English

Home > Configure Settings for AvePoint Cloud Backup > Manage Your Storage

Manage Your Storage

In the Settings > Storage page, the storage location and data retention time will be displayed. For custom storage location, you can configure when the backup data will be purged from the storage after the data expires the retention time. The default retention period for BYOS storage is 1 year, and you can customize it for specific containers or object types upon your purchased retention in the subscription.

*Note: If you purchased a subscription for BYOS (Bring your own storage) but are currently using AvePoint default storage for your backup data, your backup jobs will fail and we will send you an email notification every 7 days to remind you to update your BYOS storage configuration.

There are two types of storage locations: the default storage location and the custom storage location. The default storage location is hosted by AvePoint in Microsoft Azure Blob Storage, Amazon S3 storage, or Google Cloud Storage, and cannot be modified. The storage information on Microsoft Azure, Amazon S3 storage, or Google Cloud Storage is displayed on the Settings > Storage page. If you want to use your own storage, contact AvePoint to update your subscription. The default storage location resides in the same Data Center that was selected during your registration to AvePoint Online Services.

If you choose to use AvePoint default storage, you can choose the storage type of your AvePoint default storage location from the following:

- **Google Cloud Storage**

- > ***Note**: This storage type is not supported for customers that have Multi-Geo enabled and is only available in the Google Cloud Platform (GCP) data centers listed below:

	- GCP for Australia Southeast (Sydney) 

	- GCP for West Europe (Eemshaven, Netherlands) 

	- GCP for Japan (Tokyo) 

	- GCP for East US (Moncks Corner)

	- GCP for South Korea (Seoul)

- **Microsoft Azure Blob Storage**

- If you signed up to AvePoint Online Services with the data center **North Europe (Ireland)** or **Australia Southeast (Victoria)**, and you have purchased a subscription to use **AvePoint Azure storage** to store backup data, Cloud Backup for Microsoft 365 will store your data in the data center you signed up for in AvePoint Online Services.

- > ***Note**: AvePoint Cloud Backup for Microsoft 365 supports **United Arab Emirates (Dubai)** as a new data center in October 2025 release.

- If you want to select a different storage region for backup data in Cloud Backup for Microsoft 365, follow these steps:

	1. Sign up for AvePoint Online Services in the desired data center.

	2. Activate your AvePoint Online Services account and log in to Cloud Backup for Microsoft 365, but do not save any settings.

	3. Contact AvePoint support for further assistance. 

- The following storage regions will be available for selection when you sign into the Cloud Backup for Microsoft 365 interface for the first time:

Data Center You Signed Up for AOS	● Available Storage Region for Cloud Backup for Microsoft 365
● North Europe (Ireland)	● North Europe (Ireland)● Qatar Central (Doha)
● Australia Southeast (Victoria)	● Australia Southeast (Victoria)● New Zealand North (Auckland)

- **Amazon S3 storage** 

- > ***Note**: AvePoint Amazon S3 storage is not available for US Gov data center or data center operated by 21Vianet. 

- If you choose to use Amazon S3 storage as the default storage type, refer to the following data center mappings between the data center you signed up to AOS with and the Amazon S3 storage data center.

Data Center You Signed Up for AOS(Home Region)	Amazon S3 Storage Data Center(Storage Region)
East US (Virginia)	US East (N. Virginia)
North Europe (Ireland)	Europe (Ireland)
Southeast Asia (Singapore)	Asia Pacific (Singapore)
Australia Southeast (Victoria)	Asia Pacific (Sydney)
Japan West (Osaka)	Asia Pacific (Tokyo)
UK South (London)	Europe (London)
Canada Central (Toronto)	Canada (Central)
Germany West Central (Frankfurt)	Europe (Frankfurt)
Korea Central (Seoul)	Asia Pacific (Seoul)
France Central (Paris)	Europe (Paris)
Switzerland North (Zurich)	Europe (Zurich)
West Europe (Netherlands)	Not Supported
United Arab Emirates (Dubai)	Not Supported

- > ***Note**: For Multi-Geo customers, the default storage locations are distributed according to the data center mappings. If you are using default storage for Multi-Geo, you have a chance to choose to use the default storage or your own storage for each region while configuring data center mappings in the AvePoint Online Services interface. Once the configurations are saved, you can no longer change the storage path.

For data redundancy, note the following:

- For **Microsoft Azure Blob Storage**, Locally redundant storage (LRS) is the default option to replicate your data.

- For **Amazon S3 storage**, objects will be redundantly stored on multiple devices across a minimum of three Availability Zones in an AWS Region.

If your subscription has BYOS (bring your own storage) enabled, you can configure a custom storage location for all service types or configure separate storage for each service type to store your data, upon your subscription agreement.

	The storage information, apart from its path information, can be modified. 

	Currently, you can choose from the following supported storage types for BYOS:

- Microsoft Azure Blob Storage

- Amazon S3 

- Amazon S3-Compatible Storage

- FTP

- SFTP

- Dropbox

- IBM Storage Protect-S3

- IBM Cloud Object Storage

- Google Cloud Storage

If you are using your own Microsoft Azure storage account, note the following:

- Existing BYOS customers applying immutability policies to Azure blob storage should note the following:

	- **Backup job behavior**: The first backup job executed after applying an immutability policy will fail. However, subsequent backup jobs will process your data within the defined backup scope. 

	- **Data deletion restriction**: If immutability polices are active on your Azure blob storage, all data deletion operations, including unprotected data removal, data retention, manual deletion, and Data Subject Access Requests (DSARs) will be blocked. Data governed by these polices will remain immutable and cannot be altered or deleted unless the policies are modified.

- If you are about to use your own Microsoft Azure Blob Storage as the storage location, AvePoint recommends using the device in the same Data Center as your AvePoint Online Services tenant for the best network performance. 

- Before you add the Azure storage account to the Cloud Backup interface, you must first add the AvePoint IP addresses to your Azure storage account firewall and configure the firewall to allow AvePoint agent servers running on a dedicated ARM Vnet subnet to access your storage location. For details, refer to [Allow AvePoint Agent Servers to Access Your Storage Account](#missing-link).

- After the December 2023 release, Cloud Backup will write your new backup data to the cold tier by default to reduce storage costs. The supported Azure account kinds are **StorageV2** and **BlobStorage** of **Standard** performance type. For existing customers, your former backup data are still stored in the cool tier.

- Additionally, AvePoint recommends keeping the index database in a cool or hot tier, to ensure restore jobs automatically rehydrate data from the archive storage tier.

	For details about blob access tiers and how to change access tiers, refer to the Microsoft article: . 

- If you are using your own Microsoft Azure Blob storage and facing the upper limit of your storage account, you can contact Microsoft Azure support to request an increase. If you have another Azure storage account, you can also append it through the **Storage Location** tab in AvePoint Cloud Backup for Microsoft 365 interface. Currently, you can only append one additional storage account, and this is only available for BYOS customers on Azure. Once the new storage location is saved, the new storage will be used to store backup data for further incremental backup jobs and restore jobs. Cloud Backup services will no longer write to the legacy storage location. However, you must ensure your legacy storage is accessible if the backup job to start later is an incremental backup. Otherwise, the incremental backup will fail. The full backup job to start a new cycle will not be impacted in this case.

Allow AvePoint Agent Servers to Access Your Storage Account

If you are using or plan to use your own storage device, read the instructions in this section carefully and complete the settings upon your need. Otherwise, you can skip this topic.

When you are using your own storage device, you may have set up the storage firewall to only allow trusted clients for security concerns. To ensure that AvePoint cloud products can access your storage, complete the settings as required in the following conditions:

*Note: If you are using a trial subscription and the storage account you want to use in the trial has a firewall enabled, read the conditions below and complete the configurations.

For Microsoft Azure Cloud Platform data centers:

- If you are using Microsoft Azure storage, refer to the following:

	- **If your storage account is in the same data** **center** **as the one you use to sign up for AvePoint Online Services or your storage account is in its** , you must add the Azure Resource Manager (ARM) vNet subnets where the AvePoint servers are running on to your storage networking. You can find additional details in this Microsoft article: , and get the subnet ID of AvePoint cloud products for your data center from . For detailed instructions, refer to the **Add ARM** **Virtual** **Networks** section below.

	- Other than the condition above, you need to add all the reserved IP addresses to the Azure storage firewall. For details, refer to the **Add** **Reserved IP** **Addresses to Azure** **Storage** **Firewall** section below.

- If you are using Amazon S3 in Southeast Asia (Singapore) data center, you need to add all the reserved IP addresses and specific VPC ID to the bucket policy. For details, refer to the **AddReserved IP** **Addresses and VPC ID to Amazon S3** **Bucket** **Policy** section below.

- If you use a storage type other than Microsoft Azure storage and Amazon S3, you must add reserved IP addresses to your storage firewall. To get the list of the reserved IP addresses, refer to .

For Google Cloud Platform (GCP) data centers:

- If you use the Google Cloud Storage in Google Cloud Platform (GCP) data centers, you need to add specific VPC ID to the bucket policy. For details, refer to the **Update the** **lP** **Filter on a Google Cloud Storage Bucket Policy**section below.

- If you use a storage type other than Google Cloud Storage, you must add reserved IP addresses to your storage firewall. To get the list of the reserved IP addresses, refer to .

Add Reserved IP Addresses to Azure Storage Firewall

Follow the steps below:

Navigate to AvePoint Online Services interface > Administration > Security.
Click Download next to the Reserved IP Addresses tile to download the list of reserved IP addresses of AvePoint Online Services. For details, refer to .
Navigate to the storage account that you want to secure.
Select Networking on the menu.
Check that you’ve selected to allow access from Selected networks.
Enter the IP address or address range under Firewall > Address Range.
Select Save to apply your changes.

Add Reserved IP Addresses and VPC ID to Amazon S3 Bucket Policy

To use Amazon S3 storage in Southeast Asia (Singapore) data center, you must add all the reserved IP addresses and the AvePoint AWS VPC ID to your bucket policy.

Follow the instructions in the bucket policy template below.

{

"Version": "2012-10-17", // Specifies the language syntax rules that are to be used to process a policy. 2012-10-17 is the latest version. 

"Statement": [

    {

        "Sid": "S3_IPAllow", // An optional identifier used as a description for the policy statement. 

        "Effect": "Deny", // You must set the Effect element to **Deny** here, which indicates that the access to the resources will be denied if the IP Address is not listed in **aws:SourceIP** and the VPC is not listed in **aws:SourceVpc**. 

        "Principal": {

            "AWS": "*" // Specifies the IAM users who have access to the resources. 

        },

        "Action":[

            "s3:GetObject",

            "s3:\DeleteObject",

            "s3:\PutObject",

            "s3:\DeleteObjectVersion",

            "s3:ListBucket"

        ],

        "Resource": [

            "XXXXXXXXXXXXXXXXX", // Specifies the resources that this S3 bucket policy applies to.

            "XXXXXXXXXXXXXXXXX" 

        ],

        "Condition": {

            "NotIpAddress": {

                "aws:SourceIp": [

                    "XXXXXXXXXXXXXXXXX", // Specifies the IP addresses. Add the AvePoint reserved IP addresses to the list. To get a list of AvePoint reserved IP addresses, refer to .

                    "XXXXXXXXXXXXXXXXX" // 

                ]

            },

            "StringNotEquals": {

                "aws:SourceVpc": "vpc-04c390b29bb119f8f" // The AvePoint AWS VPC ID of Southeast Asia (Singapore) data center.

            }

        }

    }

]

}

Add ARM Virtual Networks

There are two ways to add ARM Virtual Networks:

- Use the Azure CLI tool ()

	## Use the Azure CLI tool

	# Step 1 (Optional): If you have multiple Azure subscriptions, please switch to the correct subscription

	# This command sets the active subscription to the specified subscription ID.

	az account set --subscription xxxxxxxx-xxxx-xxxx-xxxx-yyyyyyyyyyyy

	# Step 2 (Optional): Confirm whether the subscription switch is correct

	# This command displays the current subscription information in a table format.

	az account show --output table

	# Step 3: Get the AvePoint Online Services network subnet resource ID

	# This variable stores the resource ID of the subnet in the virtual network.

	# Replace with the Azure Resource Manager (ARM) VNet ID downloaded from your AvePoint Online Services tenant.

	$SUBNETID="/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-yyyyyyyyyyyy/resourceGroups/ResourceGroupName/providers/Microsoft.Network/virtualNetworks/VirtualNetworkName/subnets/SubnetName"

	# Step 4: Set your resource group name

	# This variable stores the name of the resource group where your storage account is located.

	$DESTRG="customer_resource_group_name"

	# Step 5: Set your storage account name

	# This variable stores the name of the storage account to which you want to add the network rule.

	$DESTSTA="customer_storage_account_name"

	# Step 6: Add the firewall virtual network rule to grant access to AvePoint Online Services

	# This command adds a network rule to the specified storage account, allowing access from the specified subnet.

	az storage account network-rule add --resource-group $DESTRG --account-name $DESTSTA --subnet $SUBNETID

	# Step 7: List the current network rules for the storage account to verify the addition

	# This command lists the virtual network rules for the specified storage account.

	az storage account network-rule list --resource-group $DESTRG --account-name $DESTSTA --query virtualNetworkRules

	# Step 8 (Optional): Disable the public access to storage account

	# This command updates the storage account to deny public network access.

	az storage account update --resource-group $DESTRG --name $DESTSTA --default-action Deny

	# Step 9 (Optional): Verify that the default action for network rules is set to Deny

	# This command shows the network rule set for the specified storage account, including the default action.

	az storage account show --resource-group $DESTRG --name $DESTSTA --query networkRuleSet.defaultAction

- Use the Azure Az PowerShell ()

- ## Use Azure PowerShell (Az Module)

- # Step 1: Sign in to Azure with your Azure Admin account

- Connect-AzAccount

- # Step 2 (Optional): If you have multiple Azure subscriptions, please switch to the correct subscription

- # This command sets the active subscription to the specified subscription ID.

- Set-AzContext -SubscriptionId "xxxxxxxx-xxxx-xxxx-xxxx-yyyyyyyyyyyy"

- # Step 3: Get the AvePoint Online Services network subnet resource ID

- # This variable stores the resource ID of the subnet in the virtual network.

- # Replace with the Azure Resource Manager (ARM) VNet ID downloaded from your AvePoint Online Services tenant.

- $SUBNETID="/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-yyyyyyyyyyyy/resourceGroups/ResourceGroupName/providers/Microsoft.Network/virtualNetworks/VirtualNetworkName/subnets/SubnetName"

- # Step 4: Set resource group name

- # This variable stores the name of the resource group where your storage account is located.

- $DESTRG="customer_resource_group_name"

- # Step 5: Set storage account name

- # This variable stores the name of the storage account to which you want to add the network rule.

- $DESTSTA="customer_storage_account_name"

- # Step 6: Add the firewall virtual network rule to grant access to AvePoint Online Services

- # This cmdlet adds a network rule to the specified storage account, allowing access from the specified subnet.

- Add-AzStorageAccountNetworkRule -ResourceGroupName $DESTRG -Name $DESTSTA -VirtualNetworkResourceId $SUBNETID

- # Step 7: Verify the newly added network rule

- # This cmdlet retrieves the network rule set for the specified storage account.

- Get-AzStorageAccountNetworkRuleSet -ResourceGroupName $DESTRG -AccountName $DESTSTA

You will see the virtual network rules in Azure Portal, as the screenshot below shows. You may also notice that a warning message “Insufficient Permission…” is displayed. It is because the subnet is not in your subscription. You can ignore it.

The vNet rules.

Update the lP Filter on a Google Cloud Storage Bucket Policy

To use the Google Cloud Storage in Google Cloud Platform (GCP) data centers, you must add the AvePoint Google VPC ID to your bucket policy.

Follow the instructions in the bucket policy template below.

{

"mode": "Enabled",

"vpcNetworkSources": [

{

"network": "{VPC id}",

"allowedIpCidrRanges": [

"0.0.0.0/0",

"::/0"

]

}

"publicNetworkSource": {

"allowedIpCidrRanges": [

"additional white list ip",

"additional white list ip"

]

"allowCrossOrgVpcs": true,

"allowAllServiceAgentAccess": false

}

Change Storage Location

If you want to change to use your own storage location, contact AvePoint to update your subscription and then complete the following steps. Otherwise, Cloud Backup will continue to store data in the AvePoint-hosted default storage.

On the Storage page, the Change to my own storage link is available. Click Change to my own storage. A pop-up window appears.
In the pop-up window, you must choose how to handle the existing backup data stored in the default storage location.
- Retain all backup data currently stored in AvePoint’s storage for 90 days – The backup data in the default storage location will be retained for 90 days after the storage change. You will get an email notification 7 days before the data deletion. For data migration, contact AvePoint support. The next backup job for each of the enabled backup types will store the backup data in the configured custom storage location.
- Remove all backupdata from AvePoint’s storage – The backup data will be removed from the default storage location, and you cannot use the previous backup data for restore. After the storage location is changed, the backup jobs for the enabled backup types will start in a few seconds, and the new backup schedule of an object type will start once the corresponding backup job starts. The backup data will be stored in the configured custom storage location.
Click OK to save the settings and configure the custom storage location.

Note the following:
- If you are using your own storage and would like to configure separate storage locations for each service type, contact the AvePoint support team. The Storage page will display the configurations, as the screenshot below shows. You can configure a storage for each enabled backup service.
- If you are using the Microsoft Azure Blob storage and facing the upper limit of your storage account, you can append an additional storage account of Microsoft Azure Blob Storage for backup and restore. If you have already appended the storage, you can view the storage information on the Storage page.
  
  *Note: We recommend that you contact Microsoft Azure support first to request an increase in the maximum capacity of the storage account that you are currently using.
  
  To append an additional storage location, you need another Azure storage account. Currently, you can only append one additional storage account, and this is only available for BYOS customers on Azure. Once you save the new storage location, the new storage will be used to store backup data for further incremental backup jobs and restore jobs. Cloud Backup services will no longer write to the legacy storage location. For details on storage configuration, refer to the Microsoft Azure Blob Storage section in Storage Information.
Configure the storage information. For details on configuring storage information, refer to Storage Information. Click Validation Test to test whether the entered information is valid. If successful, click Apply to save and apply your own storage.

*Note: The changes from the default storage to a custom storage cannot be reverted, and the custom storage cannot be changed to another custom storage once saved.

Either using the AvePoint default storage or your own storage, the data retention settings can be applied to your backup data to help save your storage costs. Once there is backup data approaching the retention period, your administrator group or your service provider’s administrator group will receive the Data Retention Notification. Once the next full snapshot of your Microsoft 365 scope takes place, we will begin pruning the old backup data that met your retention settings.

- If you want to keep your data in default storage, you can contact your AvePoint Account Manager to update your subscription and increase your retention settings, but please note that increasing your data retention may increase the price you pay for your backup. If you want to archive the backup data that met the retention settings for potential restore in the future, instead of letting them be deleted from AvePoint storage, you can submit an export request to export the data from the default storage as a paid service. For details, refer to [Introduction to Data Export Service](#missing-link).

- If your subscription is the BYOS type, you can update your retention settings by navigating to **General Settings** > **Retention Policy**. Increasing your data retention may increase the price you pay for your backup.

Storage Information

Refer to the sections below for the storage configuration details of the supported storage types.

Amazon S3

AvePoint will, by default, use HTTPS (SSL) communication to access your Amazon S3 storage and store your backup data to the S3 Glacier Instant Retrieval automatically. Your existing backup data before the February 2025 release will remain in the S3 Standard storage class. You can move the backup data from S3 Standard/S3 Glacier Instant Retrieval to S3 Standard-IA, S3 One Zone-IA, or S3 Intelligent-Tiering, and Cloud Backup for Microsoft 365 can restore the backup data of those storage classes. However, it is not recommended to activate the archive access tier if you are using S3 Intelligent-Tiering. Activating the archive access tier will cause data object files that have not yet been accessed for 90 days to be archived, and Cloud Backup cannot access the archived data in your Amazon S3 storage.