Office 365 Backup - Sharepoint - An existing connection was forcibly closed by the remote host

This warning usually happens when SharePoint Online throttles or resets the connection during item version download. Since the failing item changes every run, it’s very likely not a corrupted file but intermittent throttling from Microsoft 365.

Things to check: Make sure the organization is added using Modern App-Only authentication. Legacy/basic auth gets throttled heavily. In General Options > Network, ensure Veeam is not self-throttling. Increase concurrent tasks in the repository (8–12 if possible). Make sure no antivirus or HTTPS inspection is slowing down proxy traffic. 

Check these logs on the VB365 server: C:\ProgramData\Veeam\Backup365\Logs\ - If possible, share with us.

Hi,

Firstly you have way too many backup applications. 3x app registrations running in parallel is enough to throttle the whole tenant. Reduce this to 1 and scale if you need to. This type of error is normally firewall related when a session is being closed in the network path but the endpoints didn’t agree to close it. What firewall are you using?

​@matheusgiovanini 

1. We are only using Morden Auth
2. There is no Network tab in General Options
3. There is not a setting to increase concurrent tasks in the repository, only to throttle the bandwidth which is unticked
4. AV (Sophos Endpoint) gets disabled when testing but doesn't change performance if its turned on

​@MicoolPaul 

We started with 1, transfer rate was abysmal, increased to 5 was acceptable but still took ages, changed to 20 and the daily overnight backup would finish overnight. We have just changed down to 3 and trying again now to see if anything has changed.

We are using Sophos XGS but no HTTPS inspection is set for the backup server, it can downloaded at its full 1GBps. At the start of the backup the firewall processes the traffic as we can see it spike to the endpoint. Then after a few minutes drops off. Which makes me think it is M365 throttling it.

Hi,

I used to work with Sophos XG firewalls and had similar problems with VoIP. Check your timeout streams in CLI for TCP sessions. If we’re being throttled it can be that Sophos sees no traffic and closes the session even though we’re actually pausing deliberately as part of the negotiation with Microsoft’s Graph API. Whilst we’ll attempt to renegotiate it could be this keeps happening across our threads until it fails.

The Tcp Connection Establishment Idle Timeout is currently 10800 seconds which is the default. The VOIP is to do with the UDP and it is set to 150ms for us as have seen that before.

Hi sorry to clarify I was saying that I had seen this when I was working with VOIP specifically on Sophos XG.

I also saw this with Sophos XG when running Veeam Cloud Connect services too from a TCP connection state.

I’d explore a PCAP potentially here to filter for connection resets as it matches your symptoms

Ok, we are looking into that but looking at the Veeam logs for last nights backup there are a few interesting lines:

[06.02.2026 08:34:12.317]         268 (1)       [Info] Server error of type Microsoft.SharePoint.SPQueryThrottledException occurred: (ServerErrorCode: -2147024860, ServerErrorValue:<null>, trace correlation ID: 3344f4a1-2048-f000-6d2c-b31040704c0c) The attempted operation is prohibited because it exceeds the list view threshold.

[06.02.2026 08:34:12.332]         268 (1)      [Error] Error: Failed to load items using a server-side CAML query.

[06.02.2026 08:34:12.332]         268 (1)      [Error] Type: Veeam.Archiver.Source.SharePoint.Changes.ListItemChildrenQueryThrottledException