“We’re on Microsoft 365, so we don’t need a backup.”
We hear this all the time – unfortunately, that’s simply not true. Here are the most common misconceptions surrounding this topic:
- Being in the cloud means your data is secure
- Being in the cloud means everything is backed up
- M365 backup isn’t necessary or critical
This article is going to focus in on misconception #3. Before diving in, I’d like to start by saying that if you believed misconception #3 before reading this article, don’t feel naïve. M365 backup is confusing – confusing because yes, M365 does have backup, but no, their limited backup will not meet your business needs.
Where’s the M365 backup gap?
The most simple way to look at this is: Microsoft takes responsibility for backing up what they need to be able to provide their service. This leaves their clients responsible for backing up what they do using their service. In other words, Microsoft is responsible for the infrastructure – uptime, regulatory attestations at the infrastructure level, etc. You are responsible for your data – making copies of the data, managing control and regulatory processes for your data, etc.
Examples of the gap:
- Many employees use their deleted mailbox as a storage folder that they expect they can access anytime. However, on M365, deleted files will only be accessible for a short period of time before the data is permanently deleted.
- If you delete a user so you can reassign their license, on M365, their data and emails (which may be needed to support clients, move forward on projects, or provide evidence for employment or other legal disputes) will only be accessible for a short period of time before the data is permanently deleted.
Sources of risk in the gap
If your business does not have an additional M365 backup solution, you are at risk from:
- Accidents and user error
- Malicious employees
- Malware and viruses
- Legal compliance in your retention policies
The solution
The best approach is to simply treat M365 like you would treat the data if it were stored on-site. Start by deciding your data protection policy for your business as a whole. Then implement your policy across the board, including for your M365 environment, which will more than likely involve additional backup that is incremental to your M365 subscription.
