Symptoms

Backup of Microsoft 365 or Exchange public folders fails with an 'access denied' error or completes with warning. For example:

Cannot retrieve the contents of Microsoft 365 mailbox folder 'NNNN': '[Microsoft][ews-code=ErrorAccessDenied]: Access is denied. Check credentials and try again., ICS synchronization failed.

Solution

The issue is caused by the lack of permission to Public folder for the user. 

Identify the user performing backup

1. In Cyber Protection Console, open All properties of affected public folder:
   
2. Locate accessUser property and note its value:
   
3. Modify URL in browser so it should look like https://<your_data_center>/api/resource_manager/v1/o365/users?limit=1000 and run it.
   For example: https://us5-cloud.acronis.com/api/resource_manager/v1/o365/users?limit=1000
   Do not open new tab, just run request in existing tab to ensure you are authenticated in cloud.
4. In the obtained JSON data, find the noted value. Note the corresponding user:
   

Check and assign permissions

Verify that the user has sufficient permissions for public folder backup or restore:

• To back up a public folder, your account must have the ReadItems permission.
• To recover a public folder, it must have the CreateItems, EditAllItems, DeleteAllItems, CreateSubfolders permissions.

The default Owner and PublishingEditor roles have these permissions.

Do the following to check (and assign) the permissions:

Exchange Server 2013, 2016, 2019 

1. Log in to your Exchange admin center.
2. On the left pane, click public folders.
3. On the public folders tab, click the ellipsis (…) button, and then click Root permissions.
4. Check whether your account is on the list.
5. If this account is not listed, you need to add ir. Click the plus (+) button.
6. The public folder permissions window opens. Click browse and select your backup account. Click OK.
7. In the Permission level drop-down menu, select Owner. Click Save.
8. Select the Apply changes to this public folder and all its subfolders checkbox. Click Save.

Microsoft 365

1. Log into the Microsoft 365 admin account.
2. In the upper-left corner, click the grid icon.
3. Click the Admin button to go to the admin center.
4. On the left pane, find the ADMIN button. Click the arrow next to this button to expand the options.
5. Click Exchange.
6. Click Public Folders.
7. On the public folders tab, click the ellipsis (…) button, and then click Root permissions.
8. Check whether your account is on the list.
9. If this account is not listed, you need to add it. Click the plus (+) button.
10. The public folder permissions window opens. Click browse and select your account. Click OK.
11. In the Permission level drop-down menu, select Owner. Click Save.
12. Select the Apply changes to this public folder and all its subfolders checkbox. Click Save.