Backup, restore & moving an instance¶

Applies to: Both (Self-Hosted & SaaS) · Who: administrators

Settings → Sicherung (Backup) exports everything that is set up in this instance into one encrypted file and imports such a file again. Use it to:

keep a backup of your configuration and data before a larger change,
restore an instance after a mistake,
move an instance from Self-Hosted to SaaS or back, or to a new server.

An import replaces the configuration and data of the target instance completely. You can undo it for 7 days.

What the file contains¶

Included	Not included
All settings, templates, mail texts, naming rules, policies, roles, custom and extended fields	The license key and the installation ID: they stay with each instance
The uploaded Exchange certificate (re-encrypted with the target's own key on import)
Console accounts with their passwords, two-factor setup and passkeys	The cached directory (users, groups, licenses from Microsoft): the next sync rebuilds it
With Include data: audit log, workflows, HR records and HR files, PAM accounts and history	Sign-in sessions, one-time links, running jobs and logs
With Include secrets: client secret, webhook and agent tokens, SMTP password, AI keys, HR system credentials	The Microsoft admin consent of a SaaS instance and the update settings

Configuration only (switch Include data off) exports settings and accounts but no history. On import, the data of the target instance is then kept.

Without secrets leaves every password and token empty in the file. The target asks you to enter them again after the import. Choose this when the file leaves your organisation.

The file and its password¶

The file ends in .scaliobak and is protected by a password you choose (at least 12 characters).
Nobody can open the file without this password, not even Scalio. Keep the password in a password manager. A lost password cannot be recovered.
The file uses the open age format, so you can decrypt it yourself with age --decrypt -o backup.tar backup.scaliobak and read its contents (a tar archive with JSON lines).

Export¶

Open Settings → Sicherung.
Choose whether to include data and secrets.
Enter the file password twice and confirm that you will keep it safe.
Confirm your identity:
local accounts enter their current password, and their authenticator code if two-factor sign-in is on;
Microsoft accounts must have signed in within the last 15 minutes; otherwise sign out and in again.
Click Export erstellen. The file is built in the background.
Click Herunterladen as soon as it is ready.

The file can be downloaded once. Afterwards, and at the latest after one hour, it is deleted from the server. The export and the download are written to the audit log.

The export also works while the instance is read-only (for example with an expired license), but not during a maintenance lockdown.

Import¶

Open Settings → Sicherung on the target instance and click Sicherungsdatei wählen. Files up to 2 GB are uploaded in parts. If your reverse proxy only accepts small requests, the browser switches to smaller parts by itself.
Enter the file password and click Datei prüfen. The server decrypts the file and checks every part against its checksum. Nothing has changed yet.
Read the preview: where the file comes from, when and by whom it was created, its version and content, and whether your own account is in it. Warnings appear when:
the file comes from another Entra tenant (you must tick an extra confirmation; PAM accounts that point to users of the other tenant are counted),
it comes from a SaaS instance and this one is Self-Hosted, or the other way round,
it comes from another address (the agent and passkeys need the new address),
it has more administrators than the license of this instance allows,
it was exported without secrets, or with configuration only.
Type the name of this instance (its address, shown above the field) and confirm your identity as for the export.
Click Importieren und überschreiben.

During the import the instance is in maintenance for a few minutes: every page and the on-prem agent get "423 Locked", the background jobs stop. If anything goes wrong, the instance goes back to its previous state by itself.

Rules¶

The target must run the same or a newer version of Scalio Nexus than the source. Update the target first if needed. After the import, database migrations bring the data up to the target's version.
Your account is kept. If the file has no account with your email address, your current account is added, so you can always sign in after the import. If the file has one, you sign in with the credentials from the file.
Every session ends, including yours. Sign in again after the import.
Hidden system accounts (super-admin, self-check) always come from the target's environment, never from the file.

After the import¶

A checklist appears when the import is finished. Depending on the warnings it reminds you to:

sign in again;
check the license under Settings → Lizenz (it stays with the instance);
wait for the directory sync: the cached users and groups are rebuilt in the background (for another tenant they are emptied first);
check the Microsoft connection (admin consent on SaaS, app registration and certificate on Self-Hosted) when the tenant or the mode changed, see Microsoft connection;
enter the secrets again if the file was exported without them;
connect the on-prem agent to the new address, and register passkeys again (they are bound to the address of the instance).

Undo an import¶

For 7 days after an import, Settings → Sicherung shows Import rückgängig machen. It restores the state from before the import (again in a short maintenance, with re-authentication) and ends every session. After 7 days the copy of the old state is deleted.

If the server stops during an import (crash, restart), the next start finishes the cleanup: an import that had not yet replaced anything is discarded, one that was half way is rolled back.

Moving between Self-Hosted and SaaS¶

Update both instances to the same version (or the target to a newer one).
Export on the source with data and secrets.
On the target, set up the Microsoft connection for the same tenant first (SaaS: admin consent; Self- Hosted: app registration), then import the file.
Work through the checklist. Point the on-prem agent to the new address.
Keep the source instance read-only until you are sure, then remove it.

Limits¶

Files up to 2 GB.
One import, rollback or export at a time.
Demo instances cannot export or import.