Young pensive businessman sitting in the corporate office and thinking about something.
By: Catherine Brennan
For many organizations, M365 is the foundation for hybrid work. Its collaborative, work-anywhere features make both remote and in-office employees more productive by delivering a seamless work experience while advanced authentication capabilities ensure the network is accessed securely.
IT professionals are often surprised to learn that despite its many hybrid work benefits and robust data retention policies, Microsoft 365’s backup capabilities are not enough to protect an organization’s data and business continuity.

Backup vs retention

Data ‘backup’ and ‘retention’ are sometimes interpreted differently within an organization. For an IT professional, ‘backup’ usually means copying, storing, and making sure data can be recovered, whereas ‘retention’ is the period before it can be permanently deleted.

To a data governance manager, or legal counsel, “retention” is a much more complex concept, requiring data be preserved in an accessible, defensible format for purposes of discovery and legal document production.

Too often, these two concepts are confused, which can result in critical gaps in data protection and business continuity. This is particularly relevant for organizations in a M365 environment, because while M365 offers several customizable retention features, it doesn’t provide a backup infrastructure.

M365 data retention

Most Microsoft 365 applications enable retention of their respective data types. Retention policies and labels can be configured at both macro and granular levels for any prescribed period, working as follows:
 – SharePoint and OneDrive sites retain copies of deleted files in the Preservation Hold
 – Exchange mailboxes retain copies in the Recoverable Items
 – MS Teams retains data in a hidden folder named as a subfolder in the Exchange Recoverable Items
Some may be tempted to rely on M365’s built-in retention capabilities as a quasi-backup infrastructure, but there are several problems with this.
Firstly, to access a user’s data in M365 you must maintain an active account. This can be very costly, particularly for organizations with temporary users or high turnover. It just isn’t feasible to perpetually maintain licenses for former employees, however deleting their profile means all user data is permanently lost.
Cost optimization is another important consideration. M365 storage is not and quickly adds up. For example, Office 365’s autosave feature delivers instant document recovery and version control, but this requires that a copy of the document be saved and stored every time it’s edited.
When files are copied to the Preservation Hold library from SharePoint and OneDrive, it counts toward the user’s total storage quota for that account. Every deleted and modified document eats up the user’s 5TB storage limit, which means you’ll soon be paying overages.

M365 backups

Microsoft operates within a shared responsibility model, providing some protection of data:
 – physical security in their data centres, including protection from natural disasters, hardware or software failures on their part, power outages, etc.
  data storage replication and redundancy
 – core tenets of their security approach include guarantees of uptime and privacy controls
Microsoft makes it very clear that protection from accidental deletion, cyber threats, misconfigured workflows and malicious parties are the sole responsibility of the customer. In fact, they make no secret of this and strongly recommend that customers implement their own backup infrastructure and practices.

Backing up M365, the smart way

To ensure complete data protection and business continuity, you need a robust backup infrastructure that integrates with M365 and utilizes the flexibility and cost-savings of the cloud.
Orchestrating and managing successful M365 backups require expertise, constant management and testing. Solutions such as Veaam and Barracuda offer strong capabilities for this, but don’t include much management and support.
Consider outsourcing your M365 backups to an experienced IT partner who uses a combination of advanced technologies and expert best practices to achieve comprehensive protection and continuity.
Solutions such as can provide comprehensive backups and recovery for all M365 data types, including email., as well as other LOB applications within your environment. Limitless storage capabilities, cost-optimization and continuous back up of critical business data to a secondary cloud make it a favourable option.
Another smart solution is integrating M365 with Azure, which provides centralized cloud backup, disaster recovery and security capabilities for your entire network, devices and applications.
Both these solutions can fill in gaps with Microsoft 365 backups and easily integrate with your existing infrastructure.
Learn how Ricoh ensures continuous operations and data protection, even when disaster strikes. Our experts will help you develop and deploy risk management and recovery plans aligned to your business needs. Contact us today to get the conversation started.