Does Microsoft 365 Back Up My Data?

Does Microsoft back up your Microsoft 365 data?

Well, it’s a bit of both. While Microsoft does offer some retention and recovery capabilities that are worth using, they don’t provide comprehensive backup and recovery services. They clearly state in their documentation that maintaining data integrity and retention is your responsibility.

The effectiveness of Microsoft’s native tools for safeguarding your companies critical documents, emails, and team chats depends on your specific needs and the scale of your operations. To determine if they suffice, it’s up to you.

To assist in your decision-making process, let’s explore Microsoft’s data retention features, their limitations, and why considering a third-party backup and recovery solution might be advisable.

"We strive to keep the Services up and running; however, all online services suffer occasional disruptions and outages, and Microsoft is not liable for any disruption or loss you may suffer as a result. In the event of an outage, you may not be able to retrieve Your Content or Data that you’ve stored. We recommend that you regularly backup Your Content and Data that you store on the Services or store using Third-Party Apps and Services."

Microsoft

The good, bad, and the not so pretty

As you’ll discover, although these features don’t serve as a complete replacement for comprehensive backups, when utilised and set up correctly, they can serve as an effective initial layer of defence in safeguarding your data.

Data replication

Microsoft employs data mirroring across a minimum of two distinct data centers within the same region, ensuring a level of protection against localised natural disasters or service interruptions.

Nevertheless, human error remains the foremost cause of data loss. A recent study revealed that a higher percentage of companies (50%) suffered data loss due to accidental deletions and other human mistakes compared to any other reasons. Tragically, these deletions propagate throughout every data repository, amplifying the risk of substantial data loss.

Microsoft’s data retention policies

Microsoft employs a two-stage recycle bin, allowing users to recover deleted files within a “practical” timeframe. Files stored in OneDrive or SharePoint can be restored within 93 days post-deletion, while email mailboxes have a default retrieval period of up to 30 days, with individual emails retrievable within 14 days by default.

The flexibility of configuring your own data retention policies is available through Microsoft’s Security & Compliance Centre. You have the option to retain data indefinitely, ensuring the retrieval of deleted data even long after removal by any user.

However, the challenge lies not so much in saving but in the retrieval process. Unlike the streamlined management consoles found in leading third-party backup solutions, Microsoft lacks a direct path to locate and restore specific files or folders.

Restoration involves searching for deleted files based on keywords or metadata using Microsoft’s Content Search or eDiscovery tool. Subsequently, the results from the content search need to be exported for restoration. Consider the complexity involved in restoring an entire mailbox or SharePoint folder using this method!

Native Microsoft Backup

Despite common misconceptions, Microsoft does offer a fundamental backup system. The company backs up your Microsoft 365 data every 12 hours and retains it for a 14-day period. In case of emergencies such as a ransomware attack, Microsoft can restore your data.

However, this involves a complete restoration, overwriting everything else in the process. This basic backup method won’t assist in restoring individual files or folders. Additionally, the Recovery Time Objective (RTO) in the event of a successful attack may not meet your expectations.

Why you should consider third-party backup of 365 data

Now equipped with an understanding of Microsoft’s protection levels, let’s delve into specific scenarios where opting for third-party backup for Microsoft 365 would prove a prudent decision tailored to your needs.

Data loss due to user error and accidental deletions

Accidental deletions stand as a primary cause of data loss, though recent data indicates ransomware is gaining ground in this unfortunate category. Discovering loss beyond your retention policy leaves your data irretrievable. Even when caught in time, can you restore files and accounts in the necessary configuration? As mentioned earlier, the restoration process poses challenges.

User errors, like hastily deleting the wrong file or altering permissions, are frequent. System administrators, despite their expertise, can still make critical errors, causing significant organisational headaches. They might unintentionally expose crucial accounts or APIs to the public or inadvertently overwrite extensive sets of vital business data with a single keystroke.

Ransomware and compromised administrator accounts

The majority of data loss, whether accidental or due to malicious actions, stems from human actions rather than infrastructure issues. Phishing attacks, increasingly prevalent and challenging to evade, contribute significantly to this trend. According to a recent ESG survey on Ransomware, a staggering 79% of respondents encountered a ransomware attack within the past year, with 41% confirming these attacks as successful and impactful on their organisations.

A single mistaken click by a user can introduce malware, leading to data corruption. If your Microsoft 365 administrator account gets compromised, your native backups become vulnerable. Recovering from such a nightmare scenario using Microsoft’s inbuilt capabilities can be arduous and time-consuming. While versioning in OneDrive and SharePoint offers some assistance, it consumes storage and might incur additional costs. Moreover, managing a fragmented recovery strategy during a crisis might not be preferable.

Better control of restoring files

While Microsoft 365 allows for restoring entire mailboxes or site collections, performing granular restores isn’t feasible. To minimise Recovery Time Objectives (RTOs) and conserve time and resources, particularly during disaster recovery, having the ability to restore specific files precisely when needed is crucial.

Although Microsoft permits rolling back OneDrive files to a prior state (if not already deleted), it’s an all-encompassing restoration. Instead of selectively reverting specific files or folders, the only available option is a comprehensive rollback of all data to a specific point in time. This destructive restoration, often a last-resort measure, leads to the loss of incalculable data and critical changes. Preventing this scenario is feasible through the granular restore capabilities offered by comprehensive backup solutions.

It’s important to note that Microsoft 365 employs default retention periods, varying across its services. Moreover, actively deleted data by an admin or user becomes irretrievable once it exceeds the recycle bin retention period or if explicitly purged from the bin. Without adaptable and granular control over retention policies, crucial or sensitive data risks slipping through the cracks.

Quick restores

The speed of your recovery from a disaster hinges on managing two critical factors: your Recovery Time Objective (RTO) and your Recovery Point Objective (RPO). Lowering RTO demands precision in targeting what specifically needs recovery, while RPO relies on the frequency of your backups. A robust, purpose-built backup solution is characterised by its flexible recovery options and backup scheduling, vital elements in meeting these objectives effectively.

Legal compliance and retention policy gaps

Businesses face diverse requirements for retaining data, spanning compliance, legal, and operational needs. However, Microsoft’s native data protection might not align with every industry or data type’s demands. While Microsoft defaults to 30 or 90-day retention, industries like healthcare and finance often require data retention for years, if not indefinitely.

Mismanagement of data within your business can lead to policy gaps, stemming from operational disruptions such as failure to back up former employees’ data, inadequate Microsoft 365 backup protocols, and data loss during migrations.

Are you legally obligated to adhere to specific data retention or litigation policies?

Do you need to retrieve particular documents from an extensive archive on demand?

If so, opting for a third-party backup solution for Microsoft 365 that supports long-term retention and swift recall might be beneficial.

Cloud syncing is not the same as backing up your data

OneDrive serves as a file-syncing tool, facilitating file sharing and collaboration, but it doesn’t equate to a backup solution. It’s crucial to recognise that actions impacting a local document are mirrored in the synced OneDrive file. Thus, if a file gets deleted or infected by malware on your local drive, this change will automatically propagate to your synced OneDrive account. Unlike rigid or isolated recovery points, file versions within Microsoft 365 aren’t safeguarded.

When a file is deleted, all its older versions are similarly erased. Permanent deletion leaves no viable recovery points accessible.

Shared Model Makes you responsible for your data

Leveraging native Microsoft data protection tools represents an initial stride in fortifying your business’s security. For example, activating multifactor authentication (MFA) can serve as a barrier against unauthorised access to your systems. Yet, it’s crucial to acknowledge that these tools don’t replace a comprehensive backup and recovery solution. Furthermore, Microsoft explicitly outlines in their Shared Responsibility Model that they solely bear responsibility for their service infrastructure, not for your data. Consider the perspective of the Enterprise Strategy Group on this matter:

"Given Microsoft's responsibility and supporting technology is limited to infrastructure levels, organizations are exposing themselves to risks such as data loss and security breaches, retention and regulatory compliance exposures, and lack of data control in hybrid deployments if they are without third-party backup plans.

In addition, many customers have their data stored in a combination of on-premises and cloud environments, while others have different teams on different versions of Microsoft 365 suites, which can make data protection more challenging in hybrid deployments without a unified backup solution"

The need for backup and protection across all SaaS applications has increasingly worried IT decision-makers. A recent 451 Research report titled “Voice of the Enterprise: Storage, Data Management, and Disaster Recovery 2022” revealed a significant trend. When respondents were asked which SaaS platform they’d consider acquiring a backup service for protection, Microsoft 365 emerged as the top choice, with more than double the number of respondents selecting it compared to the next-ranked platform.

A compelling reason to consider a third-party backup solution surfaces in Microsoft’s own recommendation to do so.

"We strive to keep the Services up and running; however, all online services suffer occasional disruptions and outages, and Microsoft is not liable for any disruption or loss you may suffer as a result. In the event of an outage, you may not be able to retrieve Your Content or Data that you’ve stored. We recommend that you regularly backup Your Content and Data that you store on the Services or store using Third-Party Apps and Services."

Interested In Improving Your Microsoft 365? 

If your ready to improve or to get started with a Microsoft Teams contact our team here or call us on 02921 508000  

Does Microsoft 365 Back Up My Data?

Does Microsoft back up your Microsoft 365 data?

The good, bad, and the not so pretty

As you’ll discover, although these features don’t serve as a complete replacement for comprehensive backups, when utilised and set up correctly, they can serve as an effective initial layer of defence in safeguarding your data.

Data replication

Microsoft’s data retention policies

Native Microsoft Backup

Data loss due to user error and accidental deletions

Ransomware and compromised administrator accounts

Better control of restoring files

Quick restores

Legal compliance and retention policy gaps

Cloud syncing is not the same as backing up your data

Shared Model Makes you responsible for your data

Interested In Improving Your Microsoft 365?

More from the blog

Exploring the New Yealink A40 for Teams Rooms

Flotek to spearhead the new Cardiff Hypercity

New Courses & Feature In Our E-Learning Portal

Live chat

Request a callback

Call us

Hi I’m Malcolm

Speak with me today

Get in touch

Hi I’m Malcolm

When would you like to chat?