Microsoft 365: backup reports in a dedicated mailbox

Why a Microsoft 365 mailbox cannot be connected

To read a mailbox Mail Monitor uses IMAP with a username and a password, or an app password. In Exchange Online Microsoft has turned off basic authentication for IMAP, and app passwords do not work for IMAP. This applies to every mailbox on Exchange Online, including those on your own domain.

1. Create a dedicated mailbox

A mailbox whose only job is to receive backup reports, such as [email protected], with a provider that offers IMAP with a password: the email included with your hosting, or a mailbox from an email provider. One mailbox can receive the reports of every job.

• Check that IMAP access is turned on and note the server, port, username and password.
• If your domain already has its email on Microsoft 365, the dedicated mailbox cannot sit on the same domain with another provider: use a subdomain (for example [email protected]) or a separate domain. The main domain’s MX records stay with Microsoft.
• Connect it in Mail Monitor: the connection is verified before saving, and the mailbox is always opened read-only.

2. The best option: the backup sends there

Veeam, Synology, QNAP, Acronis, Iperius and almost every backup tool send notifications through an SMTP server and to a recipient you choose. Set the dedicated mailbox as the recipient: the report emails never go through Microsoft 365 and there is nothing to configure in Exchange.

• The server the emails are sent from can stay as it is, Microsoft 365 included: all that matters is where they arrive.
• If the reports also go to a person today, add the dedicated mailbox as a second recipient.
• Where to change the recipient is in the guides for Veeam, Synology, Acronis, QNAP and Iperius.

3. When the reports can only arrive on Microsoft 365

Some services, cloud ones above all, only send notifications to the account’s address, and that address is on Microsoft 365. In that case an administrator creates a mail flow rule (transport rule) in Exchange Online that copies those emails to the dedicated mailbox. Microsoft’s menu labels change often, so we describe the steps in words.

• Open the Exchange admin centre and look for the rules in the mail flow area (“Mail flow”, then “Rules”).
• Create a new rule. As the condition pick what identifies the reports: the sender, that is the address the backup service writes from, and a word in the subject if needed.
• As the action, add the dedicated mailbox as a Bcc recipient: the email also stays in the Microsoft 365 mailbox. If it is not needed there, you can redirect it instead.
• Save, check that the rule is enabled and trigger a test report: after a few minutes it should show up in the dedicated mailbox.

4. Why forwarding from Outlook is not enough

A forwarding rule created by the user in Outlook, or forwarding set on the mailbox, to an external address usually does not work: the Microsoft 365 outbound spam policy (Microsoft Defender) blocks automatic forwarding to external recipients, and the email never leaves. Use the mail flow rule from step 3, or have the administrator allow external forwarding for that mailbox only, with a separate outbound policy.

5. Create the check in Mail Monitor

• Connect the dedicated mailbox over IMAP. We always open it read-only: nothing is moved or deleted.
• The rest is as in the other guides: sender, subject, required and forbidden words, expected time with a cut-off and a tolerance. With Bcc or redirect the sender stays the original one.
• Before saving, test the rules on the last 50 emails received in the dedicated mailbox.

6. The upside: company email stays out

The dedicated mailbox only holds backup reports. You give Mail Monitor the password for that mailbox, not for your company email: no access to people’s messages, and revoking it takes one password change. That is why we recommend it even to those who could connect their own mailbox.