The question whether a company using a cloud system like Office 365 should deploy third-party backups is asked frequently in the Microsoft Technical Community (here’s another post). Some people are passionate advocates for backups while others assert that backups aren’t necessary because Microsoft can be trusted to take care of the data. Indeed, the only backups Microsoft takes of customer data within Office 365 are for SharePoint Online. No backups are taken for Exchange Online, Teams, Planner, or Azure Active Directory.
I’ve written about this topic before. Generally speaking, I’m not a huge fan of taking backups of Office 365 data unless forced into the situation by something like legal or audit requirements.This time round I want to raise the question of whether technical change within Office 365 is making the notion of backups more irrelevant over time, especially if you use the full spectrum of functionality available in the suite.
Deciding whether external backups are needed isn’t a simple question and there isn’t a simple answer. Some companies operate under strict regulatory environments that are interpreted to need to need some form of external backup. Some have hybrid organizations and others are cloud-only. Some use all the Office 365 applications, while others use a limited selection. All these factors influence the choice a company might make.
Among the reasons I see people cite to deploy backups for Office 365 are:
There’s no doubt that accidents happen that result in lost data and that we live in a world where attacks against corporate systems are an ongoing fact of life. However, the technology inside Office 365 is improving all the time to help resist problems like those listed above. In some cases, the solution to the problem is available in a feature available in Office 365 today; in others, the solution lies in improved administrator knowledge and awareness.
The “all your eggs in one Microsoft basket” question is interesting because it anticipates some catastrophic event when Office 365 might become unavailable for a sustained period. In effect, all the Office 365 datacenters in a region will be offline for more than a few hours. Although it’s impossible to say that such an event can never happen, it has not to date. Outages do happen that affect Office 365, but those outages are usually localized and only affect a subset of users and applications in a single datacenter region.
For example, is it likely that the Office 365 EMEA region will suffer an outage involving the Dublin, Amsterdam, Helsinki, and Vienna datacenters that Microsoft will not be able to recover within a day? Figuring out the statistical possibility of such an event is difficult and understanding how having external backups would help is harder. Where, for instance, could you restore the backups?
Because technology changes so quickly, tenants should assess their backup needs on an ongoing basis. A conclusion reached even two years ago might not stand up to the test of today because the application mix within Office 365 is different and the available functionality has expanded.
For example, two years ago, no one used Teams. Now, 329,000 organizations use Teams, all of whom must depend on Microsoft for Teams data storage because no backup API is available for Teams messages or other metadata.
It’s not just technology that should be considered. Regulations such as GDPR mean that companies need to pay more attention where their data is stored and how it is managed.
To assess the need for external backups, a company should work through an exercise to review their current situation and discover whether backups can help. Stripping out all the FUD that is sometimes thrown into the mix, we can focus on three straightforward questions.
If at the end of the day, you conclude that external backups are needed for your Office 365 data (or some subset of that data), go ahead and look for a reliable backup vendor who can meet your requirements (including data sovereignty, compliance with GDPR, coverage of all your Office 365 data, and ability to recover in some useful way). There are plenty of cloud-based backup vendors for Office 365 for you to talk to that offer a variety of services at different price points.
Avoid any backup product that offers to move data from the cloud to PST files. Apart from giving information to a legal investigator to review, there’s absolutely no good reason to use PSTs as a backup media.
Keep the conversation focused on your needs instead of letting the vendor direct you to what they can deliver. Stay away from what-if situations that are unlikely to occur and focus on how backups help solve business problems. It’ll be a more productive conversation that way.