Upgrading Veeam Backup for Microsoft 365 from v7 to v8: The Migration That Is Not a Simple Update

Upgrading Veeam Backup for Microsoft 365 from v7 to v8 is not a next-next-finish operation. The backend database moves from SQLite to PostgreSQL. A new NATS messaging component installs alongside the server. Every proxy and every repository must be upgraded after the server finishes. Permissions in your Entra app registration need to be re-granted. And Microsoft changed its throttling enforcement model in a way that directly affects how you have been scaling backup performance. This article covers every step, in order, with the gotchas that the upgrade wizard does not warn you about loudly enough.

---

What You Are Actually Upgrading

The v7-to-v8 upgrade changes the fundamental architecture of the product. Understand what is moving before you start.

SQLite to PostgreSQL. Every SQLite configuration database and every per-proxy persistent cache database migrates to a centralized PostgreSQL instance. This is a one-way migration. There is no rollback path to SQLite after it completes. The duration depends on database size - a 50 GB configuration database takes approximately 15 minutes. Small environments finish in under a minute.

NATS server installation. v8 installs a NATS messaging server as a new infrastructure component. NATS handles communication between proxies in a pool. Even if you are not using proxy pools yet, NATS installs during the upgrade. The installer either deploys NATS locally on the VBO365 server or connects to an existing NATS instance you have already deployed.

Proxy and repository upgrades. After the server upgrade finishes, every proxy server and every repository is marked Out of Date. They must be upgraded manually from the console before backup jobs run again. The default local proxy upgrades automatically. Remote proxies do not.

Permission model changes. v8 requires new Entra application permissions that did not exist in v7. Without them, shared mailboxes are misidentified, public folders are silently skipped, and Teams private and shared channels are not backed up.

---

Prerequisites

Run through this list completely before mounting the ISO. Missing any of these causes either a failed upgrade or a degraded state that is harder to fix than getting it right the first time.

---

The Upgrade: Step by Step

1. 1Take your snapshot. Snapshot or back up the VBO365 server VM now. Not later. Now.
2. 2Disable all backup jobs. Right-click each job and select Disable. Wait for any active sessions to complete.
3. 3Mount the v8 ISO. Download the latest v8 build from the Veeam downloads page. Mount the ISO on the VBO365 server.
4. 4Launch the installer. Run the setup executable. The wizard detects the existing v7 installation and offers an upgrade path. Accept the license agreement.
5. 5Provide your license file. The license file from v7 is not automatically detected during upgrade. You must provide it again. If you skip this step, the product runs in community edition mode until you manually install the license from the Configuration page.
6. 6System configuration check. The wizard verifies .NET Runtime and PowerShell versions. If either is missing or too old, the wizard blocks the upgrade. Install them and restart the wizard.
7. 7Review Entra application permissions. The wizard checks whether your existing Entra app registration has the permissions v8 requires. It shows a summary of what is missing. Note this information - you will need to act on it after the upgrade. The wizard does not fix permissions for you at this step.
8. 8Configure PostgreSQL. Choose between installing PostgreSQL locally or connecting to a remote instance. If installing locally, the wizard handles it. If using a remote instance, provide the host, port, database name, and credentials. The wizard then migrates all SQLite databases to the PostgreSQL instance. Watch the progress bar. On large environments this is the longest step.
9. 9Configure NATS. The wizard installs the NATS server. For a local installation, it generates a password automatically - copy and save this password. For a remote NATS instance, provide the connection details. One NATS server per VBO365 deployment. Do not share NATS across separate deployments.
10. 10Complete the wizard. The installer finishes, restarts services, and the VBO365 console is ready to open. The server upgrade is done. Everything else is post-upgrade work.

---

Post-Upgrade: The Work That Matters

The server upgrade is the easy part. The post-upgrade tasks are where things go wrong if you rush through them or skip steps. Do these in order.

1. Upgrade All Proxy Servers

Open the VBO365 console and navigate to Backup Infrastructure. Every remote proxy is marked Out of Date. Right-click each proxy and select Upgrade. The console pushes the v8 proxy binaries to the remote server. This requires the credentials you documented earlier. If a proxy fails to upgrade, check that the service account credentials are current and that the proxy server has .NET Runtime 8.0.7+ and PowerShell 7.4.2+ installed. The default local proxy upgrades automatically during the server upgrade - you do not need to touch it.

2. Upgrade All Backup Repositories

Under Backup Infrastructure, repositories are also marked Out of Date. Right-click each repository and select Upgrade. This updates the repository metadata format for v8. Do not skip this step. An unupgraded repository will appear to work but may have inconsistent cache state that causes restore failures later.

3. Grant Exchange.ManageAsApp and Global Reader

This is the most commonly missed post-upgrade step and the source of the most support cases. After upgrading, you must grant two new permissions to the Microsoft Entra application: the Exchange.ManageAsApp permission and the Global Reader role. Without both of these, public folder and discovery search mailboxes are silently skipped from backup processing, and shared mailboxes are misidentified as user mailboxes in the console and backup reports.

To grant them: right-click your organization in the console, select Edit Organization, click through to the Microsoft 365 Connection Settings page, select Use an existing Microsoft Entra ID application, click Install, and check the Grant the required permissions to this application and register its certificate in Microsoft Entra ID checkbox. Finish the wizard. Alternatively, sign into the Entra admin center and grant both manually.

4. Grant Teams Private and Shared Channel Permissions

If you back up Microsoft Teams, the Entra application also needs ChannelMember.ReadWrite.All and Files.ReadWrite.All application permissions to protect private and shared channels. The same Edit Organization wizard with the Grant permissions checkbox handles this. After the permissions are granted and the next backup runs, VBO365 performs a one-time full backup of messages from private and shared channels. This may temporarily increase your Microsoft Teams Export API costs for that cycle.

5. Switch Legacy Auth Organizations to Modern App-Only

If any of your organizations were added using basic authentication or modern authentication with legacy protocols allowed, switch them to modern app-only authentication now. Microsoft deprecated basic auth and legacy protocols. v8 still supports existing legacy-auth orgs for backward compatibility, but you cannot add new orgs with legacy auth. Switching is done through the Edit Organization wizard - select modern app-only authentication and follow the prompts to register or update the Entra application.

6. Remove Extra Backup Application Registrations

As of March 1, 2026, Microsoft enforces its terms of use that prohibit multiple application registrations performing the same operations within a tenant (KB4821). Previously, deploying extra backup application registrations was a common way to distribute API calls and reduce throttling. Microsoft now pools throttling limits across all similar applications, so extra registrations no longer improve performance. Right-click your organization, select Manage backup applications, and remove any additional registrations. Removing them from VBO365 does not delete them from Entra ID - you must manually remove them from the Entra admin center as well.

7. Clean Up the Old Object Storage Cache Directory

In v7, the persistent object storage cache lived in a local directory on each proxy. In v8, that cache is centralized in PostgreSQL. After upgrading, the old cache directory still exists on disk but is no longer used. You can safely delete it to reclaim disk space. The directory location depends on your v7 configuration - check the proxy settings for the path.

8. Upgrade REST API on Separate Machines

If you run the VBO365 REST API on a separate machine from the server (common in Restore Portal deployments), the REST API component must be upgraded manually on that machine. The server upgrade does not touch remote REST API installations. Mount the same v8 ISO on the REST API machine and run the upgrade wizard selecting the REST API component.

9. Re-enable Backup Jobs

Once every proxy is upgraded, every repository is upgraded, permissions are granted, and your REST API is current, re-enable your backup jobs. Monitor the first run closely. The first backup session after the upgrade may take longer than normal because VBO365 rebuilds its internal cache in PostgreSQL. Subsequent runs return to normal incremental performance.

---

Optional: Migrate Standalone Proxies into a Proxy Pool

v8 introduces proxy pools, which group multiple proxies into a single logical unit that distributes backup work across pool members. If you have multiple standalone proxies from v7, you can now combine them into a pool for better load distribution and Microsoft throttle management. Proxy pools require object storage repositories - Jet-based (local) repositories are not supported for pool members. To create a pool, select your proxy servers in the Backup Infrastructure view, right-click, and choose Add to Pool. Then update your backup jobs to target the pool instead of individual proxies.

---

Upgrade Failure Recovery

If the upgrade fails mid-way through the PostgreSQL migration or the installer crashes, your first and best option is reverting to the VM snapshot you took before starting. Restore the snapshot, investigate what went wrong, fix the prerequisite, and try again.

If you did not take a snapshot (please take the snapshot next time), the situation is more complex. The SQLite databases may be partially migrated, and JetDB state may be inconsistent. At this point you are in Veeam support case territory. Do not attempt to manually roll back the PostgreSQL migration or restart the installer without support guidance. Forum reports of failed upgrades without snapshots describe multi-day recovery processes involving JetDB corruption repair.

---

Post-Upgrade Checklist

---