As both an entrepreneur and an IT specialist, Lindsey offers a blend of deep technical expertise and commercial insight, delivered in language business owners can really understand and trust. She works with clients to provide a full range of services from strategic advice through to project management and infrastructure support.
Lindsey is an accredited Cyber Essentials Consultant
Do I need to backup Office 365 data?
My Inbox has been swamped of late with vendors trying to sell me additional backup facility for Office 365, and a question I am increasingly asked by customers is .. “do we need to back up our Office 365 data?” A good question! It is a common assumption that Microsoft has this covered, and to be honest for most situations, they have. With what I know of Office 365 capabilities and being a critical part of our own setup, I have chosen not to have additional backup. That isn’t to say however that your own compliance or sense of self-preservation won’t lead you to a different decision. I believe some vendors claims to be hyperbolic as to why you should use their backup .. some claims have some truth .. some stretch it somewhat.
So .. here are the facts.
How Microsoft protect Office 365 data
Microsoft have an online resource called the Microsoft Trust Centre which contains a wealth of information and resources if you care to spend a few hours reading it. Should you not have that time however, I have detailed a few questions we are usually asked below.
Does Microsoft backup my Office 365 data?
Yes. Despite the rumours, Microsoft does backup your Office 365 data. While somewhat more complex than a simple disk based or online backup .. the key statement from Microsoft is “Data resiliency means that no matter what failures occur within Microsoft 365, critical customer data remains intact and unaffected”. Further information is available from the links below
What happens if I accidentally delete something in Office 365?
Another common question, and whether by accident or otherwise, lost items are available for recovery for periods of time depending on your subscription and varies on the service.
- Microsoft Exchange Online (email) for example retains deleted mailboxes for 30 days and individual items for 14 days, and for individual items this can be increased by administrators to 30 days.
- SharePoint libraries have the protection of a recycle bin where documents deleted can be recovered. These are retained for 93 days which is usually enough for most. More information on this is here. Even if someone deletes from the Recycle Bin, the file is still recoverable within the same 93 day period by an administrator from the “collection recycle bin”
- With Microsoft Teams you cannot restore deleted messages as such to their original situ .. but you can use retention policies and the Office 365 Security and Compliance centre to ensure copies can be reviewed if lost. Files presented in Teams are hosted by SharePoint and as such the SharePoint recycle bin can be used for this purpose
- One Drive also has a recycle bin where you can recover deleted files or folders. Deleted items are retained her for 30 days and more information can be found here
What happens if my PC gets hit my Ransomware or a virus?
SharePoint and OneDrive are more vulnerable than your email here as you may use synchronisation of files to your desktop .. and ransomware usually attacks files.
For Office 365 subscribers, One Drive ransomware detection and recovery is included and more information is here
If you use SharePoint and One Drive to sync files to and from the desktop there are also options available such as version control and recycle bins, and ultimately including the backstop that Microsoft will assist you in restoring a damaged SharePoint site up to 14 days from the date of infection from their own backups. More information here
Why then are so many offering Microsoft 365 backup?
The main reason for writing this article was that I had become fed up being told by vendors that Microsoft do not backup with customers data … and equally fed up on behalf of our own customers who were maybe becoming unnecessarily concerned by the circulation of some half-truths and misinformation. I hope to have dispelled these myths. That said, some vendors do offer a valuable service, and I have listed below what I feel are reasons you may decide additional backup is right for you.
- You have compliance requirements that demand additional backup
- You just don’t feel comfortable having all your eggs in one basket.
- Continuity should a cloud outage occur .. although the limitations of online backup may not assist much there.
- Convenience. Microsoft recovery options can be fragmented, and it may be that you would like an improved experience.
- Better and more granular restore options. For example, being able to restore an email mailbox or SharePoint Library to a point in time in its entirety. Or,
- Longer retention than Microsoft offers.
Your own appetitive for risk, your budget and how comfortable you feel trusting a cloud provider all play a part and are valid .. just make sure if you do go for a 3rd party backup solution for Office 365 that you get value and don’t get sold something you already have!
A plan is good!
If you make the decision to stick with the tools provided by Microsoft, one final piece of advice would be to make a written note of some of the likely scenarios you could reasonably anticipate and the key steps you would need to start the recovery of your data. For example:
- Somebody deletes some e-mails (either accidentally or maliciously) that you need to recover
- Somebody deletes some files held in SharePoint or Microsoft Teams (either accidentally or maliciously) that you need to recover
- You are hit by a ransomware attack and you need to recover files from versions that you know are clean (i.e. copies you made before the attack)
If an incident occurs, the pressure to resolve issues quickly and return to business as normal can be very intense. If you have to spend valuable time working out what to do because you have not done some basic scenario planning “during peace time” when the pressure was off, recovery times can be extended. It may also increase the likelihood of making poor decisions or mistakes which only add to the woe. Even a simple Business Continuity Plan, which need be no more than a bit of common sense, written down, can go a long way to ensure that a mole hill does not turn into a mountain.
Do I need to backup Office 365 data? was written by Lindsey Hall with contributions from James Allison