6 Critical Reasons

for Office 365

Backup
The case for why organizations
need to protect Office 365 data
6 Critical Reasons for Office 365 Backup 2

Introduction
Do you have control of your Office 365 data? Do you have
access to all the items you need? The knee-jerk reaction
is typically, “Of course I do,” or “Microsoft takes care of it all.”

But if you really think about it — are you sure?

Microsoft takes care of quite a bit, and provides a great

service for their customers. However, Microsoft’s primary
focus is on managing the Office 365 infrastructure and
maintaining uptime to your users. They are empowering
YOU with the responsibility of your data. The misconception
that Microsoft fully backs up your data on your behalf
is quite common, and without a shift in mindset, could
have damaging repercussions when this responsibility
is left unattended.

Ultimately, you need to ensure you have access to, and

control over, your Exchange Online, SharePoint Online,
OneDrive for Business and Microsoft Teams data.

This report explores the hazards of not having an Office

365 backup in your arsenal, and why backup solutions
for Microsoft Office 365 fill the gap of long-term “We worried about the backup and retention policies in Office 365.
retention and data protection. That’s why we decided to ensure we have a backup
of our data residing in Office 365.”
— Karen St.Clair, IT Manager,
Columbia Power & Water Systems
veeam.com
6 Critical Reasons for Office 365 Backup 3

The big Office 365

misconception
The misunderstanding falls between Microsoft’s
perceived responsibility and the user’s actual
responsibility of protection and long-term retention of
their Office 365 data. The backup and recoverability
that Microsoft provides and what users assume they
are getting are often different. Meaning, aside from the
standard precautions Office 365 has in place, you may
need to re-assess the level of control you have of your
data and how much access you truly have to it.

Microsoft Office 365 offers geo redundancy, which

is often mistaken for backup. Backup takes place
when a historical copy of data is made and then
stored in another location. However, it is even more
important that you have direct access to and control
over that backup. So if data is lost, accidentally
deleted or maliciously attacked, for example — you can
quickly recover. Geo redundancy, on the other hand,
protects against site or hardware failure, so if there “With Office 365, it’s your data. You own it.
is an infrastructure crash or outage, your users will You control it.”
remain productive and often oblivious to these
underlying issues. — The Office 365 Trust Center

veeam.com
6 Critical Reasons for Office 365 Backup 4

6 reasons why backing up

Office 365 is critical
As a robust and highly capable Software as a Service people get it wrong. The average length of time from
(SaaS) platform, Microsoft Office 365 fits the needs data compromise to discovery is over 140 days 1.
of many organizations perfectly. Office 365 provides A shockingly large gap. The likelihood is high that you
application Availability and uptime to ensure your users won’t notice something is missing or gone until it’s too
never skip a beat, but an Office 365 backup can protect late for the recycle bin.
you against many other security threats.
By talking with hundreds of IT professionals across
You or your boss might be thinking, “The recycle the globe who have migrated to Office 365, six
bin is probably good enough.” This is where many vulnerabilities in data protection rise to the top:

Accidental Retention Internal External Legal and Managing hybrid

deletion policy gaps security threats security threats compliance email deployments
and confusion requirements and migrations
to Office 365

1
https://discover.office.com/6-steps-to-holistic-security/chapter1/

veeam.com
6 Critical Reasons for Office 365 Backup 5

#1 #2
Accidental Retention policy
deletion gaps and confusion

If you delete a user, whether you meant to or not, that The fast pace of business in the digital age lends itself
deletion is replicated across the network, along with to continuously evolving policies, including retention
the deletion of their personal SharePoint site and their policies that are difficult to keep up with, let alone
OneDrive data. manage. Just like hard and soft delete, Office 365 has
limited backup and retention policies that can only fend
Native recycle bins and version histories included off situational data loss, and is not intended
in Office 365 can only protect you from data loss to be an all-encompassing backup solution.
in a limited way, which can turn a simple recovery from
a proper backup into a big problem after Office 365 has Another type of recovery, a point-in-time restoration of
geo-redundantly deleted the data forever, or it has fallen mailbox items, is not in scope with Microsoft. In the case
out of the retention period. of a catastrophic issue, a backup solution can provide the
ability to roll back to a previous point-in-time prior to this
There are two types of deletions in the Office 365 issue and saving the day.
platform, soft delete and hard delete. An example of soft
delete is emptying the Deleted Items folder. It is also With an Office 365 backup solution, there are no
referred to as “Permanently Deleted.” In this case, retention policy gaps or restore inflexibility. Short term
permanent is not completely permanent, as the item can backups or long-term archives, granular or point-in-time
still be found in the Recoverable Items mailbox. restores, everything is at your fingertips making data
recovery fast, easy and reliable.
A hard delete is when an item is tagged to be purged
from the mailbox database completely. Once this
happens, it is unrecoverable, period.

veeam.com
6 Critical Reasons for Office 365 Backup 6

#3 #4
Internal External
security threats security threats

The idea of a security threat brings to mind hackers and Malware and viruses, like ransomware, have done
viruses. However, businesses experience threats from the serious damage to organizations across the globe.
inside, and they are happening more often than you think. Not only is company reputation at risk, but the privacy
Organizations fall victim to threats posed by their very and security of internal and customer data as well.
own employees, both intentionally and unintentionally.
External threats can sneak in through emails and
Access to files and contacts changes so quickly, it can attachments, and it isn’t always enough to educate users
be hard to keep an eye on those in which you’ve installed on what to look out for — especially when the infected
the most trust. Microsoft has no way of knowing the messages seem so compelling. Exchange Online’s
difference between a regular user and a terminated limited backup/recovery functions are inadequate
employee attempting to delete critical company data to handle serious attacks. Regular backups will help
before they depart. In addition, some users unknowingly ensure a separate copy of your data is uninfected and
create serious threats by downloading infected files or that you can recover quickly.
accidentally leaking usernames and passwords
to sites they thought they could trust.

Another example is evidence tampering. Imagine

an employee strategically deleting incriminating emails
or files — keeping these objects out of the reach of the
legal, compliance or HR departments.

veeam.com
6 Critical Reasons for Office 365 Backup 7

#5 #6
Legal and Managing hybrid email
compliance deployments and
requirements migrations to Office 365

Sometimes you need to unexpectedly retrieve emails, Organizations that adopt Office 365 typically need
files or other types of data amid legal action. Something a window of time to serve as a transition window between
you never think it is going to happen to you until it does. on-premises Exchange and Office 365 Exchange Online.
Microsoft has built in a couple safety nets, (Litigation Some even leave a small portion of their legacy system
Hold) but again, these are not a robust backup solution in place to have added flexibility and additional control.
capable of keeping your company out of legal trouble. These hybrid email deployments are common, yet pose
For example, if you accidentally delete a user, their on- additional management challenges.
hold mailbox, personal SharePoint site and OneDrive
account is also deleted. The right Office 365 backup solution should be able to
handle hybrid email deployments, and treat exchange
Legal requirements, compliance requirements and data the same, making the source location irrelevant.
access regulations vary between industries and
countries, but fines, penalties and legal disputes are Furthermore, you should be able to store the data
three things you don’t have room for on your to-do list. anywhere you choose, whether on premises, in cloud
object storage such as AWS S3 or Azure Blob, or with a
managed service provider.

veeam.com
6 Critical Reasons for Office 365 Backup 8

How often do these

reasons happen?
By now you understand why it’s critically important Q14. What forms of data loss have you experienced within the cloud?
to back up your Office 365 data. But you’re probably (Check all that apply)
wondering to what extent these six data protection
vulnerabilities actually happen. Unfortunately, the
answer is far too often… User error/Accidential deletion 37%

Over 1,000 IT professionals were asked what forms of

data loss they had experienced in the cloud. User error/ Security threats (malicious insider,
18%
ransomware, malware)
accidental deletion, security threats and retention gaps
all made the list from 18% to as high as 37%2.
Retention policy gaps (thinking something
19%
The scary reality is that even though sensitive cloud was protected that wasn't)

data is stored in Office documents, an estimated 76%

is not being backed up2. In fact, IDC states that 6 out
Don't use/none 20%
of every 10 organizations still don’t have any form of
Office 365 data protection3. Do you work in one of these
unprotected organizations? If so, hopefully you now have
Other 6%
the insights available through this report to encourage
your organization to protect its Office 365 data.
0% 5% 10% 15% 20% 25% 30% 35% 40%
2
Veeam customer survey, September 2019
3
IDC: Why a Backup Strategy for Microsoft Office 365 is Essential, 2019
Respondents = 1,579

veeam.com
6 Critical Reasons for Office 365 Backup 9

Conclusion
Go ahead and take a closer look. There are security
gaps you may not have been aware of before.

You already made a smart business decision by

deploying Microsoft Office 365, now find a backup
solution that offers you both complete access and
complete control of your Office 365 data and avoid the
unnecessary risks of data loss.

If you found this report helpful, we encourage you to

email it to a colleague: Forward this report

Learn more about Office 365 backup at:

https://www.veeam.com/backup-microsoft-
office-365.html

veeam.com
6 Critical Reasons for Office 365 Backup 10

veeam.com