Does Microsoft 365 provide backup protection for organisations?

Posted on February 12, 2024 by Louise Howland

Prior to the cloud, organisations have always been diligent about ensuring their servers had a sufficient backup routine to protect their data. As more and more organisations look to Microsoft 365 and SharePoint for document and email storage, there is a perception that if your data is in the cloud, it is safe. Whilst it’s certainly true that the cloud offers many benefits, including the availability of data, it is not a foolproof solution.

Many organisations are concerned that all data now resides with just one provider, and in IT terms, we never like single points of failure! And with encryption viruses in the news on a weekly basis, many organisations are rightly concerned that an infection could quickly spread and encrypt all data, including that which resides in cloud storage.

What many Microsoft 365 users don’t realise, is that although Microsoft hosts the solution and takes care of the infrastructure, the responsibility of maintaining and protecting a copy of the data is with you. Microsoft state in their Terms and Conditions “We strongly advise you to make regular back-up copies of Your Content. Microsoft can’t be held responsible for Your Content or the material others upload, store or share using our Services.”

In the traditional server set-up, we had an ‘air gap’ between two sets of data – I.e. the live data on the server, and the backed-up data on a tape, storage device or other media source. When you rely solely on the inbuilt features of Microsoft 365, that ‘air gap’ is lost. This is why we always recommend adding a third-party back up solution to overlay the Microsoft 365 tenant.

Data loss and the cloud

First, let’s start with some facts about data loss in the cloud.

• 64% of data loss is accidental: On its own, Microsoft 365 has limited retention policies. So, if an end-user accidentally deletes an email, a OneDrive for Business folder, or even an entire SharePoint site, and the retention period expires before that deletion is noticed, the data is unrecoverable.
• 20% of data loss is due to malicious intent, including hackers: More and more customers are realising this with incidents like ransomware getting attention in the media. But there are internal threats as well. For example, a SharePoint admin can permanently delete SharePoint content, making it immediately unrecoverable.
• Data recovery can be expensive, one university study found that the average cost of a data loss event without a backup solution in place is almost £4K.
• Restoring deleted items from Microsoft 365 can be very time-consuming, taking hours or even days depending on how much data needs to be restored.

What protection does Microsoft 365 itself provide?

Microsoft 365 replicates data to multiple servers, to protect against hardware failures and catastrophic incidents. However, that is not the same as backing up the data. Replication ensures that your data is always available in whatever state it is in. In other words, if a file is deleted or corrupted, that deletion or corruption is replicated throughout the cloud, and there is no way to quickly and easily get that data back where it was.

It is true that Microsoft 365 has some retention policies, including the ability to restore previous versions of documents, but those expire, and it is possible to permanently delete data before the retention period expires. As standard, the Microsoft 365 email retention policy is if you delete an email from your deleted items you have 14 days to rescue it. After that, it’s gone. 14 days is the default although this can be extended to 30 days.

With SharePoint you get 93 days retention from the point a file is deleted, after this time it is not recoverable. Remember (as above) Microsoft state in their Terms and Conditions “We strongly advise you to make regular back-up copies of Your Content. Microsoft can’t be held responsible for Your Content or the material others upload, store or share using our Services.”

Why should you use a third-party solution?

As we increasingly store more and more information in Microsoft 365, including the component applications such as Exchange, SharePoint, Teams & OneDrive, it is vital that organisations consider whether the inbuilt retention policy in Microsoft 365 is enough. There are many advantages to having a backup solution, including:

• Avoiding the risk of having the only copy of your data all with one provider
• The ability to retain data for long periods of time, regardless of whether a user deletes files or leaves the organisation
• Ability to have an ‘air gap’ between your live data and your backup – meaning that if your live data is maliciously encrypted, the virus doesn’t spread to the backed-up data
• Ability to go back to a defined ‘point in time’ version of data if needed for audit purposes
• Ability to quickly restore files and folders across all the 365 platform applications
• A quick search facility with one-click restores, enabling end-users to restore their own data quickly and efficiently.

Microsoft 365 backup from ramsac

ramsac’s Microsoft 365 Backup is a premium data protection service for Microsoft 365. It provides comprehensive backup coverage including the complete set of Microsoft 365 productivity data that organisations rely on to collaborate, communicate and operate efficiently, from Exchange Online information (mail, calendars, contacts, notes, etc.) to SharePoint libraries and data, OneDrive files and folders, and data stored and used by Microsoft 365 Groups and Microsoft Teams. It is simple to roll out and covers the entire organisation for a simple cost per user, per month fee, which can be added to your existing monthly Microsoft fee.