules/{driveProtectionRuleId}
GET /solutions/backupRestore/sharePointProtectionPolicies/{sharePointProtectionPolicyId}/siteInclusionRules
GET /solutions/backupRestore/sharePointProtectionPolicies/{sharePointProtectionPolicyId}/siteInclusionRules/{siteProtectionRuleId}
POST /solutions/backupRestore/exchangeProtectionPolicies/
POST /solutions/backupRestore/exchangeProtectionPolicies/{exchangeProtectionPolicyId}/mailboxInclusionRules
POST /solutions/backupRestore/exchangeProtectionPolicies/{exchangeProtectionPolicyId}/mailboxInclusionRules/{mailboxProtectionRuleId}/deleteAndUnprotect
POST /solutions/backupRestore/exchangeProtectionPolicies/{exchangeProtectionPolicyId}/mailboxInclusionRules/{mailboxProtectionRuleId}/run
POST /solutions/backupRestore/oneDriveForBusinessProtectionPolicies
POST /solutions/backupRestore/oneDriveForBusinessProtectionPolicies/{oneDriveForBusinessProtectionPolicyId}/driveInclusionRules
POST /solutions/backupRestore/oneDriveForBusinessProtectionPolicies/{oneDriveForBusinessProtectionPolicyId}/driveInclusionRules/{driveProtectionRuleId}/deleteAndUnprotect
POST /solutions/backupRestore/oneDriveForBusinessProtectionPolicies/{oneDriveForBusinessProtectionPolicyId}/driveInclusionRules/{driveProtectionRuleId}/run
POST /solutions/backupRestore/protectionPolicies/{protectionPolicyBaseId}/activate
POST /solutions/backupRestore/protectionPolicies/{protectionPolicyBaseId}/deactivate
POST /solutions/backupRestore/protectionUnits/{protectionUnitBaseId}/cancelOffboard
POST /solutions/backupRestore/protectionUnits/{protectionUnitBaseId}/offboard
POST /solutions/backupRestore/sharePointProtectionPolicies/
POST /solutions/backupRestore/sharePointProtectionPolicies/{sharePointProtectionPolicyId}/siteInclusionRules
POST /solutions/backupRestore/sharePointProtectionPolicies/{sharePointProtectionPolicyId}/siteInclusionRules/{siteProtectionRuleId}/run
PATCH /solutions/backupRestore/exchangeProtectionPolicies/{exchangeProtectionPolicyId}
PATCH /solutions/backupRestore/exchangeProtectionPolicies/{exchangeProtectionPolicyId}/mailboxInclusionRules/{mailboxProtectionRuleId}
PATCH /solutions/backupRestore/oneDriveForBusinessProtectionPolicies/{oneDriveForBusinessProtectionPolicyId}
PATCH /solutions/backupRestore/oneDriveForBusinessProtectionPolicies/{oneDriveForBusinessProtectionPolicyId}/driveInclusionRules/{driveProtectionRuleId}
PATCH /solutions/backupRestore/sharePointProtectionPolicies/{sharePointProtectionPolicyId}
DELETE /solutions/backupRestore/exchangeProtectionPolicies/{exchangeProtectionPolicyId}/mailboxInclusionRules/{mailboxProtectionRuleId}
DELETE /solutions/backupRestore/oneDriveForBusinessProtectionPolicies/{oneDriveForBusinessProtectionPolicyId}/driveInclusionRules/{driveProtectionRuleId}
DELETE /solutions/backupRestore/protectionPolicies/{protectionPolicyBaseId}
DELETE /solutions/backupRestore/sharePointProtectionPolicies/{sharePointProtectionPolicyId}/siteInclusionRules/{siteProtectionRuleId}
Exact Microsoft Learn match

Microsoft Graph beta endpoints are mapped directly from refreshed Microsoft Learn permissions tables.

Methods
GET /solutions/backupRestore/exchangeProtectionPolicies/{exchangeProtectionPolicyId}/mailboxInclusionRules
GET /solutions/backupRestore/exchangeProtectionPolicies/{exchangeProtectionPolicyId}/mailboxInclusionRules/{mailboxProtectionRuleId}
GET /solutions/backupRestore/oneDriveForBusinessProtectionPolicies/{oneDriveForBusinessProtectionPolicyId}/driveInclusionRules
GET /solutions/backupRestore/oneDriveForBusinessProtectionPolicies/{oneDriveForBusinessProtectionPolicyId}/driveInclusionRules/{driveProtectionRuleId}
GET /solutions/backupRestore/sharePointProtectionPolicies/{sharePointProtectionPolicyId}/siteInclusionRules
GET /solutions/backupRestore/sharePointProtectionPolicies/{sharePointProtectionPolicyId}/siteInclusionRules/{siteProtectionRuleId}
POST /solutions/backupRestore/exchangeProtectionPolicies/
POST /solutions/backupRestore/exchangeProtectionPolicies/{exchangeProtectionPolicyId}/mailboxInclusionRules
POST /solutions/backupRestore/exchangeProtectionPolicies/{exchangeProtectionPolicyId}/mailboxInclusionRules/{mailboxProtectionRuleId}/deleteAndUnprotect
POST /solutions/backupRestore/exchangeProtectionPolicies/{exchangeProtectionPolicyId}/mailboxInclusionRules/{mailboxProtectionRuleId}/run
POST /solutions/backupRestore/oneDriveForBusinessProtectionPolicies
POST /solutions/backupRestore/oneDriveForBusinessProtectionPolicies/{oneDriveForBusinessProtectionPolicyId}/driveInclusionRules
POST /solutions/backupRestore/oneDriveForBusinessProtectionPolicies/{oneDriveForBusinessProtectionPolicyId}/driveInclusionRules/{driveProtectionRuleId}/deleteAndUnprotect
POST /solutions/backupRestore/oneDriveForBusinessProtectionPolicies/{oneDriveForBusinessProtectionPolicyId}/driveInclusionRules/{driveProtectionRuleId}/run
POST /solutions/backupRestore/protectionPolicies/{protectionPolicyBaseId}/activate
POST /solutions/backupRestore/protectionPolicies/{protectionPolicyBaseId}/deactivate
POST /solutions/backupRestore/protectionUnits/{protectionUnitBaseId}/cancelOffboard
POST /solutions/backupRestore/protectionUnits/{protectionUnitBaseId}/offboard
POST /solutions/backupRestore/sharePointProtectionPolicies/
POST /solutions/backupRestore/sharePointProtectionPolicies/{sharePointProtectionPolicyId}/siteInclusionRules
POST /solutions/backupRestore/sharePointProtectionPolicies/{sharePointProtectionPolicyId}/siteInclusionRules/{siteProtectionRuleId}/run
PATCH /solutions/backupRestore/exchangeProtectionPolicies/{exchangeProtectionPolicyId}
PATCH /solutions/backupRestore/exchangeProtectionPolicies/{exchangeProtectionPolicyId}/mailboxInclusionRules/{mailboxProtectionRuleId}
PATCH /solutions/backupRestore/oneDriveForBusinessProtectionPolicies/{oneDriveForBusinessProtectionPolicyId}
PATCH /solutions/backupRestore/oneDriveForBusinessProtectionPolicies/{oneDriveForBusinessProtectionPolicyId}/driveInclusionRules/{driveProtectionRuleId}
PATCH /solutions/backupRestore/sharePointProtectionPolicies/{sharePointProtectionPolicyId}
DELETE /solutions/backupRestore/exchangeProtectionPolicies/{exchangeProtectionPolicyId}/mailboxInclusionRules/{mailboxProtectionRuleId}
DELETE /solutions/backupRestore/oneDriveForBusinessProtectionPolicies/{oneDriveForBusinessProtectionPolicyId}/driveInclusionRules/{driveProtectionRuleId}
DELETE /solutions/backupRestore/protectionPolicies/{protectionPolicyBaseId}
DELETE /solutions/backupRestore/sharePointProtectionPolicies/{sharePointProtectionPolicyId}/siteInclusionRules/{siteProtectionRuleId}
Exact Microsoft Learn PowerShell match

Microsoft Graph PowerShell v1.0 commands are mapped directly from refreshed Microsoft Learn PowerShell snippets.

Commands
Get-MgSolutionBackupRestoreExchangeProtectionPolicyMailboxInclusionRule /solutions/backupRestore/exchangeProtectionPolicies/{exchangeProtectionPolicyId}/mailboxInclusionRules
List mailboxInclusionRules
Get-MgSolutionBackupRestoreExchangeProtectionPolicyMailboxInclusionRule /solutions/backupRestore/sharePointProtectionPolicies/{sharePointProtectionPolicyId}/siteInclusionRules/{siteProtectionRuleId}
Get protectionRuleBase
Get-MgSolutionBackupRestoreOneDriveForBusinessProtectionPolicyDriveInclusionRule /solutions/backupRestore/oneDriveForBusinessProtectionPolicies/{oneDriveForBusinessProtectionPolicyId}/driveInclusionRules
List driveInclusionRules
Get-MgSolutionBackupRestoreOneDriveForBusinessProtectionPolicyDriveInclusionRule /solutions/backupRestore/sharePointProtectionPolicies/{sharePointProtectionPolicyId}/siteInclusionRules/{siteProtectionRuleId}
Get protectionRuleBase
Get-MgSolutionBackupRestoreSharePointProtectionPolicySiteInclusionRule /solutions/backupRestore/sharePointProtectionPolicies/{sharePointProtectionPolicyId}/siteInclusionRules
List siteInclusionRules
Get-MgSolutionBackupRestoreSharePointProtectionPolicySiteInclusionRule /solutions/backupRestore/sharePointProtectionPolicies/{sharePointProtectionPolicyId}/siteInclusionRules/{siteProtectionRuleId}
Get protectionRuleBase
Invoke-MgDeactivateSolutionBackupRestoreProtectionPolicy /solutions/backupRestore/protectionPolicies/{protectionPolicyBaseId}/deactivate
protectionPolicyBase: deactivate
Invoke-MgOffboardSolutionBackupRestoreProtectionUnit /solutions/backupRestore/protectionUnits/{protectionUnitBaseId}/offboard
protectionUnitBase: offboard
New-MgSolutionBackupRestoreExchangeProtectionPolicy /solutions/backupRestore/exchangeProtectionPolicies/
Create exchangeProtectionPolicy
New-MgSolutionBackupRestoreOneDriveForBusinessProtectionPolicy /solutions/backupRestore/oneDriveForBusinessProtectionPolicies
Create oneDriveForBusinessProtectionPolicy
New-MgSolutionBackupRestoreSharePointProtectionPolicy /solutions/backupRestore/sharePointProtectionPolicies/
Create sharePointProtectionPolicy
Remove-MgSolutionBackupRestoreProtectionPolicy /solutions/backupRestore/protectionPolicies/{protectionPolicyBaseId}
Delete protectionPolicyBase
Update-MgSolutionBackupRestoreExchangeProtectionPolicy /solutions/backupRestore/exchangeProtectionPolicies/{exchangeProtectionPolicyId}
Update exchangeProtectionPolicy
Update-MgSolutionBackupRestoreOneDriveForBusinessProtectionPolicy /solutions/backupRestore/oneDriveForBusinessProtectionPolicies/{oneDriveForBusinessProtectionPolicyId}
Update oneDriveForBusinessProtectionPolicy
Update-MgSolutionBackupRestoreSharePointProtectionPolicy /solutions/backupRestore/sharePointProtectionPolicies/{sharePointProtectionPolicyId}
Update sharePointProtectionPolicy
Exact Microsoft Learn PowerShell match

Microsoft Graph PowerShell beta commands are mapped directly from refreshed Microsoft Learn PowerShell snippets.

Commands
Get-MgBetaSolutionBackupRestoreExchangeProtectionPolicyMailboxInclusionRule /solutions/backupRestore/exchangeProtectionPolicies/{exchangeProtectionPolicyId}/mailboxInclusionRules
List mailboxInclusionRules
Get-MgBetaSolutionBackupRestoreExchangeProtectionPolicyMailboxInclusionRule /solutions/backupRestore/sharePointProtectionPolicies/{sharePointProtectionPolicyId}/siteInclusionRules/{siteProtectionRuleId}
Get protectionRuleBase
Get-MgBetaSolutionBackupRestoreOneDriveForBusinessProtectionPolicyDriveInclusionRule /solutions/backupRestore/oneDriveForBusinessProtectionPolicies/{oneDriveForBusinessProtectionPolicyId}/driveInclusionRules
List driveInclusionRules
Get-MgBetaSolutionBackupRestoreOneDriveForBusinessProtectionPolicyDriveInclusionRule /solutions/backupRestore/sharePointProtectionPolicies/{sharePointProtectionPolicyId}/siteInclusionRules/{siteProtectionRuleId}
Get protectionRuleBase
Get-MgBetaSolutionBackupRestoreSharePointProtectionPolicySiteInclusionRule /solutions/backupRestore/sharePointProtectionPolicies/{sharePointProtectionPolicyId}/siteInclusionRules
List siteInclusionRules
Get-MgBetaSolutionBackupRestoreSharePointProtectionPolicySiteInclusionRule /solutions/backupRestore/sharePointProtectionPolicies/{sharePointProtectionPolicyId}/siteInclusionRules/{siteProtectionRuleId}
Get protectionRuleBase
Invoke-MgBetaDeactivateSolutionBackupRestoreProtectionPolicy /solutions/backupRestore/protectionPolicies/{protectionPolicyBaseId}/deactivate
protectionPolicyBase: deactivate
Invoke-MgBetaOffboardSolutionBackupRestoreProtectionUnit /solutions/backupRestore/protectionUnits/{protectionUnitBaseId}/offboard
protectionUnitBase: offboard
New-MgBetaSolutionBackupRestoreExchangeProtectionPolicy /solutions/backupRestore/exchangeProtectionPolicies/
Create exchangeProtectionPolicy
New-MgBetaSolutionBackupRestoreOneDriveForBusinessProtectionPolicy /solutions/backupRestore/oneDriveForBusinessProtectionPolicies
Create oneDriveForBusinessProtectionPolicy
New-MgBetaSolutionBackupRestoreSharePointProtectionPolicy /solutions/backupRestore/sharePointProtectionPolicies/
Create sharePointProtectionPolicy
Remove-MgBetaSolutionBackupRestoreProtectionPolicy /solutions/backupRestore/protectionPolicies/{protectionPolicyBaseId}
Delete protectionPolicyBase
Update-MgBetaSolutionBackupRestoreExchangeProtectionPolicy /solutions/backupRestore/exchangeProtectionPolicies/{exchangeProtectionPolicyId}
Update exchangeProtectionPolicy
Update-MgBetaSolutionBackupRestoreOneDriveForBusinessProtectionPolicy /solutions/backupRestore/oneDriveForBusinessProtectionPolicies/{oneDriveForBusinessProtectionPolicyId}
Update oneDriveForBusinessProtectionPolicy
Update-MgBetaSolutionBackupRestoreSharePointProtectionPolicy /solutions/backupRestore/sharePointProtectionPolicies/{sharePointProtectionPolicyId}
Update sharePointProtectionPolicy

Code Examples

C# / .NET SDK
Create exchangeProtectionPolicy
// Code snippets are only available for the latest version. Current version is 5.x

// Dependencies
using Microsoft.Graph.Models;

var requestBody = new ExchangeProtectionPolicy
{
	DisplayName = "Exchange Protection Policy",
	MailboxProtectionUnits = new List<MailboxProtectionUnit>
	{
		new MailboxProtectionUnit
		{
			DirectoryObjectId = "cdd3a849-dcaf-4a85-af82-7e39fc14019a",
		},
		new MailboxProtectionUnit
		{
			DirectoryObjectId = "9bc069da-b746-41a4-89ab-26125c6373c7",
		},
		new MailboxProtectionUnit
		{
			DirectoryObjectId = "b218eb4a-ea72-42bd-8f0b-d0bbf794bec7",
		},
	},
};

// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=csharp
var result = await graphClient.Solutions.BackupRestore.ExchangeProtectionPolicies.PostAsync(requestBody);
JavaScript
Create exchangeProtectionPolicy
const options = {
	authProvider,
};

const client = Client.init(options);

const exchangeProtectionPolicy = {
  displayName: 'Exchange Protection Policy',
  mailboxProtectionUnits: [
    {
      directoryObjectId: 'cdd3a849-dcaf-4a85-af82-7e39fc14019a'
    },
    {
      directoryObjectId: '9bc069da-b746-41a4-89ab-26125c6373c7'
    },
    {
      directoryObjectId: 'b218eb4a-ea72-42bd-8f0b-d0bbf794bec7'
    }
  ]
};

await client.api('/solutions/backupRestore/exchangeProtectionPolicies')
	.post(exchangeProtectionPolicy);
PowerShell
Create exchangeProtectionPolicy
Import-Module Microsoft.Graph.BackupRestore

$params = @{
	displayName = "Exchange Protection Policy"
	mailboxProtectionUnits = @(
		@{
			directoryObjectId = "cdd3a849-dcaf-4a85-af82-7e39fc14019a"
		}
		@{
			directoryObjectId = "9bc069da-b746-41a4-89ab-26125c6373c7"
		}
		@{
			directoryObjectId = "b218eb4a-ea72-42bd-8f0b-d0bbf794bec7"
		}
	)
}

New-MgSolutionBackupRestoreExchangeProtectionPolicy -BodyParameter $params
Python
Create exchangeProtectionPolicy
# Code snippets are only available for the latest version. Current version is 1.x
from msgraph import GraphServiceClient
from msgraph.generated.models.exchange_protection_policy import ExchangeProtectionPolicy
from msgraph.generated.models.mailbox_protection_unit import MailboxProtectionUnit
# To initialize your graph_client, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=python
request_body = ExchangeProtectionPolicy(
	display_name = "Exchange Protection Policy",
	mailbox_protection_units = [
		MailboxProtectionUnit(
			directory_object_id = "cdd3a849-dcaf-4a85-af82-7e39fc14019a",
		),
		MailboxProtectionUnit(
			directory_object_id = "9bc069da-b746-41a4-89ab-26125c6373c7",
		),
		MailboxProtectionUnit(
			directory_object_id = "b218eb4a-ea72-42bd-8f0b-d0bbf794bec7",
		),
	],
)

result = await graph_client.solutions.backup_restore.exchange_protection_policies.post(request_body)

App Registration

1

Navigate to Azure Portal

Go to App registrations in Microsoft Entra admin center

2

Add API Permission

Select your app → API permissions → Add a permission → Microsoft Graph

3

Select Permission Type

Choose Application permissions or delegated permissions and search for BackupRestore-Configuration.ReadWrite.All

4

Grant Admin Consent

Application permissions always require admin consent.