Microsoft 365 Backup Job Failure

Product version: 11.2 

Last modified: 25 June 2026

Problem

The Microsoft 365 backup job fails.

Possible Causes and Solutions

Insufficient Permissions

Your Microsoft 365 account credentials may lack the necessary permissions. 

Make sure that the Microsoft 365 (Exchange Online) credentials have sufficient permissions to be used by NAKIVO Backup & Replication.

Interrupted Connectivity

Incorrect network settings may cause a Microsoft 365 backup job to fail.

Make sure the network settings are configured correctly.

Temporary Java Transporter Folder Free Space Problem

The Microsoft 365 backup job may fail if the temporary java transporter folder is out of space.

The temporary java transporter folder must have more than 5GB of free space on disk for temporary files in tmp folder. The disk that installed this path should also have at least 10GB of free space available. The default path for the tmp folder is the following:

  • Win: C:\Program Files\NAKIVO Backup & Replication\transporter\java\tmp

  • Linux: opt/nakivo/transporter/java/tmp

To change tmp java transporter folder location, take the following steps:

  1. Stop the NAKIVO Backup & Replication Transporter service.

  2. Enable Expert mode in your instance by adding “expert” (or “&expert”) to the end of the URL of the Settings page.

  3. Locate the expert setting system.transporter.modern.arguments.

  4. Add this to the end of the string:

    -DtempPath={full directory}

    For example: -DtempPath=D:\Dtmp

  5. Start the NAKIVO Backup & Replication Transporter service.

Antivirus Software Problem

Some NAKIVO Backup & Replication actions may result in antivirus software flagging the solution as a threat.

Make sure the following path is added to the exception of the antivirus software:

C:\Program Files\NAKIVO Backup & Replication\transporter\java\tmp

Lack of RAM

The lack of sufficient amount of RAM may case the Microsoft 365 job to fail.

Refer to the following article.

MS Graph Forbidden

Microsoft Graph rejected the request sent during the Microsoft 365 backup operation. This usually occurs when access to a Microsoft 365 resource is denied due to insufficient permissions, security policies, or other Microsoft service restrictions.

Check the following:

  • Make sure the Microsoft 365 account or application used for the backup job has the required Microsoft Graph permissions.

  • Verify that admin consent has been granted for the required permissions.

  • Check whether Microsoft Entra Conditional Access or other security policies are blocking the request.

  • Review the backup job logs to identify the Microsoft Graph operation that was rejected.

Site Access Blocked or Inaccessible

Microsoft 365 has blocked access to a OneDrive for Business, SharePoint Online, or Microsoft 365 Group / Teams site, so NAKIVO Backup & Replication cannot read its data. The cause is the site's lock state (NoAccess or ReadOnly), which only a Microsoft 365 administrator can change.

In the job log, you see an alarm such as:

"Access to the site [url] for the [name] ... has been blocked. Please contact your Microsoft 365 administrator to resolve this problem."

"The [name] OneDrive is inaccessible. Make sure the OneDrive is available. If it was deleted, edit the job and remove this OneDrive."

A Microsoft 365 administrator must unlock the site using the SharePoint Online Management Shell (there is no SharePoint Admin Center UI for this, and the SharePoint Administrator or Global Administrator role is required):

  1. Install the module (one-time, in an elevated PowerShell session):

    Install-Module -Name Microsoft.Online.SharePoint.PowerShell -Force

    If prompted to trust the PSGallery repository, confirm.

  2. Connect to your tenant and sign in with the admin account when prompted:

    Connect-SPOService -Url "https://<your-tenant>-admin.sharepoint.com"

    Replace <your-tenant> with your tenant name (the part before .sharepoint.com).

  3. Check the site's lock state, using the site URL from the alarm:

    Get-SPOSite -Identity "<SiteURL>" | Select-Object Url, LockState

    The URL looks like https://<tenant>.sharepoint.com/sites/<name> for a SharePoint or Group/Teams site, or https://<tenant>-my.sharepoint.com/personal/<user> for OneDrive.

  4. Unlock the site, then re-run the check from the previous step to confirm LockState is now Unlock:

    Set-SPOSite -Identity "<SiteURL>" -LockState Unlock

  5. Re-run the backup job in NAKIVO Backup & Replication.

If several sites are blocked, you can unlock them all at once:

Get-SPOSite -Filter {LockState -eq "NoAccess"} | Set-SPOSite -LockState Unlock

If the site was locked by a site-closure (lifecycle) policy, Unlock will not work — reopen it through that governance tooling instead, then re-run the job.

Backup Repository Hit Storage API Limit

The storage service used by the backup repository rejects requests due to limits or restrictions.

Check the following:

  • Ensure the storage account has not reached its quota or usage limits.

  • Verify that the repository credentials have sufficient permissions.

  • If the repository uses cloud or object storage, review the bucket or container settings in the storage provider and ensure that object lock, immutability, or default retention policies are not preventing write or cleanup operations.

  • Retry the backup job after resolving the issue.

Other Causes

In case none of the solutions solve your problem, create a support bundle, and send it to us.