Configure backups with policy

Outpost Backup is configured entirely through profiles. This page shows which backup.* settings to set for a typical rollout: turn backup on, choose what is backed up, add a system image and a second copy, and set how long snapshots are kept. When you finish, the endpoints in scope back up on their own and report to the Backup page.

Before you begin

• You need the profile:manage permission.
• Add a storage destination and make it the default, or decide which destination the backups use. Home Lab needs your own S3-compatible storage. Essentials, Enterprise, and MSP can use Outpost Cloud Storage.
• On the MSP plan, open the client’s workspace first. Profiles belong to one client.
• Decide who holds the keys before the first backup runs. See Backup encryption keys and recovery kits.

Backup settings apply to endpoints only. Assign the profile to Whole client, Site, Device group, or Endpoint. A backup setting on a profile assigned to a User group or Person has no effect.

Create a backup profile

1. Go to Profiles > All profiles and select New profile.
2. In Name, enter a name, such as Backup: workstations.
3. Select Create profile. The profile opens on its Settings tab.

For each setting below, find it on the Settings tab, select Set in this profile, enter the value, and select Save on the setting. See Create and assign a profile for the editor in detail.

Turn backup on and choose what is backed up

1. Set backup.enabled to on.
2. To back up each user’s Downloads folder too, set backup.include_downloads to on.
3. To back up more than the standard folders, add paths or glob patterns to backup.include_paths, such as D:\Projects or /srv/data.
4. To leave paths out, add them to backup.exclude_paths, such as **/node_modules/**.

** matches any number of folders. A pattern that does not start with / or ** matches from the start of the path. Matching ignores case on Windows and macOS. Include and exclude lists from profiles at the same rank are combined. A higher rank replaces the list of a lower one.

Set the file backup schedule

Set backup.primary_interval_minutes to how often the file backup runs. The default is 240, every 4 hours. If several profiles at the same rank set it, the most frequent schedule applies. A higher rank replaces a lower one.

By default, a backup does not run on a metered connection or on battery, and waits instead. To change that, set backup.allow_metered or backup.allow_on_battery to on. If any profile at the same rank leaves either one off, it stays off.

To cap the upload rate, set backup.upload_limit_kbps in kilobits per second.

Add a system image

1. Set backup.system_image to on.
2. Optionally, set backup.image_schedule to a five-field cron expression in the endpoint’s local time. The default, 0 2 * * 0, runs on Sundays at 02:00. Every image reads all used space, so weekly suits most computers.

The image goes to the primary destination only. What it holds depends on the operating system. See Outpost Backup.

Choose the destination

Leave backup.primary_storage_profile_id empty to use the client’s default destination. That is the usual choice.

To send this profile’s endpoints somewhere else, set backup.primary_storage_profile_id to the destination’s id. The setting takes the id, not the name, and Settings > Storage does not show ids. Read the publicId of each destination from GET /api/v1/storage/profiles, which needs storage:manage. See the API.

A Windows network share destination applies to Windows endpoints only. Linux and macOS endpoints in the same scope use the next destination: the client’s default, then the MSP’s default, then the Outpost server’s own disk. Outpost Cloud Storage is the MSP’s default unless you set another, except on Home Lab.

Add a secondary copy (3-2-1)

A secondary copy is an independent repository at another destination, with its own key, schedule, and retention. It holds files only, not system images.

1. Set backup.secondary_storage_profile_id to the id of a second destination. It has no default: while it is empty, there is no secondary copy.
2. Optionally, set backup.secondary_interval_minutes. The default is 1440, once a day.

Set retention

Retention decides which snapshots each repository keeps, grandfather-father-son style. The editor shows six fields for each retention setting: Most recent, Hourly, Daily, Weekly, Monthly, and Yearly. Each is how many snapshots of that period to keep, and 0 keeps none for that period.

Setting	Applies to	Default
backup.primary_retention	Primary file snapshots	6 most recent, 14 daily, 8 weekly, 12 monthly
backup.secondary_retention	Secondary file snapshots	3 most recent, 7 daily, 4 weekly, 6 monthly
backup.image_retention	System images	4 weekly, 3 monthly

Retention values are never combined. The profile that wins by rank sets the whole schedule, and two different schedules at the same rank are reported as a conflict, so give them different ranks.

Assign the profile and make it active

1. Open the Assignments tab and select Assign this profile.
2. In Applies to, choose Whole client, Site, Device group, or Endpoint, and choose the target.
3. Select Assign.
4. Open the Overview tab, set Status to active, and select Save changes.

Connected endpoints receive the policy at once. Offline endpoints receive it when they reconnect.

Verify

1. Open an endpoint in scope and select its Backups tab.
2. Under Outpost Backup, State shows On, with Turned on by the backup settings in a profile. Next backup, Schedule, and Keeps show the values you set.
3. Select Back up files now. The console shows Backup requested. It starts when the endpoint is online.
4. The run appears under Runs with Result Succeeded, and a snapshot appears under Snapshot timeline.

If something goes wrong

Symptom	Cause	Fix
Back up files now is unavailable with Outpost Backup is off for this endpoint. Turn it on in a profile first.	No active profile that reaches the endpoint sets backup.enabled.	Check the assignment scope and the profile’s status. See Check an endpoint’s effective configuration.
A run shows Skipped with on a metered connection or on battery power	backup.allow_metered or backup.allow_on_battery is off.	Wait for the endpoint to be on an unmetered network or mains power, or allow it in policy.
A run shows Skipped with waiting for Depot to hold the key	The endpoint has created its repository and has not yet handed its key to Outpost.	Wait for the endpoint’s next connection. The first snapshot runs after the key is held.
Linux or macOS endpoints back up to a different destination	The named destination is a Windows network share.	Expected. Name an S3-compatible bucket if those endpoints must use the same place.

Next steps

• Backup encryption keys and recovery kits
• Monitor backup coverage
• Backup policy settings