Auto-protection and mass management¶
Auto-protection settings¶
To support automatic protection and backup for new Microsoft resources (Users, Shared/room mailboxes, SharePoint sites, Groups, or Teams), Afi provides granular auto-protection settings that can be configured per resource kind (User, SharePoint site, etc.) or per an AAD (Azure Active Directory) Group.
Automatic protection settings are managed on the Service → Protection → AAD Groups tab. To enable automatic protection, Afi account administrator should select AAD Group(s) for which automatic protection should be enabled, click on the Assign SLA button, make sure that the Automatically protect new resources checkbox is checked and select a backup SLA policy that will be automatically applied by Afi to resources added in the selected group(s). Please note that, as a result, the system will also update the SLA settings for resources already present in the specified group(s).
If automatic protection is enabled, the system will assign a configured SLA policy to any resource added to the corresponding group. This applies regardless of whether the resource was newly created in the corresponding Microsoft 365 tenant or transferred from another group with a different SLA policy. In the latter case, the SLA policy assigned to the resource will be updated accordingly. It should be mentioned that, as protection against possible configuration mistakes, a resource will retain its SLA policy when moved to a group that lacks auto-protection settings.
With granular auto-protection settings that Afi provides, Afi administrators can assign different SLA policies for different groups based on the organization requirements. For example, as retention settings are linked with backup SLA policies, it is possible to keep different retention settings for different groups of users and update these settings (together with the SLA policies) for users automatically, if they are moved across AAD groups with different settings.
Info
If a user belongs to several AAD Groups which are configured to be automatically protected with different backup SLA policies, the service can change its backup SLA policy to any policy assigned to the corresponding groups. To avoid confusion in such cases, we advise to assign different backup SLA policies to resource groups that don't have common members or create dedicated AAD Groups on the Microsoft 365 side specifically for auto-protection management on Afi side.
Info
If you want to automatically protect all newly added resources in a Microsoft 365 tenant (or just all newly added resources of a specific kind), you can use the default resource groups under the All resources section on the Service → Protection → AAD Groups tab. If auto-protection is already configured through the default resource groups, you don't need to additionally configure auto-protection for AAD groups.
Info
Please note that when an AAD group is protected on the Service → Protection → AAD Groups tab, it applies to all users and shared/room mailboxes in this group, but doesn't apply to the corresponding AAD Group resource, which should be protected manually on the Service → Protection → Groups & Teams tab or automatically by configuring auto-protection for the default Microsoft 365 Groups & Teams resource group.
Resource synchronization between Afi and Microsoft 365¶
To discover new resources (users, sites, etc.) and update resource statuses, Afi performs resource synchronization with Microsoft 365 once every 24 hours. Therefore, a user or any other resource created on the Microsoft side should appear in the Afi system within 24 hours of its creation. Once Afi has synchronized new resources in the system, it will assign a backup SLA policy to these resources based on their AAD groups and will back them up according to the schedule configured for the assigned backup SLA policy.
To trigger an out-of-schedule resource synchronization between Afi and Microsoft 365, click the refresh icon in the top-right corner of the Service → Protection screen. Once the synchronization is complete, the Afi UI will refresh automatically, and the new resource(s) will appear on the Protection screen.
