Policy Settings

What policies do

A policy is a reusable set of rules you assign to users. Instead of configuring every client device by hand, you define the standard once (which backups run, which storage vaults are allowed, retention, exclusions, and what end users are permitted to change) and apply it across your account. For an MSP, this is how you keep every client on a consistent, enforced standard and stop end users from disabling protection.

You can assign one policy to many users, and any change to a policy applies immediately to everyone on it.

Where to find policies

In the Magnus Box web portal, open User policies in the left sidebar (under Management Console). Click Add Policy and the policy editor opens. To edit an existing policy, select it from the list.

The editor is organized into tabs down the left side: Summary, Storage Vaults, Protected Items, Default settings, Exclusions, Default reports, Schedule, and Retention. The sections below follow those tabs in order. The Summary tab shows a read-only overview of everything the policy enforces.

Storage Vaults

These settings restrict both end users and admins from acting on Storage Vaults.

Prevent creating new Storage Vaults, with separate options for via Storage template and via Custom.
Prevent editing existing Storage Vaults and Prevent deleting Storage Vaults.
Hide cloud storage branding in Storage Vaults, so the underlying provider is not shown to end users.
Rotate Storage Vault access keys after no update from conflicting job, with a configurable window (the system default is 48 hours). This helps recover a vault that was left locked by an interrupted job.
Restrict available Storage Vault types, then tick only the destinations you want users to be able to add. The list includes S3-compatible / Amazon S3 / Google Cloud Storage / Wasabi, SFTP, SMB, Local Path, Comet Server (your Magnus Box cloud storage), FTP, Azure Blob Storage, Spanned, OpenStack Swift, Backblaze B2 Cloud Storage, Storj DCS, and WebDAV.
Automatically create Storage Vault for new devices, driven by a Storage Template (set to User controlled by default), so protection can start without manual vault setup.

Note: in the vault type list, your Magnus Box cloud storage appears as Comet Server. Select that option when you want backups to land on Magnus Box storage.

Storage Vaults tab of the policy editor with the restricted vault-type list expanded, showing Comet Server among the destinations — The Storage Vaults tab. With *Restrict available Storage Vault types* ticked, enable only the destinations users may add. Your Magnus Box cloud storage is the **Comet Server** entry.

Protected Items

A Protected Item is a defined backup source (Files & Folders, Disk Image, Microsoft 365, a database, and so on). These settings restrict end users' actions.

Prevent creating new Protected Items, Prevent editing Protected Items, and Prevent deleting Protected Items.
Default Protected Item: push a preset backup to devices automatically. Each entry has a Type, an Enforced flag, and an Apply-to target.
Restrict available Protected Item types: limit which backup types users can create, so client devices only run the sources you support.

Default settings

'Skip if already running' setting on backup schedules: if a scheduled backup starts while the previous run is still going, skip the new run.
'If the last job encountered an error retry' setting on backup schedules: automatically retry a schedule after a failed run.
'Allow administrator to reset password' setting on user accounts.
'Allow administrator to view file names remotely' setting on devices.
'Require user to change password at next login' setting on user accounts.
Random job delay: stagger scheduled backups by a random delay (in minutes) so many devices do not all start at once.

Exclusions

On the Exclusions tab you can set automatic File and folder exclusions that apply to every Files & Folders backup run under this policy, handy for excluding files that cause errors or disruptions. Each entry has an Exclude pattern, a Type, and an Apply-to target. See Magnus Box Exclusion List for the recommended set.

Default reports

Turn on Custom Reports to set default backup report recipients and delivery rules for everyone on the policy, so job outcomes are emailed automatically without configuring each user individually.

Schedule

Default backup schedules defined here are applied to all new Protected Items on the policy. They are not applied retroactively to existing Protected Items. Each schedule entry pairs a Default Schedule with the Storage Vault it should target, which is how you point a schedule at a specific vault when a client backs up to more than one.

Retention and immutability

Retention controls how long backup data is kept. Applied at the policy level it overrides per-item retention, and it is one of your strongest ransomware safeguards.

Default retention policy: for example, Keep all backups forever.
Enforce this retention policy for all Storage Vaults.
Prevent Protected Items from overriding the Storage Vault retention policy. As the console itself notes, this is useful for ransomware protection: a bad actor with user credentials could otherwise set a Protected Item's retention to keep nothing and let historical backups be deleted.
Allow users to set the Object Lock duration: where the storage supports Object Lock, backups can be made immutable for a defined period so they cannot be altered or deleted until the lock expires.

Retention tab showing enforce retention, prevent override, and Object Lock duration options — The Retention tab. Enforce a retention range across every vault, block per-item overrides, and optionally allow an Object Lock duration for immutable backups. The console flags the override-prevention option as a ransomware safeguard.

Tips for MSPs

Build a baseline "managed client" policy, set it as your default, and lock the settings end users shouldn't touch (vault actions, retention, protected items).
Use Enforce retention plus Prevent Protected Items from overriding retention plus Object Lock together as your ransomware-resilience standard.
Turn on Random job delay once you're managing more than a few dozen devices to avoid backup congestion.