Microsoft 365 & Google Workspace
A connector is a customer's SaaS tenant, authorised once, that jobs can then read from. The data is copied out as ordinary files — .eml messages, the documents themselves — into storage the customer owns, incrementally, on a schedule. Connectors are separate from storage targets: a connector is only ever a source.
Connectors are not available on a trial; the tile is greyed in the wizard until the customer is on a paid plan, and becomes active the moment they are.
Microsoft 365 #
Connect the tenant #
- Connectors → Microsoft 365 → Connect Microsoft 365. Do this while signed in to the console as a user of the customer whose tenant it is (or with that customer selected), so the connection is recorded against them.
- Grant admin consent in the tab that opens, signed in as a Global Administrator of the customer's Microsoft 365 tenant. The permissions are application permissions, read-only for backup and write only for restore, so backups run without any user's credentials and survive that admin leaving.
- Refresh the Connectors page. It shows Connected with the date consent was granted. Disconnect from the same place; a customer's Global Admin can also revoke the app from Entra at any time, which stops backups until it is granted again.
Create the backup job #
Jobs → New Job → Connector → Microsoft 365, or the Microsoft 365 backup template. The source step lists the tenant live: Mailboxes, OneDrive, SharePoint Sites and Teams channels. Tick what you want, or for each type tick Back up all — including ones created later: the job then re-reads the directory on every run and sweeps in new starters and new sites without anyone editing it.
Choose where it runs — one of the customer's agents, or the Caryvane Cloud Agent so nothing passes through their hardware — the destination storage target, and the interval (every 6 hours by default). The first run is a full copy; every run after that asks Microsoft for what changed since the last one, so a 200-mailbox tenant costs minutes a day, not hours.
What is stored, and where #
| Resource | Stored as | Under |
|---|---|---|
| Mailbox | One .eml per message, folders preserved in the catalogue | <prefix>/mail/<user>/<year>/ |
| OneDrive | The files, in their folder structure | <prefix>/onedrive/<user>/ |
| SharePoint site | The document libraries' files | <prefix>/sharepoint/<site>/ |
| Teams channel | Messages as JSON, one file per day, plus attachments | <prefix>/teams/<team>/<channel>/ |
Because they are plain files, anything that can read the bucket can read the backup; the catalogue the console keeps is what makes them searchable and restorable by item.
Google Workspace #
Connect the domain #
Google Workspace is authorised with domain-wide delegation to Caryvane's service account, granted by the customer's Workspace super-admin. There is no OAuth pop-up: the customer authorises the service account's client ID for a fixed set of read-only scopes in their admin console, once.
- Connectors → Google Workspace → Connect Google Workspace. The dialog shows the client ID to authorise and the exact scopes list to paste. Enter the customer's Workspace domain and an admin email to impersonate (any super-admin; used only to list users).
- In the customer's Google Admin console: Security → Access and data control → API controls → Manage Domain Wide Delegation → Add new; paste the client ID and the scopes.
- Verify. Back in Caryvane, Re-verify tries each scope against the domain and names any that is missing. Verified with a date means backups can run.
Create the backup job #
Jobs → New Job → Connector → Google Workspace. Per user: Gmail, Google Drive, Calendar, Contacts; and the domain's Shared Drives. The same all — including ones created later switch, the same choice of agent or Cloud Agent, the same interval. Gmail is stored as .eml under <prefix>/gmail/<user>/<year>/; Drive files under <prefix>/drive/<user>/ with Google-native documents exported to Office formats; calendars and contacts as standard .ics and .vcf.
Archive a leaver #
When someone leaves, the licence goes and with it the mailbox — thirty days later, silently. The archive is a one-off snapshot of one person taken before that: Connectors → Office Archive → New Archive (or Google Workspace Archive). Choose the person, tick mailbox and/or OneDrive/Drive (and any SharePoint sites they owned), the storage target, and whether it runs on an agent or the Cloud Agent. The result is a single ZIP, catalogued and listed under Archives with its size and date, downloadable from the console for as long as the customer keeps it. It never deletes anything from Microsoft or Google; removing the account is the customer's step, taken afterwards.
Restore items #
On the job: ⋮ → Browse backup. Search or browse to the item; Download it, or Restore to original to put a message back in the mailbox or a file back in the drive at its original path. Teams messages are download-only. Details in Restore data.
Things to know #
- One connection per customer per platform. A customer's Microsoft 365 tenant is connected once and every job for that customer uses it.
- Throttling. Microsoft and Google rate-limit; the runner backs off and continues, so a first full run of a large tenant can take a day. It is resumable — an interrupted run continues from its change token next time.
- Consent must stay in place. If the customer's admin removes the app, or a Google scope, every job for that connector fails until it is re-granted; Troubleshooting covers the symptoms.
- Retention. A connector job overwrites the stored copy of an item that changed; turn on Keep previous versions on the job to keep the old copy too.