Microsoft 365 has had a rapidly increasing adoption rate with 1 in 5* employees using the cloud based SaaS platform worldwide. According to IDC research, 6 out of 10 businesses using Microsoft 365 don’t have a data protection plan in place for their M365 data and simply rely on Microsoft’s native capabilities.

This guide is designed to dispel some common misconceptions surrounding backup for Microsoft 365 including:

• Microsoft 365 is backed up already because it’s in the cloud
• Restores can be done with Microsoft
• The cloud is very resilient and won’t fail anyway

Although Microsoft has a responsibility for basic retention and infrastructure security for Microsoft 365, businesses themselves are responsible for the security, privacy, compliance, backup and recovery of their data.

Recovery From Deletion

You may assume that you can recover from accidental deletion from the Microsoft 365 delete items folder. This is classed as a soft delete as these items can still be recovered from the ‘recoverable items’ mailbox but for up to 30 days only.

A hard delete however is more serious as once this is done there’s no way to recover your emails. For example, if an item
is purged from the mailbox database completely, it cannot be recovered. Also, if one of your user profiles is accidentally deleted this can have a seriously detrimental effect as it will be replicated across the network, also deleting their Sharepoint and OneDrive data.

Look for a solution that will automatically back up Sharepoint, OneDrive, Calendar, and Teams so that in the event of a hard delete you can recover quickly.

Protection Against Security Threats

This is or certainly should be a number one priority for businesses. Security threats are usually thought to come from outside but can also come from within your organization. The first and most obvious one is external threats such as malware and viruses.

The most common way for these to infiltrate your environment is through links in emails or attachments. Although companies do as much as they can to educate staff to be cautious with emails from outside of the organisation, it only takes one click for a virus to infect your entire network.

Internal security threats can be just as damaging. For example, a disgruntled employee may want to cause devastation on the point of leaving your organization by deleting vital business data critical to the running of the business.

Both of these scenarios can be extremely costly, so taking regular backups of your Microsoft 365 data is paramount to ensuring you can recover quickly whatever the circumstance. It also pays to invest in a solution that offers top level encryption of your data giving you peace of mind that it is protected both in flight and at rest.

Protection Against Service Provider Outages

If Microsoft were to go offline, temporarily, or permanently for whatever reason, without an external backup on separate infrastructure, think about how your company’s data could be recovered. Microsoft don’t take backups, so if their infrastructure is compromised though corruption, human error, natural disaster, terrorist act etc then your email data would be lost forever.

Think about the potential implications on your business in the event of an outage. The main issue may be the cost of loss of productivity, but security implications are often overlooked. For example, if your employees are forced to use a third party private email to continue working this may not be protected and subject to data security risks.

Meet Compliance and Legal Requirements

With more stringent data protection regulations coming into force across the globe, it is becoming increasingly important for firms to take responsibility for the protection of customer data. The most prominent of these regulations to be introduced the in the last two years was the European General Data Protection Regulation (GDPR) which came into force in May 2018.
For the majority of data protection regulations – including GDPR, as a business you will be required to make sure data is secure, traceable, searchable, well-preserved and kept in its original form. Compliance and legal requirements can also vary from one industry to another, with tougher regulations for organizations who hold sensitive data in the financial, healthcare and government sectors for example.

Microsoft’s standard retention periods alone may not be enough to meet compliance requirements. Having a third party backup and archiving solution for M365 means you will be able to set your own retention policies protecting your business from costly fines and reputational damage.

Set Retention Policies

As mentioned in the previous point, Microsoft 365 has a limited standard retention policy which is set at 30 days only. This is purely designed for situational data loss and not to be used as an ongoing or replacement for your own backup solution. This is not only important from compliance perspective, but from a business impact point of view. Most businesses need to be able to access data for much further back than just 3 months for any number of reasons.

Also, Microsoft doesn’t offer point in time restoration capability. Choosing a third party backup solution which offers this means data can be recovered on a more granular level with a snapshot taken before a breach or deletion to offer faster recovery.

Hybrid Email Deployments and Migrations

It is important to have backup when migrating over to Microsoft 365. Some businesses have a blend of both on-premises Exchange and Microsoft 365 users. Whatever the case, your Exchange data should be managed and protected the same way, making the source location irrelevant.

Email data disasters happen every day. Having a comprehensive solution that can backup, manage, recover, archive and protect critical Microsoft 365 emails, contacts, calendars and tasks should be an essential element of your overall data protection strategy.

If you’re looking for a backup solution for your company, contact Choice Solutions today to schedule a consultation with one of our experts.