Why back up Office 365, and how?

OneDrive isn’t a backup, so how do you choose the best Office 365 backup solution? Many people think Office 365 backs up their data for them automatically. This leaves thousands of UK companies and other organisations at risk of data loss they might potentially never recover from.

This page will tell you why Office 365’s data retention policies aren’t enough; what to look for in your Office 365 third-party backup solution; and the key features of the market-leading products.

Three reasons why every business should back up its data

Remember that business data doesn’t just mean the files you create. It also means your emails and all your contacts, your calendars, your user profiles and everything you talk about in Teams. There are three good reasons why every business should back up all this data.

You need to save certain files to comply with laws and regulations

There are numerous laws in the UK about keeping old data for years. For example, you have to keep all receipts you use for reclaiming VAT for 4 years in case HMRC wants to check them. You also have to keep all your bank statements for 6 years in case of an inspection by the Inland Revenue. Many industries have a long list of other requirements relating to specific data they must save. Data protection laws also say that you must be able to recover lost data about customers, as well as prevent it getting stolen.

Backups can save the day if your data gets corrupted or destroyed

Data loss or data corruption tends to be catastrophic for most businesses. This could be caused by ransomware or human error.
Research by the British Chambers of Commerce found that 93% of businesses which suffer a data loss for more than 10 days file for bankruptcy within one year. Half of these companies actually have to file for bankruptcy immediately.

Do you think cyber attacks, like ransomware, are not likely to happen to your company? Actually, the statistics say your company is more likely to suffer a cyber attack than not! The government reported that 65% of all UK companies suffered a cyber attack in 2021 and more than half of them suffered repeat attacks every month.

With proper backups you can keep working if there’s server downtime

We tend to see Microsoft as infallible but actually, in September and October 2020 it had a massive server outage and organisations across large areas of Europe couldn’t access their Office 365 data for more than a week. How would your business be affected if that happened to you?

Businesses with their data on third-party backups carried on working, while their competitors were unable even to check their emails or work at all.

One Drive doesn’t back up automatically

Some people ask us: But surely Office 365 automatically backs up my data on OneDrive? The simple answer is, no. Microsoft 365 doesn’t make a backup of your data on OneDrive.

Microsoft 365 retention is not sufficient if you are running a business. Microsoft itself recommends third-party backups of Office365, and this is embedded in the user agreement.

What are the main risks of NOT getting third-party backups of your Office 365 data?

Is all your business data on OneDrive? And nowhere else? These are some of the risks you are taking as an organisation:

If Microsoft servers have downtime, you won’t be able to work unless you have a separate backup.

The Microsoft services agreement makes it clear that in case of outages or disruptions, Microsoft is not responsible for your data. It’s all on you!

Limited storage time

Office 365 only retains your content data (the files you have made and received in Word, Excel and so on) on OneDrive for 30 days after you put them in the recycle bin. After that, your old bank statements and other data are gone forever.

You can’t choose when to roll back to.

Suppose your mailbox got infected with malware. You cannot roll back to a specific point in time of your choosing – before the malware arrived – to get a “clean” version of your mailbox.

Microsoft stores your OneDrive data in one physical place.

That’s not good if there’s a fire or flood in the data centre.

You aren’t protected from Ransomware.

If your business suffers a ransomware attack, you could lose your data or have to pay money to criminals – and many companies pay the money but still never get their data back. Third-party backup is the only way to recover your data if you fall victim to ransomware encryption.

Restoring certain data destroys what you’ve got.

When you restore older files from a SharePoint backup, the restore is targeted at the same URL – meaning it will overwrite whatever data currently exists in the same location. What’s worse, there’s no rollback option so you can’t undo the restore if employees tell you they needed the newer work more than the backup.

Recovery is very complicated in Office 365.

Office 365 recovery has lots of steps and conditions.

People leaving your company keep costing you money.

When employees leave your company, you can save money on their user license by deactivating their account. Except when you do that, you also lose all the files they ever made. With third-party backup you can easily archive all the files created by people who leave.

Multiple servers (Source Wikimedia Commons)

What should I look for in a product or provider that backs up my Office 365 data?

You can either buy your own third-party backup software, or choose a complete service that is outsourced. This can also be bundled with other IT support, making it an affordable option. If you work in certain professions, the extra certainty of knowing your backups are handled by professionals – who likely have their own professional indemnity insurance – is well worth the money.

Look for the following characteristics in your Microsoft Office 365 backup software or provider:

It should keep old user accounts.

Check that there is a way to store the data of users who have left the company for as long as you want to without paying extra.

Check how often backups can be made.

Some products only offer an overnight save. This means that there is a 24-hour window of loss should something untoward happen.

Check the length of time data storage is available.

This is especially important if you have industry-specific requirements for long-term record keeping. We advise at least 6 years, which means you can save your financial and tax records for that long, and potentially longer if you operate in a regulated profession with additional record-keeping requirements.

Check where your backup server will physically sit.

Backup servers can be on your office premises, or in the cloud, or both. Obviously having your backup in the same building as your production data would be no help if there was a fire or flood or other disaster. If your data is in the cloud, how secure does it need to be? If your organisation has the highest requirements for data protection, you will need to confirm that your backup solution matches your security requirements.

Find out what cyber security measures will protect your backups.

Some cyber criminals specifically target backups with ransomware which encrypts the data so that they can extort money to release it. Does the product you are looking at have protection against that?

Restoring from your backups should be easy.

Make sure you can restore data without overwriting existing versions of the same files. Each person should be able to keep both the backup and the current production version of any files you have to restore.

Avoid unnecessary complexity.

Look for a system that gives you choice and control without being overly complex. Consider asking for a walk through showing you exactly what is involved in restoring different types of data from backups, such as email, stored files and so on.

Which is the best product to back up Office 365?

We at Flywheel think Datto is the best third-party Microsoft Office 365 backup software product for the vast majority of organisations.

• It’s priced competitively yet offers “enterprise” quality features
• Datto is simple to use without demanding high levels of expertise or training, making it ideal for smaller organisations
• It’s secure and reliable

Useful links and related articles

Data retention, deletion, and destruction in Microsoft 365

Microsoft 365, Wikipedia

Data Backup, Wikipedia

Datto Saas Protection and Datto SaaS Defense product guide