> For the complete documentation index, see [llms.txt](https://helpcenter.xopero.com/xopero-one-en/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://helpcenter.xopero.com/xopero-one-en/backup-and-recovery/microsoft-365/integration/required-permissions.md).

# Required permissions

**The required Microsoft 365 permissions define the access levels Xopero ONE needs to securely back up and restore your data.**

***

## General requirements

To integrate a **Microsoft 365** organization with **Xopero ONE**, ensure it uses a **Microsoft 365** business license.

To back up a single **Microsoft 365** account, the account must have a **Microsoft 365** license assigned. This also applies to shared mailboxes. License assignments can be managed in the **Microsoft 365** admin center.

Each **Microsoft 365** account and shared mailbox requires one **Xopero ONE** license to back up its data.

The backup process requires a backup agent (worker), which communicates with the **Microsoft 365** API, downloads the requested data, and performs the backup. You can use either a cloud or local worker. Any device with the **Xopero ONE Backup\&Recovery Agent** installed can act as a worker.

{% hint style="success" %}
You do not need to assign any licenses to cloud workers — the appropriate license is assigned automatically by the **Xopero ONE** system.
{% endhint %}

***

## Account permissions

To add your **Microsoft 365** organization to **Xopero ONE**, you must use a global administrator account. Only a global administrator has the necessary permissions to back up data from all user accounts in the organization.

{% hint style="info" %}
Learn more about **Microsoft 365** administrator roles in [the official Microsoft documentation](https://learn.microsoft.com/en-us/microsoft-365/admin/add-users/about-admin-roles?view=o365-worldwide).
{% endhint %}

***

## Application permissions <a href="#xopero-one-registrator" id="xopero-one-registrator"></a>

The following tables list **Xopero** apps and their permissions, which are automatically installed in the end user's **Entra ID** when integrating **Microsoft 365** with **Xopero ONE**.

### <mark style="background-color:$tint;">Xopero ONE Registrator</mark> <a href="#xopero-one-registrator" id="xopero-one-registrator"></a>

This application is used at the beginning of the integration to install and grant the necessary permissions for the **Xopero ONE MS365 PRO** app.

#### Microsoft Graph <a href="#microsoft-graph" id="microsoft-graph"></a>

| API name        | Claim value                | Permission                                          | Type      |
| --------------- | -------------------------- | --------------------------------------------------- | --------- |
| Microsoft Graph | Directory.AccessAsUser.All | Access directory as the signed-in user.             | delegated |
| Microsoft Graph | offline\_access            | Maintain access to data you have granted access to. | delegated |
| Microsoft Graph | profile                    | View user's basic profile.                          | delegated |
| Microsoft Graph | openid                     | Sign users in.                                      | delegated |

### <mark style="background-color:$tint;">Xopero ONE MS365 PRO</mark> <a href="#xopero-one-ms365-pro" id="xopero-one-ms365-pro"></a>

This application is required to back up and recover data from **Microsoft 365** tenants and is installed automatically in **Entra ID** by **Xopero ONE Registrator**.

#### Microsoft Graph <a href="#microsoft-graph.1" id="microsoft-graph.1"></a>

<table data-search="false"><thead><tr><th>API name</th><th>Claim value</th><th>Permission</th><th>Type</th></tr></thead><tbody><tr><td>Microsoft Graph</td><td>Mail.ReadWrite</td><td>Read and write mail in all mailboxes.</td><td>application</td></tr><tr><td>Microsoft Graph</td><td>User.ReadWrite.All</td><td>Read and write all users' full profile information.</td><td>application</td></tr><tr><td>Microsoft Graph</td><td>Application.ReadWrite.All</td><td>Read and write all applications.</td><td>application</td></tr><tr><td>Microsoft Graph</td><td>Group.Read.All</td><td>Read all groups.</td><td>application</td></tr><tr><td>Microsoft Graph</td><td>Contacts.ReadWrite</td><td>Read and write contacts in all mailboxes.</td><td>application</td></tr><tr><td>Microsoft Graph</td><td>Group.Create</td><td>Create groups.</td><td>application</td></tr><tr><td>Microsoft Graph</td><td>Files.ReadWrite.All</td><td>Read and write files in all site collections.</td><td>application</td></tr><tr><td>Microsoft Graph</td><td>Calendars.ReadWrite</td><td>Read and write calendars in all mailboxes.</td><td>application</td></tr><tr><td>Microsoft Graph</td><td>Tasks.ReadWrite</td><td>Create, read, update, and delete user's tasks and task lists.</td><td>delegated</td></tr><tr><td>Microsoft Graph</td><td>Directory.ReadWrite.All</td><td>Read and write directory data.</td><td>delegated</td></tr><tr><td>Microsoft Graph</td><td>Group.ReadWrite.All</td><td>Read and write all groups.</td><td>delegated</td></tr><tr><td>Microsoft Graph</td><td>offline_access</td><td>Maintain access to data you have granted access to.</td><td>delegated</td></tr></tbody></table>

#### Exchange Online <a href="#exchange-online" id="exchange-online"></a>

| API name                   | Claim value             | Permission                                                                 | Type        |
| -------------------------- | ----------------------- | -------------------------------------------------------------------------- | ----------- |
| Office 365 Exchange Online | full\_access\_as\_app   | Use **Exchange Web Services** (**EWS**) with full access to all mailboxes. | application |
| Office 365 Exchange Online | Mail.ReadWrite          | Read and write mail in all mailboxes.                                      | application |
| Office 365 Exchange Online | Calendars.ReadWrite.All | Read and write calendars in all mailboxes.                                 | application |
| Office 365 Exchange Online |                         |                                                                            | delegated   |

#### Office 365 SharePoint Online <a href="#office-365-sharepoint-online" id="office-365-sharepoint-online"></a>

| API name                   | Claim value             | Permission                                                                 | Type        |
| -------------------------- | ----------------------- | -------------------------------------------------------------------------- | ----------- |
| Office 365 Exchange Online | full\_access\_as\_app   | Use **Exchange Web Services** (**EWS**) with full access to all mailboxes. | application |
| Office 365 Exchange Online | Mail.ReadWrite          | Read and write mail in all mailboxes.                                      | application |
| Office 365 Exchange Online | Calendars.ReadWrite.All | Read and write calendars in all mailboxes.                                 | application |
| Office 365 Exchange Online |                         |                                                                            | delegated   |

***

## Useful links and items

{% embed url="<https://learn.microsoft.com/en-us/microsoft-365/admin/add-users/about-admin-roles?view=o365-worldwide>" %}