“Unauthorized” error is thrown by SharePoint Online and/or OneDrive for business backup jobs

Challenge

Backup jobs for SharePoint Online and/or OneDrive items fail with any of the following errors:

07-08-2018 11:11:39 3 (6640) Error: The request failed with HTTP status 401: Unauthorized. 
07-08-2018 11:11:39 3 (6640) Type: System.Net.WebException 
07-08-2018 11:11:39 3 (6640) Stack: 
07-08-2018 11:11:39 3 (6640) at System.Web.Services.Protocols.SoapHttpClientProtocol.ReadResponse(SoapClientMessage message, WebResponse response, Stream responseStream, Boolean asyncCall)

Or

Error: Cannot contact web site 'https://example.sharepoint.com/' or the web site does not support SharePoint Online credentials. The response status code is 'Unauthorized'. The response headers are 'X-SharePointHealthScore=1, X-MSDAVEXT_Error=917656; Access+denied.+Before+opening+files+in+this+location%2c+you+must+first+browse+to+the+web+site+and+select+the+option+to+login+automatically."

Cause

Legacy authentication protocols are disabled within Organization’s settings. As a result, applications using the SharePointOnlineCredentials class to authenticate the SharePoint Online resources are denied to access. Veeam Backup for Microsoft Office 365 uses the above-mentioned class to connect to SharePoint Online.

Solution

To resolve the issue, legacy protocols must be allowed. There are 2 ways to enable legacy protocols:

1. In SharePoint Online admin center under “Access control” -> “Apps that don’t use modern authentication”, choose “Allow”
2. Use Set-SPOTenant cmdlet as in this Microsoft article.