SharePoint Online

Since 0.4.0, Restow backs up the SharePoint Online sites of a Microsoft 365 tenant, through Microsoft Graph, next to its mailboxes and OneDrives. Every site is a protected object of its own, it runs in the same backup jobs, and you browse and restore it in the same Restore explorer. SharePoint Server (on premises) is not supported.

What is backed up

Finding the sites. Every directory sync lists the tenant’s sites (Microsoft Graph /sites/getAllSites). Sites of Microsoft 365 groups and of Teams are included; the files of a team live in the document library of its site and are backed up with it. Personal sites are left out: they are the OneDrives, which are protected through their owner. Each site found becomes a protected object of the type SharePoint site (Tenant settings → Protection → Objects, filter Type), and it runs in the mail jobs (Mail & SaaS → Jobs) like a mailbox or a OneDrive: a job with the scope “every object that is in no other job” therefore covers every site as well. To keep sites out of such a job, switch the sites mode to the selected sites only before the next directory sync.

A newly protected site gets its first backup at once, like any other new protected object. A site that the listing no longer returns is marked Orphaned (Removed from source in the restore explorer); its restore points stay. Since 0.4.7 such a site waits for an administrator to confirm that this is intended, like every object that is no longer backed up (Objects that are no longer backed up), and a site that Microsoft locked is handled the same way (see Failures and warnings).

What a backup holds. Each run of a site produces one restore point:

Part of the site	What is saved
Document libraries	Every document library, including the library of the site’s pages and the one for its assets. Files with their folders, saved with the same engine as OneDrive: Microsoft’s delta query per library (later runs read only what changed), optional older versions, and checkpoints, so a long run continues where it stopped.
Lists	Every visible list, with its columns. Hidden system lists and libraries that appear as lists are skipped.
List items	Each item’s field values as JSON, with its content type, author and dates.
The site itself	Its title, address and description.

Lists have no delta query: each run reads a list in full, and an item that did not change reuses its stored bytes, so storage does not grow with it. Sharing information (the sharing of a library’s top folder and of single items) is saved as information and never restored.

A library or a list that Microsoft Graph refuses (403, 404 or 423) is reported as a failed item and keeps its last copy; the rest of the site is backed up, and the run ends with warnings (see Backup jobs for how warnings show). Since 0.4.7 this also covers a library or list that Graph will not give for other reasons (400, 501, or a lasting 500 for a list template or a library’s permissions), and when every library of a site answers 423 (the site is locked) the run ends without a restore point instead of carrying old copies forward (Failures and warnings). SharePoint is throttled by Microsoft like OneDrive, with the same waits, the same backup queue and the same parallelism per tenant; the first backup of a large site can take long.

A site that was deleted in Microsoft 365 fails with graph.site_unavailable (“This SharePoint site no longer exists”). Its existing restore points stay restorable.

SharePoint needs one application permission that mail and OneDrive do not: Sites.ReadWrite.All (Microsoft Graph, application permission). Sites.Read.All is enough to find and back up sites, but not to restore into them.

Permission granted	Sites found and backed up	Restore into a site
`Sites.ReadWrite.All`	Yes	Yes
`Sites.Read.All` only	Yes	No: restoring files or list items into a site fails. Download as ZIP still works.
Neither	No	No

The permission is optional: a tenant that consented before 0.4.0 still counts as complete, and mail and OneDrive are not affected. To switch SharePoint on:

Add the permission to the backup’s app registration (once, as the operator): Microsoft Graph, Application permissions, Sites.ReadWrite.All. The Entra walkthrough is under First steps; the product repository has a longer setup guide, ENTRA-SETUP.md (written in German). Installation → Microsoft multi-tenant app lists the permission too. In your own tenant, select Grant admin consent on the API permissions page.
Every customer’s admin consents again. An added permission only applies in a customer tenant after a new admin consent. On the Microsoft 365 source (Tenant settings → Connections → Microsoft 365), choose Create new consent link (valid for one hour) and send it to a Global Administrator or Privileged Role Administrator of that tenant. They consent for the organization and sign in a second time, exactly as at the first connection. The link only works in the tenant that is already connected.
Verify permissions. The checklist now shows Sites.ReadWrite.All as Granted (marked Optional). The next directory sync finds the sites; saving the protection rules queues one at once.

What you see while the permission is missing:

On the source, under Application permissions, a notice SharePoint sites are not backed up (nothing granted) or SharePoint sites can be backed up, not restored into (only Sites.Read.All).
In the directory sync, a warning with the code sites_unavailable: “SharePoint sites are not found or backed up: the tenant has not granted the backup app Sites.Read.All or Sites.ReadWrite.All”. Sites that are already known stay as they are.

A source that is connected through its own app (a Graph app that the customer registered in their own tenant, since 0.2.2) has no consent link. Add Sites.ReadWrite.All to that app registration in the customer’s Entra admin center, grant admin consent there, then run Verify permissions on the source.

Protection rules: the sites mode

The protection rules of a source (Tenant settings → Protection → Sources and rules → Edit rules) have a switch of their own for sites, Protect all SharePoint sites:

On (the default): every site of the tenant is backed up, including the sites of Microsoft 365 groups and Teams. Exclude single sites in the list of protected objects.
Off (“only the selected ones”): no site is backed up unless you include it in the list of protected objects.

An individual decision on one site (Always include or Exclude from backup, also as a bulk action) beats the mode. The group scope, the exclusion list and the switch for shared mailboxes do not apply to sites. Switching the mode never deletes a backup: a site that leaves the scope is no longer backed up and keeps its restore points. Saving the rules queues a directory sync that applies the change.

Browse and restore

Open Mail & SaaS → Restore explorer and pick a site in the section SharePoint & Teams of the list (called SharePoint & Teams sites before 0.4.5), which has a section of its own, apart from the people (since 0.4.2; before it, you chose the account type SharePoint sites, which the type filter still offers). Sites of Microsoft 365 groups and Teams are listed there too, and a site that was removed from the source is marked as orphaned. Pick a site and a restore point. The site has two areas: Libraries (folders and files, with the older versions where Restow captured them) and Lists (list items). The explorer also shows the Suspicious badge on a restore point that Restow judged to carry signs of ransomware, and Immutable until with a date where a repository is locked; see Ransomware detection and Immutable backups.

Download as ZIP works for any selection: files, folders, and list items as JSON files, together with site.json (the description of the site and its libraries and lists).

Restore … asks where to restore to:

Target	What happens
Original location	Files and folders go back into their original library, at the path they had. List items go back into their original list, as new items.
Another account	For a site this means another library: choose a library of a backed-up site of the same Microsoft 365 source; add `:/Folder` to restore into a subfolder. If you restore several libraries into one other library, each gets a folder with its own name. Offered to restore operators and administrators.
Download as ZIP	As above.

If an item already exists:

Keep both (the default): nothing existing is touched. A file that exists is restored under a new name, and list items are added as new items.
Overwrite: only offered for SharePoint sites, because SharePoint keeps the replaced file as an earlier version. A file that exists is overwritten, and a list item that still exists gets its backed-up values back. Mailboxes and OneDrives are still never overwritten.
Skip existing: items that are still there stay as they are; only missing items are restored.

Like a OneDrive restore, Restow uploads large files in sessions and compares size and hash of what it wrote with the backup; an item whose confirmation does not match is shown as Not confirmed.

List items are restored with their writable fields only: system, read-only, hidden and calculated columns are left out. SharePoint sets the creation and modification dates and the authors of a new item itself. A repeated restore in the mode Keep both adds the items again.

A site belongs to no person. Restoring it is therefore not an admin restore on someone’s behalf and needs no reason, but every restore is written to the audit log as usual.

Who sees sites. Only restore operators and administrators see SharePoint sites in the Restore explorer. End users never do. In the status, sites are listed next to mailboxes and OneDrives but count as no protected mailbox.

Verification, ransomware signals and notifications

Restore check. The check reads back a sample of up to 20 files from the libraries of a restore point and compares them with the manifest, like it does for a OneDrive. List items are not part of the sample. See How Restow checks that a backup can be restored.
Ransomware signals. Every new restore point of a site is judged from data the backup already has: the amount of change (items written, bytes added) and the compression and deduplication of the new data. Deletions, renamed extensions, file names and entropy exist for machines, file shares and OneDrives only, so for a site they say “not available”, never “clean”. A finding puts the Suspicious badge on the restore point and pauses retention for the site until an administrator resolves it. See Ransomware detection.
Immutable backups. The data of a site lives in the tenant’s chunk store, so the immutability of a repository covers it like mail and OneDrive. See Immutable backups.
Notifications. There are no new events: the notifications for failed and succeeded backups and for overdue ones cover sites like mailboxes, with the site as the object.

What is not backed up

Microsoft Teams chats and channel messages. Teams as a whole is not covered. The files of a channel are in the library of the team’s site and are backed up with it. Since 0.4.5 the calendar and the conversations of the Microsoft 365 group behind a team are backed up as a group mailbox (Microsoft 365 groups); channel messages and chats are not.
Attachments of list items. Microsoft Graph v1.0 has no interface for them.
Site design and themes, navigation, web parts outside the library of the site’s pages, the site template and the content type hub. Not backed up, or kept as information only.
Workflows (SharePoint 2010 and 2013), Power Automate and Power Apps.
Permissions. The sharing of libraries and items is kept as information and is never restored; site groups and memberships are not saved at all.
SharePoint Server on premises.

Restore has these limits: a deleted site or library is not recreated (you restore into a library that exists), and list items go back only into their original list.

Failures and warnings

Code	Where	Text in the interface	What to do
`graph.site_unavailable`	Run of a site	This SharePoint site no longer exists	The site was deleted or its address changed. Existing restore points stay restorable; the next directory sync marks the site as orphaned.
`graph.object_locked`	Run of a site (since 0.4.7)	Not backed up: Microsoft locked the OneDrive or site	Microsoft answers every request for the site with HTTP 423 (“Access to this site has been blocked”): an administrator locked it, or it belongs to an account without a license. It is no failed backup: a read of the site confirms the lock, the site is marked Not backed up: locked (amber until an administrator confirms it), the run ends neutral without retries and nothing is planned for it. A site whose libraries all answer 423 ends without a restore point instead of carrying old copies forward. Lift the lock in the SharePoint admin center; the directory sync resumes the backup only when a read of the site succeeds, otherwise it keeps the lock and reports that the check failed. A 423 that the read does not confirm stays a counted failure, and a 423 on a single file stays an item problem.
Item failure of a library or list	Run of a site (since 0.4.7)	The item names the library or list	A library or list that Graph will not give (400, 501, or a lasting 500 for a list template or a library’s permissions) is an item failure and keeps its last copy (a list is marked stale); the rest of the site gets its snapshot. A 500 or 502 for a library’s contents still fails the job, which resumes from its checkpoint, and a resumed site counts the item failures of the libraries that an earlier attempt finished.
`sites_unavailable`	Directory sync warning	SharePoint sites are not found or backed up: the tenant has not granted the backup app Sites.Read.All or Sites.ReadWrite.All	Add the permission to the app registration and run the admin consent again (above).
`graph.permission_missing`	Run or restore of a site	The Restow app is missing a Microsoft 365 permission	The error names the permission (`Sites.Read.All`, or `Sites.ReadWrite.All` for a restore into a site). Add it and consent again (above).
`sites_unavailable` (other status than 401 or 403)	Directory sync warning	SharePoint sites could not be listed; the sites known so far stay as they are	Usually Microsoft or the tenant; the next sync tries again.

See Failure explanations for how failures are shown, and Connecting sources for the Microsoft 365 connection.