Office 365 lives in Microsoft’s Azure cloud service. That service consists of more than one location and certainly more than one server. Microsoft does an excellent job of keeping the service available, and to most users, it feels like it is never down but it does happen. Behind the scenes, Microsoft is continuously replicating data between multiple storage systems within Azure data centers as well as between Azure data centers.
The reliability of the service often creates an air of confidence, leading to a surprising number of organizations that believe they don’t need to protect their data. However, there are some reasons why IT needs to make sure they backup the organization’s Office 365 data in the traditional sense.
Reason #1: High Availability is Not Backup
Microsoft takes extreme measures to make sure the Office 365 service is available. To a large extent, it is immune to server failure, storage system failure or even complete loss of one of the Azure data centers. Ensuring this extreme level of availability means that Microsoft is using replication to instantly position data throughout the environment.
These steps ensure high availability, but not backups. High availability provides near zero interruption and near zero data loss. However, backup provides point in time rollback of data. Organizations need both, even with SaaS-based applications like Office 365.
For example, if ransomware malware breaches an organization and gains access to a user’s OneDrive account, which often shows up as a share on the network, then the malware can encrypt any data to which the user has access. Upon encryption of the data, the Microsoft High Availability feature detects the changed files and replicates them, almost instantly to another storage system and data center. The result is the organization’s “backup” is instantly corrupted.
The vulnerability isn’t limited to just ransomware. A user can accidentally delete data. Storage Switzerland had this happen a few years ago. The user decided to clean out some old files and didn’t realize the whole organization was sharing those files. They were old to him, so he just deleted them. Had we not had a backup, we might have lost that data forever.
Finally, a user can maliciously delete data. If a user decides to leave a company, they may decide to delete all of their Office 365 data before their final day. This act may be less overt, for example, they could only delete projects they are working on and hoping to resume at their new company.
The HA process works the same for the last two examples. Deletions replicate instantly, and although Microsoft provides the ability to recover deleted data from a recycle bin, it is not indefinite.
The problem with the typical high availability processes is there is no air gap nor are there any point-in-time independent copies. To recover from cyber-attacks and user mistakes often requires a physically separate and disconnected copy of data in another location. This requirement means the organization needs to backup Office 365 (or any cloud service) like it would any application.
Reason #2: The Data is Useable
One of the reasons backing up other SaaS applications is only for recovering from user error or cyber-attack and not for disaster recovery, is that the organization doesn’t have a copy of the applications. There is no way to self-host Salesforce.com or even Google Docs. With Microsoft, the entire Office 365 environment can be self-hosted; there are local copies of the applications available, and actually in use by most Office 365 customers.
Reason #3: Microsoft Tells You To
The number one reason to protect Office 365 Data is that Microsoft’s licensing agreement makes it very clear, data an organization stores in Office 365 is their data, not Microsoft’s data.
StorageSwiss Take
The “why” of backing up Office 365 seems obvious. The “how” is less obvious. Once an organization understands “why” to backup Office 365, IT needs to decide how to backup Office 365. Unfortunately, their search leads them to a dizzying number of software solutions and service providers that offer to deliver the capability. Wading through all of the potential options is challenging.
Our on demand webinar “The Next Question: How to Backup Office 365” provides IT professionals with the details they need to sift through the options and select the right solution for their organization.
Register for the on demand webinar and get a copy of our paper “How to Backup Office 365“, which compares the different Office 365 techniques so you can decide which method works best for you.
George Crump is the Chief Marketing Officer at VergeIO, the leader in Ultraconverged Infrastructure. Prior to VergeIO he was Chief Product Strategist at StorONE. Before assuming roles with innovative technology vendors, George spent almost 14 years as the founder and lead analyst at Storage Switzerland. In his spare time, he continues to write blogs on Storage Switzerland to educate IT professionals on all aspects of data center storage. He is the primary contributor to Storage Switzerland and is a heavily sought-after public speaker. With over 30 years of experience designing storage solutions for data centers across the US, he has seen the birth of such technologies as RAID, NAS, SAN, Virtualization, Cloud, and Enterprise Flash. Before founding Storage Switzerland, he was CTO at one of the nation's largest storage integrators, where he was in charge of technology testing, integration, and product selection.
StorageSwiss.com - The Home of Storage Switzerland 
Thanks, for such a great post full of user helpful information. I would like to suggest a great Office 365 Backup Tool. i.e. SysTools Office 365 Backup that supports auto incremental backup option on the local machine.
Ref: https://www.systoolsgroup.com/office365-backup/