Set Up Group-based Data Protection

Group-based data protection uses your existing Microsoft Entra ID security groups to automate backup policy assignment. To protect subsets of your Microsoft 365 tenants, apply your backup policies to Entra ID security groups instead of selecting individual users. This approach simplifies backup management, speeds up the onboarding of new users, and ensures consistent backup coverage to help maintain compliance.

Setting up group-based data protection requires a SuperUser account.

To set up group-based data protection

  1. To enable backups, connect to the Microsoft 365 domain you want to protect, as described in steps 1 to 7.

  2. In the Select Users page, choose Selected Groups under Backup Scope. The Entra ID groups for the tenant is displayed in the Exchange & OneDrive tab. Select the groups you want to protect, and then select Next.

    Backups include all current and future members of the selected groups.

  1. Optionally, select the sites you want to protect, and then select Next.

  2. Optionally, select the Teams you want to protect, and then select Next.

    The Summary page opens. The count of the selected groups, the customer and domain information is displayed.

  3. Review your group selections, and do one of the following:

    • Select Edit to change your selections.
    • Select Confirm to complete.

    A confirmation message appears. Your selections have been successfully added to the backup schedule.

Manage group-based data protection

You can manage the security groups you added from the Exchange & OneDrive tab.

To manage group-based data protection

  1. Sign in to the Management Console and go to the Microsoft 365 backups dashboard.

  2. Under the Exchange & OneDrive tab, go to the Groups tab. The count of the protected groups is displayed. Select or deselect the groups you want to protect. If you are switching from an individual users backup approach (Users tab) to a group-based approach (Groups tab) you are prompted to confirm your choice.

    • If you had selected individual users for your backup scope, the Users tab opens by default.
    • If you had selected Entra ID groups for backup, the Groups tab opens by default.

  3. Select Save. You are prompted to confirm your changes to the backup scope. Select Confirm to complete. The selected security groups are now included in the backup scope..

  • All current and future members of the selected groups will be backed up.
  • Switching to group-based data protection clears all previous user selections for backup.
  • This change to backup scope may affect your billing. Any deselected groups remain billable unless you remove all their backup history.

When no users or groups are chosen for backup, the system displays a prompt to select them.