Protecting SharePoint Online with Commvault

CommVault has the ability to protect SharePoint Online. To configure you will need the following.

  • Commvault v11 SP9 (SP8 works but SP9 is revamped & recommended)
  • A proxy client (Cannot be the same client used to protect mailboxes)
  • AD service account with admin rights to the proxy VM
  • A Global Administrator Account for Office365 (
    • This must also be a Site Collection Administrator
      • This can be done manually or using a script such as
  • An Azure Storage account (
  1. Create a proxy VM with internet or direct access to Share Point Online. Server 2012R2 seems to be the safest option compatibility wise (at the time of writing). Update, Domain Join & Add the AD service account to the local administrators group.
  2. Ensure Microsoft .NET Framework 4.5, and PowerShell 3.0 are installed
  3. Install the SharePoint agent, this can be done either interactively or pushed via the CommCell console.
  4. Log onto the proxy VM with your AD service acount. Install the SharePoint Online Management Shell. Navigate to C:\Program Files\Commvault\ContentStore\Base (or wherever the SharePoint agent is installed) and run spoms.msi
  5. Using the Comm Cell console, right click on the SharePoint client under the proxy and click properties. Change the account to use the service account with admin rights to the proxy VM.Client Properties
  6. Back on the proxy VM, run the following command from an elevated command prompt (navigate to the Commvault\ContentStore\Base directory first).
    CVSPWebPartInstallerLauncher.exe /registerassemblies -vm Instance001
  7. Restart the Commvault services on the Proxy VM.
  8. Create the o365 backup set. From the CommCell console, right click on the SharePoint Server client beneath the proxy and choose Create New BackupSet. Select Office365 as the ‘Document Level’.
  9. Right click on the new backup set and select properties. Use the Office 365 tab to enter the credentials and Tenant admin site URL.
    1. Login Credential username should be entered in email format.
    2. Tenant Admin site URL should be in the format
    3. Azure Credentials refer to the storage account created at Note this requires specific azure subscriptions and is used during the restore process only.
  10.  You can now configure the subclient content & assign a storage/schedule policy, splitting the subclients can help with throughput. If you experience failures check to ensure the account (the global administrator account) has Site Collection Administrator rights to each of the site collections. This can be done manually via the SharePoint admin center or via a PowerShell script (however I haven’t tried the script at the time of writing).