---
title: "Configure backups with policy"
description: "Turn on Outpost Backup with a profile, and choose what is backed up, where it goes, how often it runs, and how long snapshots are kept."
url: "https://support.outpostplatform.com/backup/configure-backup/"
product: "depot"
type: "how-to"
status: "draft"
ai_summary: "Steps to turn on Outpost Backup with backup.* settings in a profile assigned to the whole client, a site, a device group, or an endpoint. Covers paths, the file interval, system images and their cron schedule, a secondary 3-2-1 destination, GFS retention, and checks on the endpoint's Backups tab. Needs profile:manage."
availability:
  plans: ["home-lab", "essentials", "enterprise", "msp"]
  platforms: ["windows", "linux", "macos"]
  permission: "profile:manage"
  preview: false
source: "https://gitlab.com/outpostplatform/docs/-/edit/main/src/content/docs/backup/configure-backup.md"
license: "CC BY 4.0"
---

# Configure backups with policy

Outpost Backup is configured entirely through
[profiles](/automation/profiles/). This page shows which `backup.*` settings
to set for a typical rollout: turn backup on, choose what is backed up, add a
system image and a second copy, and set how long snapshots are kept. When you
finish, the endpoints in scope back up on their own and report to the
**Backup** page.

## Before you begin

- You need the `profile:manage` permission.
- Add a [storage destination](/depot/storage/) and make it the default, or
  decide which destination the backups use. Home Lab needs your own
  S3-compatible storage. Essentials, Enterprise, and MSP can use Outpost Cloud
  Storage.
- On the MSP plan, open the client's workspace first. Profiles belong to one
  client.
- Decide who holds the keys before the first backup runs. See
  [Backup encryption keys and recovery kits](/backup/encryption-keys/).

Backup settings apply to endpoints only. Assign the profile to **Whole
client**, **Site**, **Device group**, or **Endpoint**. A backup setting on a
profile assigned to a **User group** or **Person** has no effect.

## Create a backup profile

1. Go to **Profiles** > **All profiles** and select **New profile**.
2. In **Name**, enter a name, such as `Backup: workstations`.
3. Select **Create profile**. The profile opens on its **Settings** tab.

For each setting below, find it on the **Settings** tab, select **Set in this
profile**, enter the value, and select **Save** on the setting. See
[Create and assign a profile](/automation/create-a-profile/) for the editor in
detail.

## Turn backup on and choose what is backed up

1. Set `backup.enabled` to on.
2. To back up each user's Downloads folder too, set
   `backup.include_downloads` to on.
3. To back up more than the standard folders, add paths or glob patterns to
   `backup.include_paths`, such as `D:\Projects` or `/srv/data`.
4. To leave paths out, add them to `backup.exclude_paths`, such as
   `**/node_modules/**`.

`**` matches any number of folders. A pattern that does not start with `/` or
`**` matches from the start of the path. Matching ignores case on Windows and
macOS. Include and exclude lists from profiles at the same rank are combined.
A higher rank replaces the list of a lower one.

## Set the file backup schedule

Set `backup.primary_interval_minutes` to how often the file backup runs. The
default is `240`, every 4 hours. If several profiles at the same rank set it,
the most frequent schedule applies. A higher rank replaces a lower one.

By default, a backup does not run on a metered connection or on battery, and
waits instead. To change that, set `backup.allow_metered` or
`backup.allow_on_battery` to on. If any profile at the same rank leaves either
one off, it stays off.

To cap the upload rate, set `backup.upload_limit_kbps` in kilobits per second.

## Add a system image

1. Set `backup.system_image` to on.
2. Optionally, set `backup.image_schedule` to a five-field cron expression in
   the endpoint's local time. The default, `0 2 * * 0`, runs on Sundays at
   02:00. Every image reads all used space, so weekly suits most computers.

The image goes to the primary destination only. What it holds depends on the
operating system. See [Outpost Backup](/backup/#system-images).

## Choose the destination

Leave `backup.primary_storage_profile_id` empty to use the client's default
destination. That is the usual choice.

To send this profile's endpoints somewhere else, set
`backup.primary_storage_profile_id` to the destination's id. The setting takes
the id, not the name, and **Settings** > **Storage** does not show ids. Read
the `publicId` of each destination from `GET /api/v1/storage/profiles`, which
needs `storage:manage`. See the [API](/api/).

A Windows network share destination applies to Windows endpoints only. Linux
and macOS endpoints in the same scope use the next destination: the client's
default, then the MSP's default, then the Outpost server's own disk. Outpost
Cloud Storage is the MSP's default unless you set another, except on Home Lab.

## Add a secondary copy (3-2-1)

A secondary copy is an independent repository at another destination, with
its own key, schedule, and retention. It holds files only, not system images.

1. Set `backup.secondary_storage_profile_id` to the id of a second
   destination. It has no default: while it is empty, there is no secondary
   copy.
2. Optionally, set `backup.secondary_interval_minutes`. The default is `1440`,
   once a day.

## Set retention

Retention decides which snapshots each repository keeps, grandfather-father-son
style. The editor shows six fields for each retention setting: **Most
recent**, **Hourly**, **Daily**, **Weekly**, **Monthly**, and **Yearly**. Each
is how many snapshots of that period to keep, and `0` keeps none for that
period.

| Setting | Applies to | Default |
| --- | --- | --- |
| `backup.primary_retention` | Primary file snapshots | 6 most recent, 14 daily, 8 weekly, 12 monthly |
| `backup.secondary_retention` | Secondary file snapshots | 3 most recent, 7 daily, 4 weekly, 6 monthly |
| `backup.image_retention` | System images | 4 weekly, 3 monthly |

Retention values are never combined. The profile that wins by rank sets the
whole schedule, and two different schedules at the same rank are reported as a
conflict, so give them different ranks.

## Assign the profile and make it active

1. Open the **Assignments** tab and select **Assign this profile**.
2. In **Applies to**, choose **Whole client**, **Site**, **Device group**, or
   **Endpoint**, and choose the target.
3. Select **Assign**.
4. Open the **Overview** tab, set **Status** to `active`, and select **Save
   changes**.

Connected endpoints receive the policy at once. Offline endpoints receive it
when they reconnect.

## Verify

1. Open an endpoint in scope and select its **Backups** tab.
2. Under **Outpost Backup**, **State** shows **On**, with **Turned on by the
   backup settings in a profile.** **Next backup**, **Schedule**, and **Keeps**
   show the values you set.
3. Select **Back up files now**. The console shows **Backup requested. It
   starts when the endpoint is online.**
4. The run appears under **Runs** with **Result** **Succeeded**, and a
   snapshot appears under **Snapshot timeline**.

## If something goes wrong

| Symptom | Cause | Fix |
| --- | --- | --- |
| **Back up files now** is unavailable with **Outpost Backup is off for this endpoint. Turn it on in a profile first.** | No active profile that reaches the endpoint sets `backup.enabled`. | Check the assignment scope and the profile's status. See [Check an endpoint's effective configuration](/automation/effective-configuration/). |
| A run shows **Skipped** with **on a metered connection** or **on battery power** | `backup.allow_metered` or `backup.allow_on_battery` is off. | Wait for the endpoint to be on an unmetered network or mains power, or allow it in policy. |
| A run shows **Skipped** with **waiting for Depot to hold the key** | The endpoint has created its repository and has not yet handed its key to Outpost. | Wait for the endpoint's next connection. The first snapshot runs after the key is held. |
| Linux or macOS endpoints back up to a different destination | The named destination is a Windows network share. | Expected. Name an S3-compatible bucket if those endpoints must use the same place. |

## Next steps

- [Backup encryption keys and recovery kits](/backup/encryption-keys/)
- [Monitor backup coverage](/backup/coverage/)
- [Backup policy settings](/backup/policy-settings/)