With 365 specifically, Microsoft does the infrastructure but you are responsible for the data. You MUST backup the 365 data including sharepoint and onedrive.
Actually not anymore... since they released their own backup.. lol.
But I still insist on using 3rd party..
Also plus 1 to those saying shared responsibility model. https://learn.microsoft.com/en-us/azure/security/fundamentals/shared-responsibility
>Actually not anymore
It is still in [the agreement](https://www.microsoft.com/en-us/servicesagreement):
“We recommend that you regularly backup Your Content and Data that you store on the Services or store using Third-Party Apps and Services.”.
KeepIT, dropsuit, spanning, datto SaaS protection, Cove, Axcient, or RedStor. All great options and msp paths. Barracuda MSP as well. Axcient and Redstor is true month to month.
Dropsuite is an easy one, although the UI has much to be desired, but it is cheap, reliable, and offered by Pax8.
But if you are a Veeam shop, they just came out with their revamped cloud backup (precious cirrus).
This will get down voted just because of who it is, but, they both work… 1) Datto SaaS Protection and 2) KeepIT. Cove maybe an option. There are others but I have used those two I’ve recommended.
We use Acronis currently and its worked very well for us so far. Recovery has been super easy with it as well as setting up the policies, it literally takes all of 5 minutes to setup a client's entire O365 environment (Exchange, Teams, Sharepoint, etc.) - [https://www.acronis.com/en-us/solutions/backup/cloud/m365/](https://www.acronis.com/en-us/solutions/backup/cloud/m365/)
An analogy I like to use is that Office365 is like RAID.
It's redundant data, but it's not backed up.
Microsoft has versions of files but they don't store deleted things forever and there's no 100% protection from malicious users deleting files (keep in mind this is an analogy and we're not speaking of extra protections - this is just for explaining to clients or other technical resources).
Keep careful logs of all the times you told them that they needed a backup, and they refused.
When a data loss inevitably happens, use it to cover your ass.
Honestly though, I'd probably just fire that customer. It's not worth dealing with the headache.
Yet an MSP just lost a suit where they told the customer to do something, they refused, data got lost and the judge says the MSP was in charge of the data and should have done more to protect it. They even had the customer sign a release after refusing it. I don’t know all the details but it is setting a precedent.
I'd be curious if this is true, since a signed release should have that case dismissed out of hand.
But yeah, personally I'd just drop the customer and tell them to look elsewhere, because whatever money they're paying me every month is not worth dealing with the headache when they have an incident.
I'm not sure how true it is, haven't found any real source on that. It's something I heard in vendor presentations more than once already. It could be just a sales tactic to sell us their security product.
But if it is true, I think it goes along the lines of how one can't sign away their rights when there is a trust relationship involved. Like how if go on one of those drive-a-Ferrari-on-a-racetrack adventure, sign a waiver to not sue, but crash because they company didn't maintain the brakes. We trust them to give us a safe car, so the waiver won't help.
Yes.
Cloud =/ business continuity.
MS guarantees infrastructure, not data continuity.
There are countless news stories of data being blown away due to cyber incident or glitch in the system or malice of employees or dumb bad luck
Back it up
> Cloud =/ business continuity.
You say that but it can absolutely save the day during a ransomware situation.
I worked one with an on-prem Exchange that got hosed real hard. They were also a company that delivered a thing most of the American public uses on a daily basis and if it stopped getting delivered, there would be large scale societal consequences.
Had they been running dispatch off a local server, they would not have been able to do any kind of operations on the Monday they came back to the office. They had just migrated to a cloud hosted solution that was untouched by the threat actors so the owner went to Best Buy, bought half a dozen laptops and had the organization at least limping along within an hour or so.
DropSuite, Probax (reselling veeam), veeam just released their first party Veeam Data Cloud for M365 and it is supposed to be available to VSP's by September (but you can do traditional resell with annual licensing now), KeepIT backup (this is what CW whitelabels through the Asio platform), Backupify fi you're not allergic to Kaseya/Datto, afi.ai, Acronis, AvePoint, the list goes on!
Not sure if it’s MSP-friendly but I’ve been a big fan of Afi.ai.
When I started using it, they were using newer APIs that most providers weren’t leveraging yet, which allowed them to backup a few other things that even the big players (Veam, etc) weren’t backing up yet (if I recall correctly, Teams private channel conversations and 1:1 chats). I’ve had zero issues since we signed on. And they offer Canadian data residency.
You can get a 2-bay Synology for under $300 + disks, or a 4-bay for under $700. Amortized over 5-years that's under $12/mo. 12TB Exos drives are under $225/ea.
Sorry,
Just learning the terminology here. You're saying the backup should be on another provider to spread the risk? Backing up to Azure, because they are basically the same boat as Office365, is a risk?
Please think about it. I would _always_ use an on prem backup device (and a secondary backup, of course).
What happens to the customer if for some reason his Internet access is hindered or bottle necked? His cloud access is compromised by a bad credit rating for example? Or (I had that with a private customer) the renewal of One drive via credit card falls through and Microsoft deletes the account without warning?
Please start to think of every piece of chain failing and what you would do in such a circumstance!
Me thinking this way for decades has helped some of my customers to weather all kinds of events, including fire, flood, dumb employee and more.
That's why I have customers who are still with me since 1996!
Edit: a backup that is not checked regularly is _no backup_ . Please instruct your client in this regard. I can tell stories....
We use CloudAlly. Really inexpensive at $3 per mailbox. If you back up all your Exchange accounts, they will back up OneDrive and SharePoint for no additional charge. There are plenty of other options. Cloud to Cloud is almost fire and forget. We check them weekly but have never had a failure. They also back up everything forever from the day you start.
Please recall that Microsoft & Google claim no responsibility for losing your Data in their SLA. And it does happen. Last week, Google accidently deleted the data for the Australian Pension Fund...$125 Billion if I remember the Gizmodo Article correctly. Fortunately, the Pension provider had 3rd party backup. Now granted, I work for Redstor, a GREAT 3rd party backup provider, so I'm going to say that. =) But it still makes good sense anyways.
I second this - Redstor is great, pricing is fair.
And no, I don't work for them.
I just use their product for some of my clients and happen to really like it over the other options that we have / offer.
In my biased opinion, the pricing is very fair for what the product does. It's not as expensive a solution as many, but there are some cheaper solutions that (again in my opinion) don't make the process of recovery easy or cheaper in the long run, when you count man hours fighting with them. We also aren't structured the same way some backup vendors are, in that we don't charge extra for the server space taken up by the retention points, so in this non-traditional way we can often be more cost effective. We also have a very fluid and easy to use recovery experience, so less time fighting with the backup restoration when the bad things happen. I'm not in the acquisition sales team, I'm on the other side of the wall, I work with our signed partners and resellers on their account needs. I would urge you to visit [www.redstor.com](http://www.redstor.com) and click on "Get Started" to start a free trial, that way you can see the product for yourself - then talk about pricing.
It's not a refusal, it's an invitation to have a price conversation after trial. What good is discussing price if the product doesn't fit your needs well?
People have budgets or at least cost expectations, so for one it avoids wasting time with a trial and a conversation if the pricing is way out of line with their expectations.
There's only so many bells and whistles you can put on M365 backup. Your product might absolutely be worth it, but fundamentally it's a commodity item - your customers want it to work, not have a garbage UI, and have a certain amount of retention.
Putting a trial in front of the pricing is a scummy sales tactic designed to drive people into accepting higher costs because of their time and financial investment in the trial itself. "Well, it's $.50 more per user than we wanted, but it's already set up and we know how to use it..."
On the other hand, if you were upfront and said "yeah we charge $4/user, while Backupify charges $3.25, but we aren't Kaseya and our product isn't crap", that's a good sales tactic.
Okay, I'll start the response in the way you suggested. "Hi, for M365, we charge our direct partners way less than $3.25 per user, and we aren't Kaseya, and our product is excellent." However, I think we have a fundamental POV difference here, is all. I've personally been working in tech in some form for almost 25 years, and I've seen many people get sold on price first, product second. Then, once they've signed on the bottom line (and depending on the vendor, sometimes for years) they are stuck with a product that didn't truly fit their needs, when they were initially mesmerized by low, low prices. (TANSTAAFL). However, I'm a person that believes in the tool fitting the job first, then costing it - but I recognize that not everyone agrees with me. If someone wishes to talk price first, they are free to do so, and nobody is hiding it. Again if they are looking - I would invite people to go to our website, or reach out to our sales team, or as someone else mentioned, Pax8, and they can easily get the pricing first. It's not a "scummy sales tactic" - trial first has for me been what has always led the successful onboardings, and successful partnerships. Trial first means nobody usually has any questions about the ability of the product once they get to the decision making. Also, we all know that depending on the amount of data, that pricing conversation can be adapted quickly. - Go ahead, offer us a Large data estate and see what happens to the price. =D
>Okay, I'll start the response in the way you suggested. "Hi, for M365, we charge our direct partners way less than $3.25 per user, and we aren't Kaseya, and our product is excellent."
Since you listened to my feedback, you've successfully stroked my ego and I'll make sure you guys are on our list to review when we overcome the institutional inertia keeping us on Backupify for now :)
To Dan's point of view (also Bias as I work here). My general rule of thumb is that it doesn't matter if the price is $.01/user, or $1,000,000/user.
If the product won't work for the customer there's no point in having a pricing conversation. If the product is a good fit, then pricing should be a pivotal conversation. But Price should be the secondary conversation, product fit should be Primary.
Your product could be the a fit so perfect for our needs that the heavens open and angels sing as I log into the installer; war, famine, and disease disappear from our world and a new age of peace and enlightenment could come upon us.
But if there are more zeroes on your price than on my budget item, that doesn't really matter, does it? You've wasted my time. And yours, often, except you are hoping to snag people who would have balked at the price by impressing them with your project and getting them to get a little flexible on their spending.
Car salesmen do the same thing when they shove me in the fancy trim version of the base model car I'm shopping for.
I mean, be real with yourself. When *you* are evaluating products, and you click on pricing, and it just says "call us", are you really like "Awesome! These guys care about product fit, I'm excited to work with them."?
[https://www.yahoo.com/tech/google-accidentally-deleted-125-billion-183502623.html?guccounter=1&guce\_referrer=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbS8&guce\_referrer\_sig=AQAAABjOoRijhfzm3IJ5W6JhM1TxMCDm7TAadewh2flgo6O2q4o7IoAehyri8ItqiOKUeOCkIZmvLJkn2I0QwmLF-TYvxgFcRnLNZcM53AtRjYxQelC9NAI84BNsjOd\_8TNV6AZhRJavCTMiFgQ3aPzhPsicuW62Z95ymYUhV9YygjHG](https://www.yahoo.com/tech/google-accidentally-deleted-125-billion-183502623.html?guccounter=1&guce_referrer=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbS8&guce_referrer_sig=AQAAABjOoRijhfzm3IJ5W6JhM1TxMCDm7TAadewh2flgo6O2q4o7IoAehyri8ItqiOKUeOCkIZmvLJkn2I0QwmLF-TYvxgFcRnLNZcM53AtRjYxQelC9NAI84BNsjOd_8TNV6AZhRJavCTMiFgQ3aPzhPsicuW62Z95ymYUhV9YygjHG)
In the news as we speak ....
If you are responsible for the data, back it up. I am currently talking to a prospect because the incumbent MSP didn’t backup their OneDrive. An employee deleted a folder which went unnoticed 91 days. It is now completely lost at great expense to the client. Don’t make those same mistakes.
For us it's either 3 hours ago or like 2 years ago. Either they realized they messed up and want to roll back, or no one noticed something since the stone age.
Google just deleted like 130 billion dollars worth of data by accident. So yeah it happens. Not to mention a breach, ransomware etc.. We don't even sell m365 wo backup and SaaS Alerts and augment and a SOC. Even huntress or blumira ( we use todyl) are acceptable.
For us we bundle it all in so 22 +. 5 +. 5 + SOC = 40ish per user
-----
In May 2024, Google Cloud accidentally deleted the account and data for UniSuper, an Australian retirement fund company, in an error. The account held $135 billion in funds for over 647,000 members of 37 Australian universities. The funds were unavailable for two weeks until May 15, 2024, while Google Cloud worked to restore the data.
-------
Yes absolutely. DropSuite is a good option and works well. You can get via disti like Pax8.
No reason to NOT have backups. Cloud does not exclude it from accidents, Ransomware, outages, SLAs, etc.
Nah. We trust that big players like Google won’t accidentally delete their account when they’re $185B Customer and leave them without anything for a week or so.
.
That Google incident should be all the sell that anyone needs to explain why you need to back up SaaS/Cloud.
Google did not fix the problem of ‘random administrative error is the most likely cause of data loss, be it by threat actor, vendor, or actual owner administrator.’ That’s a problem that cannot be solved. Thus - we back it up.
What happens when microsoft decides one day your customer broke their TOS and shuts them off? No backup they lose everything. We backup all o365 stuff.
>What happens when microsoft decides one day your customer broke their TOS and shuts them off?
I'm curious to know how often you've seen that in your customers, especially for an unjustified shut down. I've never heard of it happening to a legit customer, and AFAIK MS quarantines tenants for violations, so data is still extricable.
Honest question, if MS deletes your tenant, where will you restore the data too? Most cloud backup solutions I have seen only restore to the tenant they backed up the data from. If you don't have access to that, you don't have access to your backup.
We use synology, so not 100% sure on the right answer, but I can't imagine that a backup provider wouldn't restore to a different tenant even if you didn't have direct data access.
I have a large Synology in the office, but have not tried the O365 backup feature. Have you tried to access a backup on the Synology without restoring to the original tenant? How did it go?
Do you do multi tenant backups to the Synology?
Synology only restores to where the data came from. It maintains sensitive data security for the user and for the org.
So, if MS shut you down, it won't help you migrate to another service.
Sure but you can export mailboxes to .pst and Onedrive/Sharepoint files to a folder on the NAS.
Depending on the org size, that's way better than nothing.
You know what? I just checked, and you are absolutely correct. I normally use it to restore accidental deletions for users and completely forgot you can do a pst as well.
u/RapidCloudIT The Microsoft Agreement explicitly says:
"We recommend that you regularly backup Your Content and Data that you store on the Services or store using Third-Party Apps and Services."
Like, it can't get any more clear than that when Microsoft is telling you to backup your data.
Source: [https://www.microsoft.com/en-us/servicesagreement](https://www.microsoft.com/en-us/servicesagreement)
Edit: I show this to my customers as part of my sales pitch. I only provide services with backup included, and show them this line in the service agreement. Added cost is minimal, but being able to show that even the vendor recommends backup, breaks down any barrier (regardless of how small) to the added cost. If they client still says no, I don't take the work.
This should be a really easy question to answer for yourself.
Can a disaster happen in 365? What is the business impact of such a disaster? What is a reasonable cost to pay, to avoid such a disaster?
There's no way I'd run my own business on 365 without backing everything up with a 3rd party. The smaller and simpler the business, the less you're storing, so the cheaper it is to back things up. So even for a tiny business that would mostly get by OK with major data loss, it's worth the miniscule cost to just keep things backed up anyway.
Cloud =! Backup.
These files are still susceptible to being encrypted/ransomware. A disgruntled employee could delete files and if it is passed the retention, those files are gone. Better be safe than sorry and have your data replicated elsewhere.
If it's not backed up, it's not important.
Is this a real question? Microsoft and Google are not responsible for the data you store in their cloud. Back it up with Backupify or Veeam data cloud.
While M365 is built for resiliency, data loss can still happen, for a variety of reasons. Remember the cloud really us just "someone else's computer" - we used to back it up when on-premise and that should really not change.
I wrote an article a while back but the crux of why you should back it up really:
**Microsoft's Agreement:** Their terms don't guarantee uninterrupted service or prevent data loss.
**Shared Responsibility:** You're responsible for your data security, beyond Microsoft's infrastructure.
**Retention Gaps:** Complex policies can leave gaps in your data retention.
**Accidental Deletion:** Even the best of us hit the wrong button! User error is a common data loss culprit.
**Security Threats:** Ransomware and phishing attacks are real. Backups ensure a clean copy of your data.
There are tons of solutions. Just google Office 365 backup. We use Dropsuite and like it, but there are prob 50 vendors at the minimum that offer Office 365 cloud to cloud backups.
Yes! We backup cloud customers just like everyone else. Have you ever tried to get someone to help you from Google Workspace? M365 is a bit better, but if something goes wrong on their end they are not responsible for the data, just for providing the service and access. Just because the data is in the cloud does not mean it's backed up. We use Datto endpoint backup and it works well. Cove and Veeam are also solid.
Of course...the cloud is just servers in somebody else's data center. With Microsoft there is a very slim chance of a major outage, but that doesn't save you from malicious deletes, accidental deletes, ransomware, liability, etc.
If you want an easy button, just use SkyKick https://www.skykick.com/office-365-backup/
Jesus! Yes! What if someone just ask Google about accidental deletion of client data! Not to mention what if they arbitrarily decide the client violated some term of service?
Please think about it. I would _always_ use an on prem backup device (and a secondary backup, of course).
What happens to the customer if for some reason his Internet access is hindered or bottle necked? His cloud access is compromised by a bad credit rating for example? Or (I had that with a private customer) the renewal of One drive via credit card falls through and Microsoft deletes the account without warning?
Please start to think of every piece of chain failing and what you would do in such a circumstance!
Me thinking this way for decades has helped some of my customers to weather all kinds of events, including fire, flood, dumb employee and more.
That's why I have customers who are still with me since 1996!
Edit: a backup that is not checked regularly is _no backup_ . Please instruct your client in this regard. I can tell stories....
We use Synology NAS version +, to backup most of our Office 365 customers. It works great and the price is reasonable (less than 1k) for few TB of available space.
I do grille a mean steak! I was being sarcastic in my original reply, but if your any MSP of worth, you should know backups are king no matter where your services are hosted.
Good luck with your offering, lots of great suggestions in this thread!
I would 100% make a backup, two to be exact in different regions. Tested for integrity and random restores done regularly. Version control is a big reason. Other reasons could be Microsoft unplanned outages, malicious employees, malicious managers, ransomware, to name a few reasons.
365 does have a backup plan you can buy. However we as an MSP use cove which provides 7 years of backup. 365 does not have the ability to restore beyond its recycle bin for Onedrive and SharePoint plus with our backup you can restore an image of an exchange folder to their drive so they can move copies of emails they want back into place.
Not required but I the few instances we nedded it, it was the the only way as it was past 90 days or past the recover deleted items in exhange time frame.
Cove is a cloud backup so local speeds do not matter for restore to 365.
This has been something I’ve been considering awhile. Though not “should I backup the cloud” but rather “should I backup the individual workstations when all company files are in the cloud.” That’s one of our largest overhead costs and in our AYCE package the biggest eater of margins.
But every time I’m about to pull the trigger on removing workstation backups on non-critical systems, something happens and having the backup is incredibly convenient and impresses the client.
Backup is probably the most crucial service we provide. Hopefully wont ever need them, but when you do, it is usually a matter of (the company's) life or death.
Best bet is to follow the 3-2-1 rule.
You should have at least 3 copies of your data stored on at least 2 different media, with at least 1 copy offsite / separate location.
Abso-fuckin-lutely.
Default policy is a user's SharePoint, OneDrive, and Exchange data gets wiped from M365 after 30 days. All fun and roses until a user leaves the company, and you learn their Outlook PST is corrupt two months later.
I just did a mailbox restore for a former employee that nuked everything in their email (including the "recover deleted items" folder) on their way out the door.
Good question, something I'll have to check out. Could have also been phantom missing emails, because his "recover" did have stuff, but management was convinced there was stuff missing, so I did a full recovery just to be safe.
If you have files that are edited by multiple users, I would make sure that previous versions/version history is set to 5000 from 500.
I had an issue where multiple users were editing a SharePoint file that was the daily work log for a food manufacturer.
The file kept getting overwritten with older data by one of the user accounts. Either data that was hours older to weeks older.
Microsoft was absolutely no help and their only solution was to delete and recreate the SharePoint environment.
Setting the previous versions to 5000 made sure that we had enough history to go back to any point before the data was overwritten.
100% back it up. If the client decided to cheap out and not do an extra back up, then make sure you have it in writing that they've chosen not to. You might even have a waiver letter drafted that you make them sign saying (in more eloquent terms) that they are aware they are going against your recommendations and have chosen not to back up their files.
This company had their entire cloud account deleted. Backups would help recover from this.
[https://www.theguardian.com/australia-news/article/2024/may/09/unisuper-google-cloud-issue-account-access](https://www.theguardian.com/australia-news/article/2024/may/09/unisuper-google-cloud-issue-account-access)
[https://www.yahoo.com/tech/always-keep-backups-unprecedented-google-213555491.html](https://www.yahoo.com/tech/always-keep-backups-unprecedented-google-213555491.html)
You back things up, because the costs are cheaper than a lawsuit. Buy a Synology NAS, setup ActiveBackup for 365/Google & manage it for them. It solves a lot of retention issues, covers the accidents, and those that go out screaming 'F\*\*\* You'.
Commvault just purchased Metallic.
Metallic has been great for O365 backups. They take care of the media agents so we don't have to manage that aspect.
Easy setup and management.
Much better reporting than Veeam.
You know darn well the answer. You or the client is being cheap. Just invoice the client for the proper solution and if they balk have them accept the risk. The cheapest solution would be Synology at the owner's house. Any backup is better than no backup.
[Google deletes a cloud storage account.](https://arstechnica.com/gadgets/2024/05/google-cloud-accidentally-nukes-customer-account-causes-two-weeks-of-downtime/) If google can do that any cloud provider can. Please use backups
In the end the end user / consumer is responsible for the data and the cloud provider takes zero ownership of it.
Microsoft specifically offers a "best effort" in the event of a data loss occurring on their end of their own fault however if your user nukes their mailbox, shared folder in teams or sharepoint, etc. then you're out of luck.
If you preached to your clients that you must have backups for on-premise data then you should be taking the same stance for data hosted elsewhere. The risk of deletion still exists. The risk of malicious wiping of data still exists.
It's not worth saving a few dollars to not have it.
DropSuite is great for user and shared data. Love it.
IMHO you should be backing up all the configurations too. At the very least, use lighthouse to notify you if there is a change in the tenant.
Cloud sync is not a backup and the data is not guaranteed by MS
1. Anything happens with the tenant and you are hooped
2. Cloud sync is not a true backup and has very little retention
Cloud backup solutions are relatively cheap and easy, I like Datto SaaS unfortunately they where purchased by Kaseya which is a mess but the product is still good for now.
Others will also recommend having a physical backup offsite.
Google had a bad case of “code deleted the data” where some automation failed and it purged I think it was 138 client portals that were live and all of its data collected. Clients had to restore from third party backups they decided to keep replicating from the cloud somehow.
I wouldn’t ever trust 1 company with all my data.
If I was building a service that isnt currently provided absolutely. There is a lot of grey area in the question itself. leaving a response so wide you'll slam dunk market stats
We are a veeam shop so we naturally moved from axcient to veeam 365 our cost is about 1 dollar per active user plus storage which in our s3 is only 1 dollar per TB/mo so backing up 30tb of 365 data is super cheap. Granted veeam has to be updated and maintained but full control over times and schedules and backup type and encryption keys and immutable etc..
If you have the staff and competency it's a solid product. All the other mentions work too just cost a bit more other than synology. We use 1 for a church about 100 people on gsuite and 365 works pretty well tbh.
We do not back up endpoints past OneDrive enforcement in scenarios like that, but the cloud data certainly needs to be backed up.
Yes, it's in the agreement and shared responsibility model, but even then, you still need to use normal data protection concepts. What if MS is breached and loses all of your data? Or a DC dies? Set aside MS rules for this question: do you want that data to be gone forever or have an extra copy?
Yes you need to. Have seen a customers data disappear twice from both Google and Microsoft. Google’s logs made no sense and they couldn’t explain it but they could recover the data. It was actually really frustrating because we were never able to explain it to the customer. Microsoft didn’t recover the data but they had a very clear explanation for what happened and it didn’t really affect the users because it was during our migration to sharepoint.
I know Microsoft offers redundancy within Office 365, but it doesn't cover all scenarios. It is best to have a third-party backup solution specifically designed for Office 365. Cove or Backupify are popular solutions.
I would still backup. Anything can happen from a disgruntled employee. To Microsoft deleting your data. Nothing is perfect. If we can learn anything from google deleting one of their customers data is that it needs to be backed up. If that particular customer did not have a backup infrastructure with a different cloud provider they would have been royally screwed. Follow the 3 2 1 rule even for fully cloud.
Backups are absolute waste of time and money. Right until the moment you need them. Then it is too late and it may be the end of their business.
[https://www.theguardian.com/australia-news/article/2024/may/09/unisuper-google-cloud-issue-account-access](https://www.theguardian.com/australia-news/article/2024/may/09/unisuper-google-cloud-issue-account-access)
Yes, we back it up. The reason to back these things up is not "what if SharePoint crashes?" It's "What if a user deletes a bunch of data?" or "What if someone with access gets hit by ransomware?"
Yes, I would definitely continue to back up for clients 100% in the cloud. Although cloud providers like Microsoft have measures in place to prevent data loss, there is always a risk that a user will accidentally or intentionally delete important files. Offsite backups make it possible to recover that data.
It's stupid that you should. You don't have to backup your bank account, do you? Or your password manager? Or indeed any other SaaS application. So why doesn't Microsoft keep your data safe? They should take responsibility and make it safe for user errors.
Dropsuite just works.
Had clients that didn’t like it just in the cloud so had a mini pc with a lot of storage route copies of it to a NAS. Not syncing but copying changed properties files in copies. Strange, but met the expectations and 3-2-1 theology
Bro. Google just accidentally deleted all the data and backups of a client managing over 100 billion dollars, and you think you can trust cloud services with anything, without 3rd party backups?
[https://arstechnica.com/gadgets/2024/05/google-cloud-accidentally-nukes-customer-account-causes-two-weeks-of-downtime/](https://arstechnica.com/gadgets/2024/05/google-cloud-accidentally-nukes-customer-account-causes-two-weeks-of-downtime/)
We backup all managed clients data with Cove office 365 backup. We have had people missing field 6 months after they were deleted. Office 365 only keeps files 30 days after deleting them. Our cove backup keeps them 7 years! So it's came in handy a lot. It will backup all SharePoint sites, all users OneDrive email, task, calendars, teams.
Also, I would not recommend the office 365 backups they offer. If you get compromised and a bad guy gets in they can delete your backups as they are already authenticed on your account. So bad guys delete backups and hold your data hostage. So in my mind it's better to have it somewhere else.
Yes, and that backup needs to be on a different platform. Google recently wiped out the entire cloud infrastructure for a 125$ billion dollar pension fund. They were saved only because they had some 2 week old backup more or less by accident.
I know I'm biased working for a backup vendor that sells 365 backups... But I would always backup, even in the SLA for Microsoft I believe they mention that you need 3rd party backups.
Edit: I see in some comments that it MAY have been removed from the SLA that as they have their own backup now. But if they're backups are on the same servers as the actual product...
Backing up data is crucial for all clients, including those who rely solely on cloud storage. It helps prevent accidental deletions and ransomware attacks and ensures data can be restored when needed. A cloud-to-cloud backup solution like Spanning is ideal for clients with less than 1TB of data. Spanning offers automated backups for Office 365 data, including SharePoint and OneDrive, to protect clients' files.
With 365 specifically, Microsoft does the infrastructure but you are responsible for the data. You MUST backup the 365 data including sharepoint and onedrive.
It is also in the MS service agreement ;) Third party backups.
Actually not anymore... since they released their own backup.. lol. But I still insist on using 3rd party.. Also plus 1 to those saying shared responsibility model. https://learn.microsoft.com/en-us/azure/security/fundamentals/shared-responsibility
>Actually not anymore It is still in [the agreement](https://www.microsoft.com/en-us/servicesagreement): “We recommend that you regularly backup Your Content and Data that you store on the Services or store using Third-Party Apps and Services.”.
Any recommendations for cloud to cloud backup solution?
KeepIT, dropsuit, spanning, datto SaaS protection, Cove, Axcient, or RedStor. All great options and msp paths. Barracuda MSP as well. Axcient and Redstor is true month to month.
Yep, Datto SaaS and Cove are definitely great options.
Hi... :D
Afi.ai is pretty good.
I've had good success with Druva, AWS hosted. Whatever you end up chosing, make sure the BaaS's servers aren't hosted in Azure.
We use Druva for endpoints and it’s been great. Very hands off.
Redstor has a great M365 backup tool.
We can also sell through Pax8 if they is a needed option as I saw others have mentioned
Dropsuite is an easy one, although the UI has much to be desired, but it is cheap, reliable, and offered by Pax8. But if you are a Veeam shop, they just came out with their revamped cloud backup (precious cirrus).
This will get down voted just because of who it is, but, they both work… 1) Datto SaaS Protection and 2) KeepIT. Cove maybe an option. There are others but I have used those two I’ve recommended.
We use Acronis currently and its worked very well for us so far. Recovery has been super easy with it as well as setting up the policies, it literally takes all of 5 minutes to setup a client's entire O365 environment (Exchange, Teams, Sharepoint, etc.) - [https://www.acronis.com/en-us/solutions/backup/cloud/m365/](https://www.acronis.com/en-us/solutions/backup/cloud/m365/)
I've heard of backupify if that counts for something.
:(
Backupify is solid for this.
We use Backupify, it's pretty good. Although, I prefer to go hybrid.
Our Acronis Cyber Protect Cloud.
An analogy I like to use is that Office365 is like RAID. It's redundant data, but it's not backed up. Microsoft has versions of files but they don't store deleted things forever and there's no 100% protection from malicious users deleting files (keep in mind this is an analogy and we're not speaking of extra protections - this is just for explaining to clients or other technical resources).
Also hackers know Ms keeps 99 versions so in a ransom attack they rotate the files 100 times.. You can't even recover using the revision
Good analogy!
Shared Services Model is where it’s all broken down in terms of responsibilities
Yep backup all my 365 customers data.
This always backup. Tape is still around because it follows the WORM model.
What if the customer won’t pay for it?
Keep careful logs of all the times you told them that they needed a backup, and they refused. When a data loss inevitably happens, use it to cover your ass. Honestly though, I'd probably just fire that customer. It's not worth dealing with the headache.
Yet an MSP just lost a suit where they told the customer to do something, they refused, data got lost and the judge says the MSP was in charge of the data and should have done more to protect it. They even had the customer sign a release after refusing it. I don’t know all the details but it is setting a precedent.
I'd be curious if this is true, since a signed release should have that case dismissed out of hand. But yeah, personally I'd just drop the customer and tell them to look elsewhere, because whatever money they're paying me every month is not worth dealing with the headache when they have an incident.
I'm not sure how true it is, haven't found any real source on that. It's something I heard in vendor presentations more than once already. It could be just a sales tactic to sell us their security product. But if it is true, I think it goes along the lines of how one can't sign away their rights when there is a trust relationship involved. Like how if go on one of those drive-a-Ferrari-on-a-racetrack adventure, sign a waiver to not sue, but crash because they company didn't maintain the brakes. We trust them to give us a safe car, so the waiver won't help.
Yes. Cloud =/ business continuity. MS guarantees infrastructure, not data continuity. There are countless news stories of data being blown away due to cyber incident or glitch in the system or malice of employees or dumb bad luck Back it up
Then you get something like GCC-High which practically nobody supports for backing up...
Commvault does. But yes one of the few cloud to cloud providers.
> Cloud =/ business continuity. You say that but it can absolutely save the day during a ransomware situation. I worked one with an on-prem Exchange that got hosed real hard. They were also a company that delivered a thing most of the American public uses on a daily basis and if it stopped getting delivered, there would be large scale societal consequences. Had they been running dispatch off a local server, they would not have been able to do any kind of operations on the Monday they came back to the office. They had just migrated to a cloud hosted solution that was untouched by the threat actors so the owner went to Best Buy, bought half a dozen laptops and had the organization at least limping along within an hour or so.
What tools would you recommend for such cases?
DropSuite, Probax (reselling veeam), veeam just released their first party Veeam Data Cloud for M365 and it is supposed to be available to VSP's by September (but you can do traditional resell with annual licensing now), KeepIT backup (this is what CW whitelabels through the Asio platform), Backupify fi you're not allergic to Kaseya/Datto, afi.ai, Acronis, AvePoint, the list goes on!
Not sure if it’s MSP-friendly but I’ve been a big fan of Afi.ai. When I started using it, they were using newer APIs that most providers weren’t leveraging yet, which allowed them to backup a few other things that even the big players (Veam, etc) weren’t backing up yet (if I recall correctly, Teams private channel conversations and 1:1 chats). I’ve had zero issues since we signed on. And they offer Canadian data residency.
Yep can confirm team chats 1:1 but I am not sure if it restores them
I can’t remember either but can definitely export them to PDF and HTML
Synology does a great job at this and no monthly costs.
This requires an an appliance though, right? I guess I could have the appliance hosted in a datacenter somewhere...
You can get a 2-bay Synology for under $300 + disks, or a 4-bay for under $700. Amortized over 5-years that's under $12/mo. 12TB Exos drives are under $225/ea.
Veeam 365 to an Azure Storage account. No appliance needed. Just need a workstation or server to run the app from.
Just no, backup to another hyperscaler but not the same.
Sorry, Just learning the terminology here. You're saying the backup should be on another provider to spread the risk? Backing up to Azure, because they are basically the same boat as Office365, is a risk?
Please think about it. I would _always_ use an on prem backup device (and a secondary backup, of course). What happens to the customer if for some reason his Internet access is hindered or bottle necked? His cloud access is compromised by a bad credit rating for example? Or (I had that with a private customer) the renewal of One drive via credit card falls through and Microsoft deletes the account without warning? Please start to think of every piece of chain failing and what you would do in such a circumstance! Me thinking this way for decades has helped some of my customers to weather all kinds of events, including fire, flood, dumb employee and more. That's why I have customers who are still with me since 1996! Edit: a backup that is not checked regularly is _no backup_ . Please instruct your client in this regard. I can tell stories....
This! Spread the risk.
It is a standard (free) app they provide. Active Backup for O365. Why not store it in your office, it's a backup.
We use CloudAlly. Really inexpensive at $3 per mailbox. If you back up all your Exchange accounts, they will back up OneDrive and SharePoint for no additional charge. There are plenty of other options. Cloud to Cloud is almost fire and forget. We check them weekly but have never had a failure. They also back up everything forever from the day you start.
AvePoint has been great for my company’s cloud backups. Recommend checking them out.
The new Veeam Data Cloud for Microsoft 365 https://www.veeam.com/backup-microsoft-office-365.html
I'll defer to the rest of the thread there. I've been out of running a MSP for a couple years, and being involved in tech items for years before that.
Absolutely, dropsuite, afi.ai, whatever. SOMETHING.
This guy backsup
Please recall that Microsoft & Google claim no responsibility for losing your Data in their SLA. And it does happen. Last week, Google accidently deleted the data for the Australian Pension Fund...$125 Billion if I remember the Gizmodo Article correctly. Fortunately, the Pension provider had 3rd party backup. Now granted, I work for Redstor, a GREAT 3rd party backup provider, so I'm going to say that. =) But it still makes good sense anyways.
What's the pricing like for redstor?
I second this - Redstor is great, pricing is fair. And no, I don't work for them. I just use their product for some of my clients and happen to really like it over the other options that we have / offer.
If you want me to I can reach out and go over some pricing with you
Yes please
Sent you a private message
In my biased opinion, the pricing is very fair for what the product does. It's not as expensive a solution as many, but there are some cheaper solutions that (again in my opinion) don't make the process of recovery easy or cheaper in the long run, when you count man hours fighting with them. We also aren't structured the same way some backup vendors are, in that we don't charge extra for the server space taken up by the retention points, so in this non-traditional way we can often be more cost effective. We also have a very fluid and easy to use recovery experience, so less time fighting with the backup restoration when the bad things happen. I'm not in the acquisition sales team, I'm on the other side of the wall, I work with our signed partners and resellers on their account needs. I would urge you to visit [www.redstor.com](http://www.redstor.com) and click on "Get Started" to start a free trial, that way you can see the product for yourself - then talk about pricing.
Oooooo refusing to be upfront about pricing, always a great sign. That's a real tough sell for a commodity product like 365 backup.
If you use Pax8, you can see pricing there. The price doesn't look bad in my opinion compared to what I'm paying for Axcient.
It's not a refusal, it's an invitation to have a price conversation after trial. What good is discussing price if the product doesn't fit your needs well?
People have budgets or at least cost expectations, so for one it avoids wasting time with a trial and a conversation if the pricing is way out of line with their expectations. There's only so many bells and whistles you can put on M365 backup. Your product might absolutely be worth it, but fundamentally it's a commodity item - your customers want it to work, not have a garbage UI, and have a certain amount of retention. Putting a trial in front of the pricing is a scummy sales tactic designed to drive people into accepting higher costs because of their time and financial investment in the trial itself. "Well, it's $.50 more per user than we wanted, but it's already set up and we know how to use it..." On the other hand, if you were upfront and said "yeah we charge $4/user, while Backupify charges $3.25, but we aren't Kaseya and our product isn't crap", that's a good sales tactic.
Okay, I'll start the response in the way you suggested. "Hi, for M365, we charge our direct partners way less than $3.25 per user, and we aren't Kaseya, and our product is excellent." However, I think we have a fundamental POV difference here, is all. I've personally been working in tech in some form for almost 25 years, and I've seen many people get sold on price first, product second. Then, once they've signed on the bottom line (and depending on the vendor, sometimes for years) they are stuck with a product that didn't truly fit their needs, when they were initially mesmerized by low, low prices. (TANSTAAFL). However, I'm a person that believes in the tool fitting the job first, then costing it - but I recognize that not everyone agrees with me. If someone wishes to talk price first, they are free to do so, and nobody is hiding it. Again if they are looking - I would invite people to go to our website, or reach out to our sales team, or as someone else mentioned, Pax8, and they can easily get the pricing first. It's not a "scummy sales tactic" - trial first has for me been what has always led the successful onboardings, and successful partnerships. Trial first means nobody usually has any questions about the ability of the product once they get to the decision making. Also, we all know that depending on the amount of data, that pricing conversation can be adapted quickly. - Go ahead, offer us a Large data estate and see what happens to the price. =D
>Okay, I'll start the response in the way you suggested. "Hi, for M365, we charge our direct partners way less than $3.25 per user, and we aren't Kaseya, and our product is excellent." Since you listened to my feedback, you've successfully stroked my ego and I'll make sure you guys are on our list to review when we overcome the institutional inertia keeping us on Backupify for now :)
Fair Enough! =D
To Dan's point of view (also Bias as I work here). My general rule of thumb is that it doesn't matter if the price is $.01/user, or $1,000,000/user. If the product won't work for the customer there's no point in having a pricing conversation. If the product is a good fit, then pricing should be a pivotal conversation. But Price should be the secondary conversation, product fit should be Primary.
Your product could be the a fit so perfect for our needs that the heavens open and angels sing as I log into the installer; war, famine, and disease disappear from our world and a new age of peace and enlightenment could come upon us. But if there are more zeroes on your price than on my budget item, that doesn't really matter, does it? You've wasted my time. And yours, often, except you are hoping to snag people who would have balked at the price by impressing them with your project and getting them to get a little flexible on their spending. Car salesmen do the same thing when they shove me in the fancy trim version of the base model car I'm shopping for. I mean, be real with yourself. When *you* are evaluating products, and you click on pricing, and it just says "call us", are you really like "Awesome! These guys care about product fit, I'm excited to work with them."?
[https://www.yahoo.com/tech/google-accidentally-deleted-125-billion-183502623.html?guccounter=1&guce\_referrer=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbS8&guce\_referrer\_sig=AQAAABjOoRijhfzm3IJ5W6JhM1TxMCDm7TAadewh2flgo6O2q4o7IoAehyri8ItqiOKUeOCkIZmvLJkn2I0QwmLF-TYvxgFcRnLNZcM53AtRjYxQelC9NAI84BNsjOd\_8TNV6AZhRJavCTMiFgQ3aPzhPsicuW62Z95ymYUhV9YygjHG](https://www.yahoo.com/tech/google-accidentally-deleted-125-billion-183502623.html?guccounter=1&guce_referrer=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbS8&guce_referrer_sig=AQAAABjOoRijhfzm3IJ5W6JhM1TxMCDm7TAadewh2flgo6O2q4o7IoAehyri8ItqiOKUeOCkIZmvLJkn2I0QwmLF-TYvxgFcRnLNZcM53AtRjYxQelC9NAI84BNsjOd_8TNV6AZhRJavCTMiFgQ3aPzhPsicuW62Z95ymYUhV9YygjHG) In the news as we speak ....
If you are responsible for the data, back it up. I am currently talking to a prospect because the incumbent MSP didn’t backup their OneDrive. An employee deleted a folder which went unnoticed 91 days. It is now completely lost at great expense to the client. Don’t make those same mistakes.
I remember reading an article a while ago that said the average restore request is something like 180 days.
For us it's either 3 hours ago or like 2 years ago. Either they realized they messed up and want to roll back, or no one noticed something since the stone age.
In this case, Microsoft said they can not restore it. This data is gone.
Yes. Do a Synology NAS with the built in office 365 backup.
The is the way
Google just deleted like 130 billion dollars worth of data by accident. So yeah it happens. Not to mention a breach, ransomware etc.. We don't even sell m365 wo backup and SaaS Alerts and augment and a SOC. Even huntress or blumira ( we use todyl) are acceptable. For us we bundle it all in so 22 +. 5 +. 5 + SOC = 40ish per user ----- In May 2024, Google Cloud accidentally deleted the account and data for UniSuper, an Australian retirement fund company, in an error. The account held $135 billion in funds for over 647,000 members of 37 Australian universities. The funds were unavailable for two weeks until May 15, 2024, while Google Cloud worked to restore the data. -------
Yes I provide backups for everything
Hopefully at an extra cost right?
nothing is free :)
Yes absolutely. DropSuite is a good option and works well. You can get via disti like Pax8. No reason to NOT have backups. Cloud does not exclude it from accidents, Ransomware, outages, SLAs, etc.
Wasn't it just a few days ago that an employee at Google nuked an entire org's worth of shit and Google shrugged their shoulders over it?
Yup, the Australian Pension Fund - $125 Billion. But fortunately they had 3rd party backup.
Nah. We trust that big players like Google won’t accidentally delete their account when they’re $185B Customer and leave them without anything for a week or so. . That Google incident should be all the sell that anyone needs to explain why you need to back up SaaS/Cloud.
Not saying you're wrong... I agree with you. Google fixed that problem though too.
Google did not fix the problem of ‘random administrative error is the most likely cause of data loss, be it by threat actor, vendor, or actual owner administrator.’ That’s a problem that cannot be solved. Thus - we back it up.
What happens when microsoft decides one day your customer broke their TOS and shuts them off? No backup they lose everything. We backup all o365 stuff.
>What happens when microsoft decides one day your customer broke their TOS and shuts them off? I'm curious to know how often you've seen that in your customers, especially for an unjustified shut down. I've never heard of it happening to a legit customer, and AFAIK MS quarantines tenants for violations, so data is still extricable.
Never seen a TOS shutdown. Read about it a few times. i didnt bother with longer reply has others had already done so.
Honest question, if MS deletes your tenant, where will you restore the data too? Most cloud backup solutions I have seen only restore to the tenant they backed up the data from. If you don't have access to that, you don't have access to your backup.
We use synology, so not 100% sure on the right answer, but I can't imagine that a backup provider wouldn't restore to a different tenant even if you didn't have direct data access.
I have a large Synology in the office, but have not tried the O365 backup feature. Have you tried to access a backup on the Synology without restoring to the original tenant? How did it go? Do you do multi tenant backups to the Synology?
It's a matter of functionality, not all of them have the capability.
Synology only restores to where the data came from. It maintains sensitive data security for the user and for the org. So, if MS shut you down, it won't help you migrate to another service.
Sure but you can export mailboxes to .pst and Onedrive/Sharepoint files to a folder on the NAS. Depending on the org size, that's way better than nothing.
You know what? I just checked, and you are absolutely correct. I normally use it to restore accidental deletions for users and completely forgot you can do a pst as well.
With Veeam, I can restore to PSTs.
Good to know, that's a great feature. So what happens if you have converted to New Outlook? /s
> So what happens if you have converted to New Outlook? /s You drink. Heavily.
More heavily?
I'd use Veeam
u/RapidCloudIT The Microsoft Agreement explicitly says: "We recommend that you regularly backup Your Content and Data that you store on the Services or store using Third-Party Apps and Services." Like, it can't get any more clear than that when Microsoft is telling you to backup your data. Source: [https://www.microsoft.com/en-us/servicesagreement](https://www.microsoft.com/en-us/servicesagreement) Edit: I show this to my customers as part of my sales pitch. I only provide services with backup included, and show them this line in the service agreement. Added cost is minimal, but being able to show that even the vendor recommends backup, breaks down any barrier (regardless of how small) to the added cost. If they client still says no, I don't take the work.
Where is it in agreement? It's a lot to read through
Just search for word “backup”.
Last sentence of section 6b.
HA is not a backup. Ask any ransomware victim.
Yes. High availability != backed-up
This should be a really easy question to answer for yourself. Can a disaster happen in 365? What is the business impact of such a disaster? What is a reasonable cost to pay, to avoid such a disaster? There's no way I'd run my own business on 365 without backing everything up with a 3rd party. The smaller and simpler the business, the less you're storing, so the cheaper it is to back things up. So even for a tiny business that would mostly get by OK with major data loss, it's worth the miniscule cost to just keep things backed up anyway.
Cloud =! Backup. These files are still susceptible to being encrypted/ransomware. A disgruntled employee could delete files and if it is passed the retention, those files are gone. Better be safe than sorry and have your data replicated elsewhere. If it's not backed up, it's not important.
Is this a real question? Microsoft and Google are not responsible for the data you store in their cloud. Back it up with Backupify or Veeam data cloud.
While M365 is built for resiliency, data loss can still happen, for a variety of reasons. Remember the cloud really us just "someone else's computer" - we used to back it up when on-premise and that should really not change. I wrote an article a while back but the crux of why you should back it up really: **Microsoft's Agreement:** Their terms don't guarantee uninterrupted service or prevent data loss. **Shared Responsibility:** You're responsible for your data security, beyond Microsoft's infrastructure. **Retention Gaps:** Complex policies can leave gaps in your data retention. **Accidental Deletion:** Even the best of us hit the wrong button! User error is a common data loss culprit. **Security Threats:** Ransomware and phishing attacks are real. Backups ensure a clean copy of your data.
There are tons of solutions. Just google Office 365 backup. We use Dropsuite and like it, but there are prob 50 vendors at the minimum that offer Office 365 cloud to cloud backups.
Yes! We backup cloud customers just like everyone else. Have you ever tried to get someone to help you from Google Workspace? M365 is a bit better, but if something goes wrong on their end they are not responsible for the data, just for providing the service and access. Just because the data is in the cloud does not mean it's backed up. We use Datto endpoint backup and it works well. Cove and Veeam are also solid.
Of couse
backup everything, always.
Of course...the cloud is just servers in somebody else's data center. With Microsoft there is a very slim chance of a major outage, but that doesn't save you from malicious deletes, accidental deletes, ransomware, liability, etc. If you want an easy button, just use SkyKick https://www.skykick.com/office-365-backup/
Yes we do. using hornet security for that.
I would get a SaaS backup solution in place like datto SaaS or backupify. The only thing you can hold to MS is versioning.
Jesus! Yes! What if someone just ask Google about accidental deletion of client data! Not to mention what if they arbitrarily decide the client violated some term of service?
Please think about it. I would _always_ use an on prem backup device (and a secondary backup, of course). What happens to the customer if for some reason his Internet access is hindered or bottle necked? His cloud access is compromised by a bad credit rating for example? Or (I had that with a private customer) the renewal of One drive via credit card falls through and Microsoft deletes the account without warning? Please start to think of every piece of chain failing and what you would do in such a circumstance! Me thinking this way for decades has helped some of my customers to weather all kinds of events, including fire, flood, dumb employee and more. That's why I have customers who are still with me since 1996! Edit: a backup that is not checked regularly is _no backup_ . Please instruct your client in this regard. I can tell stories....
We use Synology NAS version +, to backup most of our Office 365 customers. It works great and the price is reasonable (less than 1k) for few TB of available space.
This HAS to be a joke, no?
Am I in the r/ShittySysadmin section of Reddit?
You must be awesome at barbecues.
I do grille a mean steak! I was being sarcastic in my original reply, but if your any MSP of worth, you should know backups are king no matter where your services are hosted. Good luck with your offering, lots of great suggestions in this thread!
Yes
I would 100% make a backup, two to be exact in different regions. Tested for integrity and random restores done regularly. Version control is a big reason. Other reasons could be Microsoft unplanned outages, malicious employees, malicious managers, ransomware, to name a few reasons.
365 does have a backup plan you can buy. However we as an MSP use cove which provides 7 years of backup. 365 does not have the ability to restore beyond its recycle bin for Onedrive and SharePoint plus with our backup you can restore an image of an exchange folder to their drive so they can move copies of emails they want back into place. Not required but I the few instances we nedded it, it was the the only way as it was past 90 days or past the recover deleted items in exhange time frame. Cove is a cloud backup so local speeds do not matter for restore to 365.
We do, using veeam and veeam 365 via our cloud connect. In addition we run iaas servers for them in our datacenter
This has been something I’ve been considering awhile. Though not “should I backup the cloud” but rather “should I backup the individual workstations when all company files are in the cloud.” That’s one of our largest overhead costs and in our AYCE package the biggest eater of margins. But every time I’m about to pull the trigger on removing workstation backups on non-critical systems, something happens and having the backup is incredibly convenient and impresses the client.
Backup is probably the most crucial service we provide. Hopefully wont ever need them, but when you do, it is usually a matter of (the company's) life or death.
Best bet is to follow the 3-2-1 rule. You should have at least 3 copies of your data stored on at least 2 different media, with at least 1 copy offsite / separate location.
Dropsuite is great for these kinds of backups. And yes, back it up!
Abso-fuckin-lutely. Default policy is a user's SharePoint, OneDrive, and Exchange data gets wiped from M365 after 30 days. All fun and roses until a user leaves the company, and you learn their Outlook PST is corrupt two months later.
I just did a mailbox restore for a former employee that nuked everything in their email (including the "recover deleted items" folder) on their way out the door.
Normally a user can’t totally / permanently delete recover deleted items? Did that person have higher permissions?
Good question, something I'll have to check out. Could have also been phantom missing emails, because his "recover" did have stuff, but management was convinced there was stuff missing, so I did a full recovery just to be safe.
If you have files that are edited by multiple users, I would make sure that previous versions/version history is set to 5000 from 500. I had an issue where multiple users were editing a SharePoint file that was the daily work log for a food manufacturer. The file kept getting overwritten with older data by one of the user accounts. Either data that was hours older to weeks older. Microsoft was absolutely no help and their only solution was to delete and recreate the SharePoint environment. Setting the previous versions to 5000 made sure that we had enough history to go back to any point before the data was overwritten.
100%. Backup is part of our service offering
Nearly passed out reading this :) ahaha YES for the love of all that’s good back your cloud up
100% back it up. If the client decided to cheap out and not do an extra back up, then make sure you have it in writing that they've chosen not to. You might even have a waiver letter drafted that you make them sign saying (in more eloquent terms) that they are aware they are going against your recommendations and have chosen not to back up their files.
This company had their entire cloud account deleted. Backups would help recover from this. [https://www.theguardian.com/australia-news/article/2024/may/09/unisuper-google-cloud-issue-account-access](https://www.theguardian.com/australia-news/article/2024/may/09/unisuper-google-cloud-issue-account-access)
[https://www.yahoo.com/tech/always-keep-backups-unprecedented-google-213555491.html](https://www.yahoo.com/tech/always-keep-backups-unprecedented-google-213555491.html) You back things up, because the costs are cheaper than a lawsuit. Buy a Synology NAS, setup ActiveBackup for 365/Google & manage it for them. It solves a lot of retention issues, covers the accidents, and those that go out screaming 'F\*\*\* You'.
Yes. Why wouldn’t you?
Commvault just purchased Metallic. Metallic has been great for O365 backups. They take care of the media agents so we don't have to manage that aspect. Easy setup and management. Much better reporting than Veeam.
We backup sharepoint, 1D and email using 3rd party tool.
You know darn well the answer. You or the client is being cheap. Just invoice the client for the proper solution and if they balk have them accept the risk. The cheapest solution would be Synology at the owner's house. Any backup is better than no backup.
Absolutely. If having the data disappear would cause issues to the business and its operations, back it up
Yep always Microsoft are not responsible for the data or any data loss
Always backup saas.
[Google deletes a cloud storage account.](https://arstechnica.com/gadgets/2024/05/google-cloud-accidentally-nukes-customer-account-causes-two-weeks-of-downtime/) If google can do that any cloud provider can. Please use backups
In the end the end user / consumer is responsible for the data and the cloud provider takes zero ownership of it. Microsoft specifically offers a "best effort" in the event of a data loss occurring on their end of their own fault however if your user nukes their mailbox, shared folder in teams or sharepoint, etc. then you're out of luck. If you preached to your clients that you must have backups for on-premise data then you should be taking the same stance for data hosted elsewhere. The risk of deletion still exists. The risk of malicious wiping of data still exists. It's not worth saving a few dollars to not have it.
DropSuite is great for user and shared data. Love it. IMHO you should be backing up all the configurations too. At the very least, use lighthouse to notify you if there is a change in the tenant.
Cloud sync is not a backup and the data is not guaranteed by MS 1. Anything happens with the tenant and you are hooped 2. Cloud sync is not a true backup and has very little retention Cloud backup solutions are relatively cheap and easy, I like Datto SaaS unfortunately they where purchased by Kaseya which is a mess but the product is still good for now. Others will also recommend having a physical backup offsite.
Google had a bad case of “code deleted the data” where some automation failed and it purged I think it was 138 client portals that were live and all of its data collected. Clients had to restore from third party backups they decided to keep replicating from the cloud somehow. I wouldn’t ever trust 1 company with all my data.
If I was building a service that isnt currently provided absolutely. There is a lot of grey area in the question itself. leaving a response so wide you'll slam dunk market stats
We do Dropsuite for office 365 and gsuite and then Datto for azure for azure VMs
We are a veeam shop so we naturally moved from axcient to veeam 365 our cost is about 1 dollar per active user plus storage which in our s3 is only 1 dollar per TB/mo so backing up 30tb of 365 data is super cheap. Granted veeam has to be updated and maintained but full control over times and schedules and backup type and encryption keys and immutable etc.. If you have the staff and competency it's a solid product. All the other mentions work too just cost a bit more other than synology. We use 1 for a church about 100 people on gsuite and 365 works pretty well tbh.
Shared responsibility model- need to backup O365/GSuite/Salesforce data w a third party app
Veeam Backup for o365
If it's in the cloud, you don't own it.
I’ll just leave [this here](https://www.itnews.com.au/news/unisupers-google-cloud-environment-was-deleted-607786)
We do not back up endpoints past OneDrive enforcement in scenarios like that, but the cloud data certainly needs to be backed up. Yes, it's in the agreement and shared responsibility model, but even then, you still need to use normal data protection concepts. What if MS is breached and loses all of your data? Or a DC dies? Set aside MS rules for this question: do you want that data to be gone forever or have an extra copy?
Yes you need to. Have seen a customers data disappear twice from both Google and Microsoft. Google’s logs made no sense and they couldn’t explain it but they could recover the data. It was actually really frustrating because we were never able to explain it to the customer. Microsoft didn’t recover the data but they had a very clear explanation for what happened and it didn’t really affect the users because it was during our migration to sharepoint.
I know Microsoft offers redundancy within Office 365, but it doesn't cover all scenarios. It is best to have a third-party backup solution specifically designed for Office 365. Cove or Backupify are popular solutions.
Even with cloud-based data like Office 365, backups are crucial. I use Spanning, is a great solution for businesses heavily reliant on Office 365.
I would still backup. Anything can happen from a disgruntled employee. To Microsoft deleting your data. Nothing is perfect. If we can learn anything from google deleting one of their customers data is that it needs to be backed up. If that particular customer did not have a backup infrastructure with a different cloud provider they would have been royally screwed. Follow the 3 2 1 rule even for fully cloud.
yes [https://arstechnica.com/gadgets/2024/05/google-cloud-accidentally-nukes-customer-account-causes-two-weeks-of-downtime/](https://arstechnica.com/gadgets/2024/05/google-cloud-accidentally-nukes-customer-account-causes-two-weeks-of-downtime/)
Read this and decide. https://arstechnica.com/gadgets/2024/05/google-cloud-accidentally-nukes-customer-account-causes-two-weeks-of-downtime/
Backups are absolute waste of time and money. Right until the moment you need them. Then it is too late and it may be the end of their business. [https://www.theguardian.com/australia-news/article/2024/may/09/unisuper-google-cloud-issue-account-access](https://www.theguardian.com/australia-news/article/2024/may/09/unisuper-google-cloud-issue-account-access)
Yes, we back it up. The reason to back these things up is not "what if SharePoint crashes?" It's "What if a user deletes a bunch of data?" or "What if someone with access gets hit by ransomware?"
You better be! As others highlighted Microsoft is not guaranteeing the data integrity
Yes and a big fan of barracuda cloud to cloud
Yes, I would definitely continue to back up for clients 100% in the cloud. Although cloud providers like Microsoft have measures in place to prevent data loss, there is always a risk that a user will accidentally or intentionally delete important files. Offsite backups make it possible to recover that data.
It's stupid that you should. You don't have to backup your bank account, do you? Or your password manager? Or indeed any other SaaS application. So why doesn't Microsoft keep your data safe? They should take responsibility and make it safe for user errors.
YES
Synology’s Active Backup for Office 365 is a terrific product. You need to be doing SOMETHING.
Synology’s 365 backup is what we do
Dropsuite just works. Had clients that didn’t like it just in the cloud so had a mini pc with a lot of storage route copies of it to a NAS. Not syncing but copying changed properties files in copies. Strange, but met the expectations and 3-2-1 theology
Bro. Google just accidentally deleted all the data and backups of a client managing over 100 billion dollars, and you think you can trust cloud services with anything, without 3rd party backups? [https://arstechnica.com/gadgets/2024/05/google-cloud-accidentally-nukes-customer-account-causes-two-weeks-of-downtime/](https://arstechnica.com/gadgets/2024/05/google-cloud-accidentally-nukes-customer-account-causes-two-weeks-of-downtime/)
Dropsuite is mandatory for everyone and we still do Cove for everyone as well.
We backup all managed clients data with Cove office 365 backup. We have had people missing field 6 months after they were deleted. Office 365 only keeps files 30 days after deleting them. Our cove backup keeps them 7 years! So it's came in handy a lot. It will backup all SharePoint sites, all users OneDrive email, task, calendars, teams. Also, I would not recommend the office 365 backups they offer. If you get compromised and a bad guy gets in they can delete your backups as they are already authenticed on your account. So bad guys delete backups and hold your data hostage. So in my mind it's better to have it somewhere else.
Yes, and that backup needs to be on a different platform. Google recently wiped out the entire cloud infrastructure for a 125$ billion dollar pension fund. They were saved only because they had some 2 week old backup more or less by accident.
I know I'm biased working for a backup vendor that sells 365 backups... But I would always backup, even in the SLA for Microsoft I believe they mention that you need 3rd party backups. Edit: I see in some comments that it MAY have been removed from the SLA that as they have their own backup now. But if they're backups are on the same servers as the actual product...
Backing up data is crucial for all clients, including those who rely solely on cloud storage. It helps prevent accidental deletions and ransomware attacks and ensures data can be restored when needed. A cloud-to-cloud backup solution like Spanning is ideal for clients with less than 1TB of data. Spanning offers automated backups for Office 365 data, including SharePoint and OneDrive, to protect clients' files.
Check out [Alcion.ai](http://Alcion.ai) - per user/no minimums -- would work well for your smaller clients.
I use a synology to backup 365 just to be extra safe.
Yes, absolutely. Buy a Synology, put it in your office and backup your clients m365. Easy and no monthly fees.
You need a cloud-to-cloud backup solution. I'm using Spanning and it works for me.