Wednesday, May 22, 2024

Office 365: Yes, You Need Data Protection

Datamation content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More.

By Jim Whalen

Microsoft Office 365 a is a popular, cloud-based SaaS productivity suite for consumers and businesses of all sizes.  In addition to Microsoft’s Office applications, such as Word and Excel, it also contains cloud-hosted versions of Exchange for email; SharePoint for document sharing and management; and OneDrive for general cloud storage. 

Office 365 is offered via a subscription service and provides automatic access to the latest versions of all of the components, along with technical support, making it an all-in-one solution for any entity looking to simplify their operations. 

With it being a cloud-based SaaS offering, many users think that there’s no need to backup their Office 365 data, as Microsoft will be taking care of all of those sorts of behind-the-scenes activities.  But that’s not how it works. 

As the host, Microsoft is providing availability to their service and your data, primarily with instances and redundant copies spread across multiple data centers, but their focus is on preventing data loss due to hardware and application failures, natural disasters and power outages.  They don’t provide anything more than some rudimentary data protection mechanisms for users.  They do a SharePoint backup every 12 hours, but only keep the backups around for 14 days and the recovery restrictions are significant. 

Microsoft also offers licensed capabilities, called “In Place Hold” and “Litigation Hold,” that save deleted emails indefinitely.  However, the search and recovery mechanisms they provide are rudimentary.  The bottom line is, even with the protections that Microsoft provides, there are still several ways that data can be lost.


If a user mistakenly deletes an email, they can recover it from the recycle bin – within a given time frame. Exchange Online automatically and permanently purges items after 14 days (extendable up to 30 days).  Some Office 365 licenses allow for unlimited retention periods, but still limit the overall amount of storage space that may be used, deleting the oldest items first once the limit is hit.  In the case of a malicious deletion, the email is immediately unrecoverable.

It gets even worse if mailboxes, contacts or folders are deleted.  A deleted mailbox can be tediously rebuilt email by email, but any contacts or folders that are deleted, accidentally or maliciously, are lost permanently.

SharePoint and OneDrive both have similar limitations.  Deleted items remain in the recycle bin for a minimum of 30 days before they’re permanently purged, so only if the deletion is noticed in time can it be recovered.  As with email, any malicious deletions are lost immediately and it’s also possible for the SharePoint administrator or any OneDrive user to permanently delete one or more files by accident, making them unrecoverable.

Corruption and Hackers

While Microsoft does have malware protections in place, if a user clicks on the wrong link, files and emails can still be compromised by viruses and ransomware while residing in the cloud.  When this happens, it’s important to be able to restore an earlier, uncorrupted version from a backup, otherwise the data may be gone for good.  Users can also corrupt files by overwriting them, requiring, at a minimum, potentially substantial rebuild time.  Hackers, too, can gain access to the system and steal, delete or corrupt emails and files. 

Even with all that Microsoft does to make sure that they don’t lose your data, this is still a pretty daunting list of ways in which data loss can occur.

Recovery Time Matters

As every backup administrator knows, backup is important, but what’s really critical is being able to recover their data.  There are several recovery issues with Office 365.  First of all, even if deleted data is still somewhere in the system, it’s not easy to find.  For example, all deleted emails are saved when using Litigation Hold, but the search/recovery interface is not in the same league as a purpose-built data protection recovery interface.  It’s even worse when trying to recover something from one of the various recycle bins – there’s no search mechanism, so the entire collection of deleted items must be manually inspected one by one.  Finding the desired email or file can take a long time.  If what you’re looking for is still on the system, you can get it back, but it’s painful. 

In some cases, it’s not even possible for a tenant administrator to independently recover something; Microsoft support must be called.  Again, it’s not fast or easy.  For anyone that’s used to modern data protection packages where finding a desired item and restoring it is a simple, quick, self-service process, recovering something from Office 365 is likely to be frustrating. 

Data Protection Vendors Step Up

Given all of the ways that you can still experience data loss in Office 365 and, even if the data is still there and technically recoverable, the difficulty and time required in getting it back, a true backup and recovery solution is something that every Office 365 tenant should consider acquiring.  The data protection industry has responded to this need.

The most recent entrant in the space is Unitrends, with their Cloud Backup for Office 365 service offering, an extension of their Connected Continuity Platform.  It fully protects Exchange (email, calendars, contacts, folders and mailboxes), OneDrive and SharePoint, storing the data in a dedicated Microsoft Azure Cloud instance with unlimited retention. 

Unitrends’ focus was on simplicity and ease of use, so they designed it so that there’s nothing to install; there’s no need to manage a backup schedule, the service automatically takes a full snapshot up to 6 times daily; and it automatically discovers and backs up new users.  It offers end users self-service search and recovery for quick restores and it can be accessed from anywhere with an internet connection.  With Unitrends’ “keep it simple” emphasis and comprehensive backup coverage for all components of Office 365, this is perhaps the most interesting offering currently available.

Another familiar name in the backup business, Veeam has just recently announced their first Office 365 product, Veeam Backup for Microsoft Office 365, currently in Beta testing.  It will be offered as an additional component of their existing Veeam Backup and Replication product and, initially, will only be able to backup and restore email data and perform searches.

Barracuda and Datto are two other data protection companies, known primarily for their backup appliances, that offer solutions for Office 365: Cloud-to-Cloud Backup for Office 365 and Backupify for Office 365, respectively.  Both will backup Exchange and OneDrive; Barracuda does not support ShareDrive backups, while Datto will do a partial SharePoint backup.  Both allow on-demand or scheduled backups and store user data in their clouds with unlimited retention.  Users can search for and restore data from anywhere they have an internet connection.  Uniquely, Barracuda allows Cloud-to-Cloud Backup to be added to a customer’s existing Barracuda Backup appliance, in addition to providing it through a standalone subscription. Datto’s  business model is exclusively MSP-based.

EMC acquired Spanning Cloud Apps several years ago, giving them a solution to Office 365 data protection. With EMC Spanning Backup for Office 365, they provide daily automated or on-demand backups for email, calendars and OneDrive but, significantly, not for SharePoint.  Customer data is stored in their own cloud provider’s data center and they offer flexible search and restore operations, either self-service or administrator-driven.  The software is optimized to run on tablets, laptops and smartphones so that users can access it from wherever they’re working

Asigra began selling a remote backup solution years before cloud architectures even existed.  Now, their Office 365 solution, Asigra Cloud Backup, is a cloud-to-cloud product offered via a large network of MSPs.  Customer data is stored wherever the MSP chooses to store it, but Asigra fully supports private, public or hybrid cloud repositories.  It protects Exchange, OneDrive and SharePoint fully.  Asigra Cloud Backup provides on-demand or scheduled backups and also allows end users to perform self-service searches and restores.  Asigra offers unlimited retention of data, but charges for storage on a $/GB/month basis.  One thing to look out for is that Asigra has perhaps the most complicated offering in this space, so working closely with an MSP will be important in getting it architected and configured properly.

Most of these Office 365 backup solutions offer some form of per-user pricing, but Asigra charges depending on how much data you work with.  With all of the options, pricing differs noticeably from company to company, so some calculator time will be required to figure out who’s providing the most cost effective solution for any given situation.  However, once you understand the many ways that data can be lost in Office 365, you realize that it’s a price that must be paid. 

Jim Whalen is a senior analyst and consultant with the Tenaja Group

Subscribe to Data Insider

Learn the latest news and best practices about data science, big data analytics, artificial intelligence, data security, and more.

Similar articles

Get the Free Newsletter!

Subscribe to Data Insider for top news, trends & analysis

Latest Articles