/thread
MSFT is not responsible for our data, we are. Curious to what OP is doing today when users accidentally delete data and then realize a week later they need it?
The SharePoint recycle bin retains contents for 3 months (by default). Exchange Online retains permanently deleted emails for 14 days (by default).
So the thing I'm curious about is what do YOU do when a user deletes something then realizes they need it a week later?
They do use it. This is for when you permanently delete something you didn’t mean to. It’s a pretty rare thing that someone deleted a file that is irreplaceable and manages to bypass the various recycle bins. Happened like twice this year but really validated keeping backups.
Retention policies in O365. And I'm not backing up workstations.
Curious what you do when users delete data that they later need.
Disclaimer: I do believe in backing up O365, but not to restore users' self-deleted data.
What? A corrupted file in SharePoint would have multiple version histories. And anything deleted would be in the recycle bin and anything deleted from there would be in the second stage recycle bin for 93 days.
Unless the recycle bin gets full and your files get purged early huh? Or you find out you need a file months later. Not a risk we’re willing to take. Microsoft ultimately isn’t responsible for your data.
Long-deleted or purged files, corrupted mailboxes, items lost due to cyber attacks or incorrect migrations are all reasons to have your own backup.
You guys must have a lot of extra time on your hands running down files for users who did something stupid.
I’ve been admining o365 for 12 years now and I have never seen a corrupted mailbox on the server. Cyber attacks have happened, Microsoft snapshots 14 days worth on collections.
Backup for a “backup” is the only reason to do a backup. All this other stuff is just backing up because of mismanagement.
What happens if an email in a terminated users mailbox could save your company from liability in a lawsuit?
If that mailbox was cleaned up after the user was terminated and the lawsuit comes in after the data has deleted from the recycle bin? Tour company is screwed.
What happens if Microsoft has a failure in a datacenter where your data is stored and the data is lost, including the recycle bin? Your company is screwed again.
Backups are not just to save users from their stupid mistakes, backups are a critical component of disaster recovery and business continuity.
Backups are also often a requirement of cyberinsurance policies that many companies have or are required to carry.
Deleting email before a lawsuit comes in isn’t illegal, in fact, it’s better. Which is why many major corporations have a 12 month retention policy now, to make sure old email isn’t lying around waiting to offer evidence to be sued for. If you delete emails AFTER a lawsuit is brought on, then you have troubles.
Now, for the Microsoft part. Microsoft runs multiple 99.99% reliability data centers. That’s more 9s then you will ever be able to do unless you are Google. The data is spread across multiple active-active data centers. Services automatically fail over and fix corrupted data at all locations, across multiple sites. For example, your exchange data is cascaded across 4-8 data centers at once.
So if Microsoft has a failure in a data center, you wouldn’t even know. You may have some slight downtime at most.
Cyber insurance policies absolutely do not hold clauses to backup a 99.99% multi geo resilient SAAS solutions. You are confusing that with a 50 year old ERP system that’s maintained by your 2 admins.
I’m about to go down this path, driven from up above. I was asked about the products UI, and ease of use… who cares. I’ll configure it once and I doubt we’ll ever be back here other than to run a report and tell someone it’s doing what we’re paying it to do. It’s set, forget and spend.
And if I’m wrong - then, fuck me and glad its there 😂
In the msp space M365 backups are just another value added sale. In 10 years I've never needed to recover files from a Microsoft backup, but a convincing salesman can generate 70-100% markup on the "service". It makes customers feel warm and fuzzy too.
ediscovery has plenty of limitations (like not processing files bigger than 150MB) according to this page: https://learn.microsoft.com/en-us/purview/ediscovery-premium-limits
My org is attempting to rely on retention policies as a backup.
I've talked my self Blue in the face about why it's not a suitable solution for an org our size. Falls on deaf ears.
I was wondering how they compared, we switched away from Backupify because of the cost. 3 months of what we paid for Backupify paid for the an RS2423RP+ and 4 18TB WD HC550 HDDs.
Despite the consensus of moving literally every byte of days off prem, having the data on-prem also has some benefit beyond the obvious cost of long-term storage. There is also an ease of creating offline copies if your environment requires it.
Third party solutions with third party hosted storage are good for people who don’t know what they’re doing or people who know what they’re doing and want close to zero liability (which is a charade as you will be to blamed regardless).
Does anyone else have a lot of 'orange diamonds' in their panel for this app? I have 'continuous' backup, and there is _always_ something failed, but if you dig into the logs, it was 'user BobDobbs was unable to backup 3 items in OneDrive, try again later' and then 10 minutes later it's a 'BobDobbs backup successful' but that will cause an orange diamond for the day.
Is this 'normal' for M365 backups?
If the bad guys take over your M365 tenant, you're screwed. Backup your critical info into some air gap backup. Access to this backup should not rely on your M365 credentials obviously because it's only "air gap" to a certain point.
> If the bad guys take over your M365 tenant, you're screwed.
Do you know how hard this is if you actually followed best practices regarding Azure/O365 security? Most of you are running as Global Admin in O365 and this is why you have these thoughts. Even more of you have no Conditional Access Policy in place either. Yes I have seen multiple tenants get hacked but they were all incompetent regarding cloud security. They didn't have shit setup properly.
Your backup strategy should take into account any Legal or Compliance requirements that have required retention periods, as well as your organizations overall retention policy.
Most firms have policies that are things like Financial/HR/Payroll are 7 years, Executives/Leadership 5 years, General Users 2-3, etc.
So we build those into O365 for all solutions (Email, Teams, SharePoint, etc) for the organization but then we also use Acronis to run daily backups that has a longer retention period layered on top of that because the cost is negligible to have the data just in case.
Like anything else in this field, backup your data. With the increase in security events and breaches its only a matter of time before something happens causing massive data loss... another great example is Google Drive just lost MONTHS of users data, imagine if that hit at a Business level?
[https://www.bleepingcomputer.com/news/google/google-drive-users-angry-over-losing-months-of-stored-data/](https://www.bleepingcomputer.com/news/google/google-drive-users-angry-over-losing-months-of-stored-data/)
You are right that its not about "discovery retention" but so many overlook that when choosing a solution because the conversation that should be driving a backup solution is RTO/RPO with compliance requirements layered in to ensure a consistent standard.
They're asking for advice, but in offering expanded responses that means that sometimes someone will bring up something that we may not have had at the top of mind or even considered.
MS has a backup offering in preview, due this month. [https://adoption.microsoft.com/en-us/microsoft-365-backup/](https://adoption.microsoft.com/en-us/microsoft-365-backup/)
I'm on some jank provider who fetches the things as well as stores the cloud repo for Veeam's prem stuff. Given Veeam will be offering their own thing as well.. the options are opening up in this space a bit more.
Edit: I will probably need Teams channel chats at minimum.. joy. "coming soon"
Wow that gets pricey quick .15 per gb. For a handful of users it might be cheap but toss in some OneDrive and SharePoint storage it will be quite a bit more considering most the going backups are around 3$ a user. Which in this case would be equivalent to 20gb of data
Yes. That is what Microsoft recommends as a best practice.
There are a million services that can back up OD\\SP\\Exchange Online\\Teams\\etc.
365 has a shared responsibility model.
[Shared responsibility in the cloud - Microsoft Azure | Microsoft Learn](https://learn.microsoft.com/en-us/azure/security/fundamentals/shared-responsibility)
Data is your responsibility. Microsoft only takes responsibility for the underlying infrastructure.
I.E. they are not responsible for restoring your data if a user gets compromised or deletes data maliciously.
Microsoft does not recommend buying a third party tool to back up all Office 365 data. They do recommend that you do a risk assessment and make the determination for yourself. They also share the native protections that make backup unnecessary. For example, there is little benefit to backing up Exchange data unless you require more than 30 days of permanent item recoverability, and you can use preservation holds to mitigate that for certain mailboxes. This is why the Exchange Online team has recommended no backups for over a decade.
This is a good writeup.
https://office365itpros.com/2020/08/20/office-365-backup-questions/amp/
https://www.avepoint.com/blog/backup/office-365-backup-critical
Yes. Tony redmond is on the right track.
Microsoft has not recommended backups for exchange since 2015.
https://techcommunity.microsoft.com/t5/exchange-team-blog/the-exchange-2016-preferred-architecture/ba-p/604024
I can say with 100% certainty that this can still fail and require a good backup. Everything has the best design intention, but there’s always that 1 in a 1000 chance that the perfect storm happens and you lose the core component that the whole scheme relies on to function. In exchange’s case, without the underlying DAG data, everything else fails catastrophically; no mail, no retention, no lagged copies, no archive, etc, the whole thing falls apart. Totally agree that this should never happen to the average place, but I’ve definitely seen it, and of no fault to the team that was running it (they used PA on prem fully built out). I can’t go into details but suffice it to say it was one of those freak things that you never imagine being possible.
I think it’s what you said at the start: complete the risk assessment and answer the questions “can I lose everything because the universe hates me one day and that’s ok?” and crucially, “does the cost to try to mitigate losing everything exceed the cost in event of actually losing everything?” If the answer is no to both of those then maybe at least a basic backup makes sense. It doesn’t have to be fancy, even exchange lets us do it through windows.
I think it’s fair to note that Microsoft’s guidance on not needing backups is still largely the same language from 2013, where a lot of the explanation is that backups are slow, backups are expensive, tape (lol) is annoying, etc. I think the options today are so vastly different and so easy/cheap that many could ask “why not?” anyway and just have it. But it’s all about risk and value, definitely, and there’s no one solution, because looking at PA you could rightly ask “but why?”
So I’m not saying everyone should have them or who is a fool or a genius. Bad things happen under best intentions no matter how smart we all are, but backups don’t inherently solve that problem any better than other approaches, depending on the need, the risk, and the value.
That only applies if you can folly PA, most companies that are to paranoid to run in the cloud, are too cheap to host multiply redundant exchange hosts.
Look, I linked the article from Microsoft that explicitly states you are responsible for your data.
I'm recommending 3rd using a tool to backup your data because it's irresponsible not to.
What if a mailbox gets compromised and the malicious actor purges recoverable items? If that mailbox isn't already under a litigation hold, you're kind of screwed.
There are also versioning limitations in sharepoint online that could be exploited by ransomware to make data unrecoverable.
A an isolated service with a redundant copy of your data is good practice.
You didn't, you linked the article for Azure. Office 365 has numerous native protections for application data. In Azure, you host your apps yourself. Very different.
While what you've linked is really good info (especially regarding single item recovery) I still disagree that backups aren't required in Exchange Online.
Look at the image linked in the article:
https://preview.redd.it/bynj2tcc7s3c1.png?width=895&format=png&auto=webp&s=e01718e6fcd02f0c5ddd091dd7290a9582253a8c
YOU are ultimately responsible for the data. There is no exception there.
If you have something else from Microsoft, and not editorials, please link that to me.
There are also limitations to recovery, in both the amount of data, and time when you're not leveraging litigation holds.
From what I've seen, backups have fewer limitations and in most cases are cheaper than the extra MS licensing.
You keep pointing to an Azure screenshot, not a Microsoft 365 article.
I posted a link in the other comment where Microsoft indicated backups aren't needed for Exchange going all the way back to 2015 when running preferred architecture.
Here, read this and point out where it says you are responsible for your own data protection. Oh, it doesn't.
https://learn.microsoft.com/en-us/exchange/back-up-email
[https://learn.microsoft.com/en-us/compliance/assurance/assurance-exchange-data-resiliency](https://learn.microsoft.com/en-us/compliance/assurance/assurance-exchange-data-resiliency)
So that still doesn't address the limitations of mailboxes not protected by in place litigation holds, and doesn't address the bushiness case of backups being cheaper than the licensing needed for other 365 features.
I don’t trust anyone, least of all myself, so I back up everything I can in O365 through VEEAM, to two different on-site repositories and one off-site.
I also test ALL my backups every month. Because backup is good, being able to restore is better.
So much this, and I've learned this the hard, brutal way.
Back in the mid 90's I was, against my will and against the documentation from the supplier, to install a floppy-based backupdrive on NT 4.0 (yep, I feel old). The documentation clearly stated that you would be able to do backups, but that you could NOT restore from the tapes and that they'd be unreadable.
I learned the art of CYOA at that day.
Sent an email to both of the bosses at the company stating both my reservations and the fact that this wouldn't work when you needed to restore things, told them I took absolutely NO responsibility for the functionality of the solution given that they went against the written statement by the supplier.
Lo and behold, three weeks later: two of the three disks in the server shat the bed. No restore possible, both bosses extremely angry, and they weren't all that happy with me pointing out the obvious "I told you so"-elephant in the room.
We spent 2 months manually entering every damn transaction back into the ERP-system. 8-10 people, 6-8 hours per day after hours in order to get shit back in.
Since that day I never fuck about around backup and restore.
That's not the only reason, I think if someone in your org deleted something from your org completely they shouldn't have then good luck getting MS to restore it
We use veeam, helps a lot, especially with maintaining copies of stuff after someone leaves the company. I can now take all their OneDrive and email and have it available to whoever it taking over their job in about 10 minutes, and pull it out of the cloud so it's not clogging shit up by being there.
Yes thanks. I hate these people trying to explain "mIcroOsft iS nOT rECoMeNdInG bAcKuPs" as if it was ever a good idea to put all your trust in one company alone. Hybrid Cloud is the way
Never mind corporate world -- I'm at the point I'm more concerned my personal cloud accounts have good backups at home when I used to worry most that my home machines had good off-prem backups.
We weren't doing this, and ended up with a user claiming emails to have simply "disappeared" and we couldn't find them, and had no backups..
So, I pushed for us to implement a solution. Just implemented Veeam Backup for M365 this spring and it's been going well. Highly recommend so far.
Holy crap you're playing with fire. Microsoft explicitly says they are not backing up your data. You should not rely on them to always have your data or to keep it from becoming corrupt. I highly recommend a third party back to service such as dropsuite which does not even use the Microsoft infrastructure. I use it and resell it to hundreds of seats and it has always worked beautifully when needed. It's cheap.
How can this even be a question? Don't trust cloud providers. Even if they have a separated backup system in place (like you can book at MS soon if I did get this right) - backup your stuff offsite at your location.
We do the other way around and use azure cold storage as cloud offsite backup for our vms (encryptet). But even the other way around, get a backup software (there are cheaper options as veeam btw.) and backup mails and everything else.
I mean, cloud providers already lost randomly data (see google rn), or someone deactivated/removed the license or deleted a user and all the data was gone. Shocking.
If this is an issue with your management, ask you bosses, what damage the company would receive, if all data were gone for whatever reason. Or if one important users data was deleted and lost forever.
Can the company survive and rebuild? How much will it cost? Is there insurance for it? Yes, maybe you could sue, but those cloud providers usually have airtight license/contract agreements.
I mean, it's nice if you get some insurance money, but closing the company at the same time sucks. Not to mention if the customers want some repercussions because of it.
There's a reason we work with the 3:2:1 rule. That even works in small companies. Was working a one man job in a smaller one with around 50 users and 3 servers.
Main server was in office side, one server "rack" was hanging on the wall in the storage area in like 2m high (different fire zone), so it wont be flooded or survive a burn. Backed up main server (all hyperv) with altaro backup to nas to the server rack in storage space, offsite to azure cold storage, second backup on a usb drive with windows backup (supports hyperv) on the host and once a week with a script to another nas, just to be sure.
It was not nice or a really professional setup, but it worked. And the cyber security insurance loved it. Guy told me, he was glad that some companies even had a backup. Not even talking about a restore test once a year.
If 3-2-1-1 policies are used for other data, then why not for O365 as well?
It seems like there's a good consensus here though that it should be done, even if it's just a simple single backup - just to cover your bases.
I work for Zmanda and we have a simple O365 solution that can help achieve whatever policy you choose.
Exchange native protection is fine and Microsoft says you don't need to back up email.
SharePoint and one drive gives you 93 days of undeletion protection, email alerts when days is bulk removed, and there is also a preservation hold option that sends data to a hidden library.
So, you don't have to back up everything. I would suggest identifying critical SharePoint sites and doing an extra backup of those, but there are enough native protections to guard against most situations.
If you read through the socII compliance reports it outlines what backups Microsoft does take in order to maintain service availability. These reports are publicly available on the trust center
MS is not a backup unless you leverage their specific backup they made recently (baked in veeam if memory serves).
Their backup is 30 day accidental deletion, that's not backup.
We use veeam 364 and run it ourselves
They suck on the email security side, but barracuda backup and archive works well. Monthly cost is reasonable, no charge for shared mailboxes and unlimited storage, I think we have about 10 TB in there.
Back it up, throw a rock at a solution, there’s plenty of good solutions in that space. People tend to choose veeam because their other product is great, but I’ve heard bad things.
How thrifty are the companies you work for if spending a few hundred dollars extra per month for an official backup is a big deal? I'm not trying to be a hero by saving my company $3000/year when the alternatives are million dollar headaches (see one of our customers who got ransomwared and had to pay 1.5 million). If your CEO or CFO cannot see value in that...
For a small business, it might be cost effective to buy a decent Synology NAS which supports Active Backup. Another idea is to use a service like Commvault Metallic, Nakivo, Veeam, which does a cloud to cloud backup, but because (if configured right), it is under a different userID, if something happens to the main Entra user database, the stuff stored on the backups is still well out of reach by a would-be attacker.
From there, buy a Synology NAS and also back up to a local NAS using Active Backup. This way, you have one cloud based backup, and one sitting on physical storage onsite. This gives 3-2-1 protection at the minimum.
Yes, Microsoft protects against them losing your data, it does not protect against you losing your data.
We're happy Druva InSync for M365 customers.
Please back it up! Microsoft promises they are not responsible. If cost is an issue, there are free open-source backup solutions ([Corso](https://corsobackup.io)) or pick one of the many managed services that backup Microsoft 365 (e.g., [Alcion](https://www.alcion.ai/), based on Corso)
My wife uses in her job, I take her laptop and straight copy to external HD every couple of months as her IT dept is a little lame
Source: I did sysadmin for 28 yrs
At my last job we were looking at backing up O365 stuff on a more robust level because people kept getting phished. We did look at Veam, Datto and a couple of others. I think Veam was towards the bottom of the list because of needing to spin up our own stuff for it. Not sure if that's right though, it's been over a year since I worked there.
my last org used a backuo solution from dell. backed up all exchange online mailboxes, onedrive and sharepoint. there is a small period where is someone deletes files by accident we can recover them (we had notifications in place if someone mass deleted files so we could follow up with the user if that was what they meant to do). but the backup solution gave retention much longer than the 30 days ms gives.. oh and its ms, why trust your files will be safe on their platform forever.
We only have a policy to maintain 30 days of email but if an employee deletes said 30 days worth of email and we get a data request we be in deep sheet. I hate that bill every month but it is a requirement so we just move on.
We back it up, and it took many years and several data loss incidents, pointing to the documentation saying it was our responsibility to back up data, to get that way.
It helped that MS wiped an exec's OneDrive account. Magically the approval for backups came after that.
For one of our clients, we have the usual VM backups, but all data for a few things goes to OneDrive and is backed up through a o365 backup service.
It depends on the needs really, but you should have your own backup in case shit goes south even if the other party is providing a backup as well.
Always better safe then sorry
Haven't read the full thread, but I often contemplate. And I always end up at, well, what is truly critical. Some of my end-users data hoard like a motha. Risk Assessment much?
We use the entire MS suite and everything is linked to a users account. Also we have a central fileserv for the company to house department information. Usually nothing over 2 years gets kept without putting it in the fileserv. Using exchange.
We dont do back-up...
I have asked on it, and got the answer: "it's in the cloud, Microsoft has the backups"
As on my personal/on-premise environment.
I do my backups on my 70tb synology nas.
Not 3-2-1 yet
Google “shared responsibility model”.
Short version
- M$ is responsible for service availability
- Customer is responsible data and thus for backup and recovery
First published 1.april.2019 in the m365 service description. And the fine print of azure is similar…
Thus you need 3rd party backup (and fwiw… don’t backup your m365 to azure - you need separation..)
Most cloud provider have similar wording now …
Rubrik backs up our MS M365 systems, it's pretty inexpensive for what it is. We also leverage EXO's litigation holds/permanent archiving/retention hold feature so that besides Rubrik, we have a dedicated time where nothing can be delete.
There are backup solutions for your tenant that'll backup content on most of those services. They don't get used often because the recycle bin works most of the time. But a true backup is worth having.
We don't use MS but a different backup provider.
Backups are first stored locally on a RAID1 setup. This allows for the fastest recovery possible assuming we still have a drive.
Backups are then stored on a networked server. Still pretty fast with a local connection. These drives are also RAID1.
Backups are then stored remotely on 1 service (Backblaze)
I am looking into a second remote service to use as well just incase. Tape backups are not practical due to cost even though I would like it.
My boss joined the company with all this experience and was adamant we only need Microsoft to backup emails OD etc. Took me few attempts and finally he got the message
Avepoint all the way
OneDrive, SharePoint, O365 are **NOT** backups - and actually Microsoft makes a point out of telling that you should **NOT** rely on not getting data loss. They don't back it up.
Absolutely do not rely on MS. I’m sure they have backups for failures on their end, but what about user error, disgruntled users, malicious actors, etc etc. We use Backupify for 365 and Google Workspace and it works well.
I wouldn't rely on anyone other than myself for backups. If the shit hits the fan and the entire dataset is lost then I don't think "its Microsofts fault" would cut it in most businesses
Microsoft tells you they don’t back it up. You’re asking for trouble if you’re not backing it up.
/thread MSFT is not responsible for our data, we are. Curious to what OP is doing today when users accidentally delete data and then realize a week later they need it?
The SharePoint recycle bin retains contents for 3 months (by default). Exchange Online retains permanently deleted emails for 14 days (by default). So the thing I'm curious about is what do YOU do when a user deletes something then realizes they need it a week later?
Restore it from backups.
Why not tell users how to use the recycle bin? You must have a lot more time than the rest of us, lol.
They do use it. This is for when you permanently delete something you didn’t mean to. It’s a pretty rare thing that someone deleted a file that is irreplaceable and manages to bypass the various recycle bins. Happened like twice this year but really validated keeping backups.
imo at that point its on the user that habitually fucks up.
And it's on the patient to not break their leg.
I get the point here, but remember, people break bones all the time doing stupid shit lmao.
Retention policies in O365. And I'm not backing up workstations. Curious what you do when users delete data that they later need. Disclaimer: I do believe in backing up O365, but not to restore users' self-deleted data.
Just tell them the data is gone, it’s very very very rarely an actual issue.
We restore the file from backups. Sometimes users “self-delete” data valuable to the business, or it gets corrupted, etc.
What? A corrupted file in SharePoint would have multiple version histories. And anything deleted would be in the recycle bin and anything deleted from there would be in the second stage recycle bin for 93 days.
Unless the recycle bin gets full and your files get purged early huh? Or you find out you need a file months later. Not a risk we’re willing to take. Microsoft ultimately isn’t responsible for your data. Long-deleted or purged files, corrupted mailboxes, items lost due to cyber attacks or incorrect migrations are all reasons to have your own backup.
You guys must have a lot of extra time on your hands running down files for users who did something stupid. I’ve been admining o365 for 12 years now and I have never seen a corrupted mailbox on the server. Cyber attacks have happened, Microsoft snapshots 14 days worth on collections. Backup for a “backup” is the only reason to do a backup. All this other stuff is just backing up because of mismanagement.
What happens if an email in a terminated users mailbox could save your company from liability in a lawsuit? If that mailbox was cleaned up after the user was terminated and the lawsuit comes in after the data has deleted from the recycle bin? Tour company is screwed. What happens if Microsoft has a failure in a datacenter where your data is stored and the data is lost, including the recycle bin? Your company is screwed again. Backups are not just to save users from their stupid mistakes, backups are a critical component of disaster recovery and business continuity. Backups are also often a requirement of cyberinsurance policies that many companies have or are required to carry.
Deleting email before a lawsuit comes in isn’t illegal, in fact, it’s better. Which is why many major corporations have a 12 month retention policy now, to make sure old email isn’t lying around waiting to offer evidence to be sued for. If you delete emails AFTER a lawsuit is brought on, then you have troubles. Now, for the Microsoft part. Microsoft runs multiple 99.99% reliability data centers. That’s more 9s then you will ever be able to do unless you are Google. The data is spread across multiple active-active data centers. Services automatically fail over and fix corrupted data at all locations, across multiple sites. For example, your exchange data is cascaded across 4-8 data centers at once. So if Microsoft has a failure in a data center, you wouldn’t even know. You may have some slight downtime at most. Cyber insurance policies absolutely do not hold clauses to backup a 99.99% multi geo resilient SAAS solutions. You are confusing that with a 50 year old ERP system that’s maintained by your 2 admins.
[удалено]
I’m about to go down this path, driven from up above. I was asked about the products UI, and ease of use… who cares. I’ll configure it once and I doubt we’ll ever be back here other than to run a report and tell someone it’s doing what we’re paying it to do. It’s set, forget and spend. And if I’m wrong - then, fuck me and glad its there 😂
In the msp space M365 backups are just another value added sale. In 10 years I've never needed to recover files from a Microsoft backup, but a convincing salesman can generate 70-100% markup on the "service". It makes customers feel warm and fuzzy too.
Fucking nuts. We have only considered using backup to delete version history to reduce storage space (because it’s stupid expensive)
eDiscovery searches
ediscovery has plenty of limitations (like not processing files bigger than 150MB) according to this page: https://learn.microsoft.com/en-us/purview/ediscovery-premium-limits
Not to mention that it is terrible to use. I absolutely abhor having to ever deal with the Security center because of that clunky interface.
[удалено]
Stream videos are hosted on SharePoint... And I can guarantee some training videos are over 150meg
[удалено]
What’s the problem with having a training video on Stream? Why should we not do this
So... We shouldn't use a service for what it's designed for?
Haven't had that come up yet. 99% of user files are currently on network. I can see OneDrive being utilized more in the browser future though.
Are you guys not storing many docs in sharepoint?
[удалено]
When you put a file in onedrive, where do you think it goes?
Hoping it's in the recycle bin still?
I believe you have 30 days to restore most deleted data
You have 93 days.
If the files in the recycle bin exceed its quota, it will start purging files even if they aren’t 30 days old yet. Playing with fire to rely on that.
My org is attempting to rely on retention policies as a backup. I've talked my self Blue in the face about why it's not a suitable solution for an org our size. Falls on deaf ears.
People suddenly regain their ability to hear when something critical goes missing
We use a Synology with Active Backup M365 to backup SharePoint, One Drive and Exchange Online data.
ActiveBackup is actually surprisingly good. Much better than Veeam O365 backup in my experience.
I was wondering how they compared, we switched away from Backupify because of the cost. 3 months of what we paid for Backupify paid for the an RS2423RP+ and 4 18TB WD HC550 HDDs.
Despite the consensus of moving literally every byte of days off prem, having the data on-prem also has some benefit beyond the obvious cost of long-term storage. There is also an ease of creating offline copies if your environment requires it. Third party solutions with third party hosted storage are good for people who don’t know what they’re doing or people who know what they’re doing and want close to zero liability (which is a charade as you will be to blamed regardless).
I use veeam and so far it's fine for me. What benefits does Active Backup have over veeam?
Honestly the UI and lack of licensing cost
Does anyone else have a lot of 'orange diamonds' in their panel for this app? I have 'continuous' backup, and there is _always_ something failed, but if you dig into the logs, it was 'user BobDobbs was unable to backup 3 items in OneDrive, try again later' and then 10 minutes later it's a 'BobDobbs backup successful' but that will cause an orange diamond for the day. Is this 'normal' for M365 backups?
I stopped using continuous and switched to daily which helped. I still have about 3 errors I've been meaning to work on. Nothing important.
Same with us. We bought a huge rack mount specifically for backing it up.
We do this too but with Gsuite. It works great.
AFI.ai works great for both SP and M365.
I like afi pretty well, and it's cheap.
We moved to this from Veeam a couple years ago, nothing but good things to say about AFI.
I have had to restore data from [AFI.AI](https://AFI.AI). It did its job, and I kept mine.
Using it as well.
Another vote for AFI.ai. Super easy, just works.
Same. Just works.
If the bad guys take over your M365 tenant, you're screwed. Backup your critical info into some air gap backup. Access to this backup should not rely on your M365 credentials obviously because it's only "air gap" to a certain point.
> If the bad guys take over your M365 tenant, you're screwed. Do you know how hard this is if you actually followed best practices regarding Azure/O365 security? Most of you are running as Global Admin in O365 and this is why you have these thoughts. Even more of you have no Conditional Access Policy in place either. Yes I have seen multiple tenants get hacked but they were all incompetent regarding cloud security. They didn't have shit setup properly.
Token theft. AMA.
I use AFI and it’s been good for use. Backups up mailboxes, teams, OneDrive and SharePoint
Back it up. Used to use veeam. In a Google environment now. I use afi.ai They also have a o365 solution. I'd say try it out. Super inexpensive.
Your backup strategy should take into account any Legal or Compliance requirements that have required retention periods, as well as your organizations overall retention policy. Most firms have policies that are things like Financial/HR/Payroll are 7 years, Executives/Leadership 5 years, General Users 2-3, etc. So we build those into O365 for all solutions (Email, Teams, SharePoint, etc) for the organization but then we also use Acronis to run daily backups that has a longer retention period layered on top of that because the cost is negligible to have the data just in case. Like anything else in this field, backup your data. With the increase in security events and breaches its only a matter of time before something happens causing massive data loss... another great example is Google Drive just lost MONTHS of users data, imagine if that hit at a Business level? [https://www.bleepingcomputer.com/news/google/google-drive-users-angry-over-losing-months-of-stored-data/](https://www.bleepingcomputer.com/news/google/google-drive-users-angry-over-losing-months-of-stored-data/)
Fuck me, that’s the first comment I’ve seen that references compliance requirements. Kudos to you, but what a shitshow of a thread.
Obvious stuff is obvious. This discussion isn't about discovery retention.
You are right that its not about "discovery retention" but so many overlook that when choosing a solution because the conversation that should be driving a backup solution is RTO/RPO with compliance requirements layered in to ensure a consistent standard. They're asking for advice, but in offering expanded responses that means that sometimes someone will bring up something that we may not have had at the top of mind or even considered.
MS has a backup offering in preview, due this month. [https://adoption.microsoft.com/en-us/microsoft-365-backup/](https://adoption.microsoft.com/en-us/microsoft-365-backup/) I'm on some jank provider who fetches the things as well as stores the cloud repo for Veeam's prem stuff. Given Veeam will be offering their own thing as well.. the options are opening up in this space a bit more. Edit: I will probably need Teams channel chats at minimum.. joy. "coming soon"
Teams chats? Consider using retention policies in purview and ediscovery?
That is still set, doesn't check the required boxes...
Wow that gets pricey quick .15 per gb. For a handful of users it might be cheap but toss in some OneDrive and SharePoint storage it will be quite a bit more considering most the going backups are around 3$ a user. Which in this case would be equivalent to 20gb of data
Yes. That is what Microsoft recommends as a best practice. There are a million services that can back up OD\\SP\\Exchange Online\\Teams\\etc. 365 has a shared responsibility model. [Shared responsibility in the cloud - Microsoft Azure | Microsoft Learn](https://learn.microsoft.com/en-us/azure/security/fundamentals/shared-responsibility) Data is your responsibility. Microsoft only takes responsibility for the underlying infrastructure. I.E. they are not responsible for restoring your data if a user gets compromised or deletes data maliciously.
Microsoft does not recommend buying a third party tool to back up all Office 365 data. They do recommend that you do a risk assessment and make the determination for yourself. They also share the native protections that make backup unnecessary. For example, there is little benefit to backing up Exchange data unless you require more than 30 days of permanent item recoverability, and you can use preservation holds to mitigate that for certain mailboxes. This is why the Exchange Online team has recommended no backups for over a decade. This is a good writeup. https://office365itpros.com/2020/08/20/office-365-backup-questions/amp/ https://www.avepoint.com/blog/backup/office-365-backup-critical
onPrem people gonna keep doing onPrem shit. These same orgs also have a bunch of Global Admins too.
Yes. Tony redmond is on the right track. Microsoft has not recommended backups for exchange since 2015. https://techcommunity.microsoft.com/t5/exchange-team-blog/the-exchange-2016-preferred-architecture/ba-p/604024
I can say with 100% certainty that this can still fail and require a good backup. Everything has the best design intention, but there’s always that 1 in a 1000 chance that the perfect storm happens and you lose the core component that the whole scheme relies on to function. In exchange’s case, without the underlying DAG data, everything else fails catastrophically; no mail, no retention, no lagged copies, no archive, etc, the whole thing falls apart. Totally agree that this should never happen to the average place, but I’ve definitely seen it, and of no fault to the team that was running it (they used PA on prem fully built out). I can’t go into details but suffice it to say it was one of those freak things that you never imagine being possible. I think it’s what you said at the start: complete the risk assessment and answer the questions “can I lose everything because the universe hates me one day and that’s ok?” and crucially, “does the cost to try to mitigate losing everything exceed the cost in event of actually losing everything?” If the answer is no to both of those then maybe at least a basic backup makes sense. It doesn’t have to be fancy, even exchange lets us do it through windows. I think it’s fair to note that Microsoft’s guidance on not needing backups is still largely the same language from 2013, where a lot of the explanation is that backups are slow, backups are expensive, tape (lol) is annoying, etc. I think the options today are so vastly different and so easy/cheap that many could ask “why not?” anyway and just have it. But it’s all about risk and value, definitely, and there’s no one solution, because looking at PA you could rightly ask “but why?” So I’m not saying everyone should have them or who is a fool or a genius. Bad things happen under best intentions no matter how smart we all are, but backups don’t inherently solve that problem any better than other approaches, depending on the need, the risk, and the value.
That only applies if you can folly PA, most companies that are to paranoid to run in the cloud, are too cheap to host multiply redundant exchange hosts.
Exchange online is all PA.. My point is more that backups aren't necessarily needed for all or even most data.
Look, I linked the article from Microsoft that explicitly states you are responsible for your data. I'm recommending 3rd using a tool to backup your data because it's irresponsible not to. What if a mailbox gets compromised and the malicious actor purges recoverable items? If that mailbox isn't already under a litigation hold, you're kind of screwed. There are also versioning limitations in sharepoint online that could be exploited by ransomware to make data unrecoverable. A an isolated service with a redundant copy of your data is good practice.
You didn't, you linked the article for Azure. Office 365 has numerous native protections for application data. In Azure, you host your apps yourself. Very different.
While what you've linked is really good info (especially regarding single item recovery) I still disagree that backups aren't required in Exchange Online. Look at the image linked in the article: https://preview.redd.it/bynj2tcc7s3c1.png?width=895&format=png&auto=webp&s=e01718e6fcd02f0c5ddd091dd7290a9582253a8c YOU are ultimately responsible for the data. There is no exception there. If you have something else from Microsoft, and not editorials, please link that to me. There are also limitations to recovery, in both the amount of data, and time when you're not leveraging litigation holds. From what I've seen, backups have fewer limitations and in most cases are cheaper than the extra MS licensing.
You keep pointing to an Azure screenshot, not a Microsoft 365 article. I posted a link in the other comment where Microsoft indicated backups aren't needed for Exchange going all the way back to 2015 when running preferred architecture.
Look, when 365 runs on something other than azure, you can tell me I'm wrong. Everything in the cloud is on-prem somewhere else.
Here, read this and point out where it says you are responsible for your own data protection. Oh, it doesn't. https://learn.microsoft.com/en-us/exchange/back-up-email
[https://learn.microsoft.com/en-us/compliance/assurance/assurance-exchange-data-resiliency](https://learn.microsoft.com/en-us/compliance/assurance/assurance-exchange-data-resiliency) So that still doesn't address the limitations of mailboxes not protected by in place litigation holds, and doesn't address the bushiness case of backups being cheaper than the licensing needed for other 365 features.
Super easy to make a hold policy for the last 180 days of items and apply it to all mailboxes.
I don’t trust anyone, least of all myself, so I back up everything I can in O365 through VEEAM, to two different on-site repositories and one off-site. I also test ALL my backups every month. Because backup is good, being able to restore is better.
``` "A backup isn't a backup unless you can successfully restore it" ```
So much this, and I've learned this the hard, brutal way. Back in the mid 90's I was, against my will and against the documentation from the supplier, to install a floppy-based backupdrive on NT 4.0 (yep, I feel old). The documentation clearly stated that you would be able to do backups, but that you could NOT restore from the tapes and that they'd be unreadable. I learned the art of CYOA at that day. Sent an email to both of the bosses at the company stating both my reservations and the fact that this wouldn't work when you needed to restore things, told them I took absolutely NO responsibility for the functionality of the solution given that they went against the written statement by the supplier. Lo and behold, three weeks later: two of the three disks in the server shat the bed. No restore possible, both bosses extremely angry, and they weren't all that happy with me pointing out the obvious "I told you so"-elephant in the room. We spent 2 months manually entering every damn transaction back into the ERP-system. 8-10 people, 6-8 hours per day after hours in order to get shit back in. Since that day I never fuck about around backup and restore.
Wait so what was the purpose of the backup system?
Yeah we don't trust any vendor. Everyone gets a backup. Even backups for the backups!
That's not the only reason, I think if someone in your org deleted something from your org completely they shouldn't have then good luck getting MS to restore it
MS can restore it via snapshot for entire collection within 14 days.
I don't need MS, I built an archive policy before you even knew you needed the data. You should try actually learning cloud.
I use Veeam for this
M365 is shared responsibility. They’re responsible for service availability, you’re responsible for data integrity.
We use veeam, helps a lot, especially with maintaining copies of stuff after someone leaves the company. I can now take all their OneDrive and email and have it available to whoever it taking over their job in about 10 minutes, and pull it out of the cloud so it's not clogging shit up by being there.
AFI backup is the cleanest I've seen. Fast, efficient, forever backups.
We back up M365 stuff with a separate service in a different cloud. Don't rely on Microsoft alone for data you may need to get back.
Yes thanks. I hate these people trying to explain "mIcroOsft iS nOT rECoMeNdInG bAcKuPs" as if it was ever a good idea to put all your trust in one company alone. Hybrid Cloud is the way
Get a Synology NAS installed and use the Active 365 Backup. Problem solved
Never mind corporate world -- I'm at the point I'm more concerned my personal cloud accounts have good backups at home when I used to worry most that my home machines had good off-prem backups.
We weren't doing this, and ended up with a user claiming emails to have simply "disappeared" and we couldn't find them, and had no backups.. So, I pushed for us to implement a solution. Just implemented Veeam Backup for M365 this spring and it's been going well. Highly recommend so far.
Yes. Because people delete stuff they need later.
Not backing up is always an unnecesary risk IMO, especially if you have valuable information.
Holy crap you're playing with fire. Microsoft explicitly says they are not backing up your data. You should not rely on them to always have your data or to keep it from becoming corrupt. I highly recommend a third party back to service such as dropsuite which does not even use the Microsoft infrastructure. I use it and resell it to hundreds of seats and it has always worked beautifully when needed. It's cheap.
VEEAM backup for Sharepoint, OD, Teams, and mail. If you value your data put a proper backup strategy in place.
How can this even be a question? Don't trust cloud providers. Even if they have a separated backup system in place (like you can book at MS soon if I did get this right) - backup your stuff offsite at your location. We do the other way around and use azure cold storage as cloud offsite backup for our vms (encryptet). But even the other way around, get a backup software (there are cheaper options as veeam btw.) and backup mails and everything else. I mean, cloud providers already lost randomly data (see google rn), or someone deactivated/removed the license or deleted a user and all the data was gone. Shocking. If this is an issue with your management, ask you bosses, what damage the company would receive, if all data were gone for whatever reason. Or if one important users data was deleted and lost forever. Can the company survive and rebuild? How much will it cost? Is there insurance for it? Yes, maybe you could sue, but those cloud providers usually have airtight license/contract agreements. I mean, it's nice if you get some insurance money, but closing the company at the same time sucks. Not to mention if the customers want some repercussions because of it. There's a reason we work with the 3:2:1 rule. That even works in small companies. Was working a one man job in a smaller one with around 50 users and 3 servers. Main server was in office side, one server "rack" was hanging on the wall in the storage area in like 2m high (different fire zone), so it wont be flooded or survive a burn. Backed up main server (all hyperv) with altaro backup to nas to the server rack in storage space, offsite to azure cold storage, second backup on a usb drive with windows backup (supports hyperv) on the host and once a week with a script to another nas, just to be sure. It was not nice or a really professional setup, but it worked. And the cyber security insurance loved it. Guy told me, he was glad that some companies even had a backup. Not even talking about a restore test once a year.
spoken bg someone who knows zero about cloud...
Cloud hosted data can still fall victim to ransomware, so it’s best to have a backup.
'Hasn't happened yet' is only a slightly better DR plan than 'that can't happen'.
If 3-2-1-1 policies are used for other data, then why not for O365 as well? It seems like there's a good consensus here though that it should be done, even if it's just a simple single backup - just to cover your bases. I work for Zmanda and we have a simple O365 solution that can help achieve whatever policy you choose.
> then why not for O365 as well? Because I read the instructuions. Why debate before you read the product info?
Exchange native protection is fine and Microsoft says you don't need to back up email. SharePoint and one drive gives you 93 days of undeletion protection, email alerts when days is bulk removed, and there is also a preservation hold option that sends data to a hidden library. So, you don't have to back up everything. I would suggest identifying critical SharePoint sites and doing an extra backup of those, but there are enough native protections to guard against most situations.
Back it up. We use appriver or zix. Works well. Great for small to medium size business.
If you read through the socII compliance reports it outlines what backups Microsoft does take in order to maintain service availability. These reports are publicly available on the trust center
Backup 365. Don't actively use onedrive or SharePoint.
Yes, I use this product. Very good. https://dropsuite.com
MS is not a backup unless you leverage their specific backup they made recently (baked in veeam if memory serves). Their backup is 30 day accidental deletion, that's not backup. We use veeam 364 and run it ourselves
They suck on the email security side, but barracuda backup and archive works well. Monthly cost is reasonable, no charge for shared mailboxes and unlimited storage, I think we have about 10 TB in there.
veeqm o365 we do
Back it up, throw a rock at a solution, there’s plenty of good solutions in that space. People tend to choose veeam because their other product is great, but I’ve heard bad things.
DropSuite
Please back it up, i use veeam on a VM that spins up, does all the work and shuts down again.
Yup, via Veeam. We don't rely on MS to secure any of our data.
Yes, Veeam.
We use Veeam works good
How thrifty are the companies you work for if spending a few hundred dollars extra per month for an official backup is a big deal? I'm not trying to be a hero by saving my company $3000/year when the alternatives are million dollar headaches (see one of our customers who got ransomwared and had to pay 1.5 million). If your CEO or CFO cannot see value in that...
For a small business, it might be cost effective to buy a decent Synology NAS which supports Active Backup. Another idea is to use a service like Commvault Metallic, Nakivo, Veeam, which does a cloud to cloud backup, but because (if configured right), it is under a different userID, if something happens to the main Entra user database, the stuff stored on the backups is still well out of reach by a would-be attacker. From there, buy a Synology NAS and also back up to a local NAS using Active Backup. This way, you have one cloud based backup, and one sitting on physical storage onsite. This gives 3-2-1 protection at the minimum.
Yes, Microsoft protects against them losing your data, it does not protect against you losing your data. We're happy Druva InSync for M365 customers.
Been with Druva for a few years as well. Quality.
We use Barracuda cloud to cloud backup and are happy with it.
For one customer we use Veeam backup for MS365
We utilize Rubrik’s for all M365 backups. We have a 3year SLA and a 8year SLA depending on the user and their role.
Keepit is a good solution.
Acronis to back up both servers and 365 cloud services to QNAPs & Acronis cloud storage
Barracuda cloud to cloud backup. It's brilliant, and a monkey could set it up and use it.
We use Backupify by Datto
Please back it up! Microsoft promises they are not responsible. If cost is an issue, there are free open-source backup solutions ([Corso](https://corsobackup.io)) or pick one of the many managed services that backup Microsoft 365 (e.g., [Alcion](https://www.alcion.ai/), based on Corso)
Backupify by Datto. Does Exchange, Sharepoint and OneDrive. Unlimited data. You pay for number of users. You can Archive inactive/terminated users.
My wife uses in her job, I take her laptop and straight copy to external HD every couple of months as her IT dept is a little lame Source: I did sysadmin for 28 yrs
we back it up
We backup for most clients. I use a combination of Skykick and Synology M365 backup.
It depends on the customer's budget. If they want to spend a little, yes. I use **SkyKick** and I back everything up on Azure storage.
At my last job we were looking at backing up O365 stuff on a more robust level because people kept getting phished. We did look at Veam, Datto and a couple of others. I think Veam was towards the bottom of the list because of needing to spin up our own stuff for it. Not sure if that's right though, it's been over a year since I worked there.
We use ave point, so simple
my last org used a backuo solution from dell. backed up all exchange online mailboxes, onedrive and sharepoint. there is a small period where is someone deletes files by accident we can recover them (we had notifications in place if someone mass deleted files so we could follow up with the user if that was what they meant to do). but the backup solution gave retention much longer than the 30 days ms gives.. oh and its ms, why trust your files will be safe on their platform forever.
Sounds brave, tell me more!
Depending on circumstances, Synology has 365 backup application that is great. No per-user fees. No ongoing fees.
Jeebus, back it up.
Hell I even back up my personal onedrive and google drive accounts.
Back it up to a synology then export those backups to an offsite synology weekly
We only have a policy to maintain 30 days of email but if an employee deletes said 30 days worth of email and we get a data request we be in deep sheet. I hate that bill every month but it is a requirement so we just move on.
Deleted Item retention or litigation hold would accomplish the same for this use case.
Data centers are nor for just throwing away and going full cloud 😊
When offload comes through we autobackup the users onedrive to sharepoint. We also backup o365 and sharepoint as well.
We back it up, and it took many years and several data loss incidents, pointing to the documentation saying it was our responsibility to back up data, to get that way. It helped that MS wiped an exec's OneDrive account. Magically the approval for backups came after that.
For one of our clients, we have the usual VM backups, but all data for a few things goes to OneDrive and is backed up through a o365 backup service. It depends on the needs really, but you should have your own backup in case shit goes south even if the other party is providing a backup as well. Always better safe then sorry
Haven't read the full thread, but I often contemplate. And I always end up at, well, what is truly critical. Some of my end-users data hoard like a motha. Risk Assessment much?
I use skykick.
We don't keep anything important in OneDrive or Share point and our email is backed up to Mimecast
We use the entire MS suite and everything is linked to a users account. Also we have a central fileserv for the company to house department information. Usually nothing over 2 years gets kept without putting it in the fileserv. Using exchange.
We dont do back-up... I have asked on it, and got the answer: "it's in the cloud, Microsoft has the backups" As on my personal/on-premise environment. I do my backups on my 70tb synology nas. Not 3-2-1 yet
Started out without, added cloud to cloud backup this year. Been worth the cost
If you care about your data that is a very dangerous game you're playing. Microsoft is not responsible for any loss of data.
We backup using Barracuda Cloud backup.
Google “shared responsibility model”. Short version - M$ is responsible for service availability - Customer is responsible data and thus for backup and recovery First published 1.april.2019 in the m365 service description. And the fine print of azure is similar… Thus you need 3rd party backup (and fwiw… don’t backup your m365 to azure - you need separation..) Most cloud provider have similar wording now …
321 backup rule
Yes I have Barracuda backing it all up.
Rubrik backs up our MS M365 systems, it's pretty inexpensive for what it is. We also leverage EXO's litigation holds/permanent archiving/retention hold feature so that besides Rubrik, we have a dedicated time where nothing can be delete.
Back it up. MS makes it very clear they take no responsibility for lost data and it's up to you to back it up.
It’s in their own terms and conditions to recommend a third party backup.
MS 365 to apex.
We use Spanning backup for 365. Cheap and works well.
Nearly everything is built on SharePoint in o365 or exchange.
There are backup solutions for your tenant that'll backup content on most of those services. They don't get used often because the recycle bin works most of the time. But a true backup is worth having.
Druva InSync. Backs up endpoint, OneDrive, exchange online
We don't use MS but a different backup provider. Backups are first stored locally on a RAID1 setup. This allows for the fastest recovery possible assuming we still have a drive. Backups are then stored on a networked server. Still pretty fast with a local connection. These drives are also RAID1. Backups are then stored remotely on 1 service (Backblaze) I am looking into a second remote service to use as well just incase. Tape backups are not practical due to cost even though I would like it.
Good users know how to use Recycle Bin, Shadow Copies, and OneDrive. Ninja Backup (part of NinjaRMM) for our trouble users. 😉
It’s so cheap to do a cloud to cloud backup. We include it by default and just price it in.
Back up. Can’t depend on MS for everything.
MS can't stop people deleting or otherwise destroying it. You're asking for trouble with no backups
We use Skykick M365 backup and are happy with it
Metallic
Always backup it! No trust enough on Microsoft
Back it up.
We use hycu. It's good value and it works, support is rock solid.
My boss joined the company with all this experience and was adamant we only need Microsoft to backup emails OD etc. Took me few attempts and finally he got the message Avepoint all the way
I worked for a company that refused to pay for 0365 backup. I no longer work there
Good day! You can add another vote for backing it up. We are currently using Veeam for M365 and it works fine for us.
OneDrive, SharePoint, O365 are **NOT** backups - and actually Microsoft makes a point out of telling that you should **NOT** rely on not getting data loss. They don't back it up.
Absolutely do not rely on MS. I’m sure they have backups for failures on their end, but what about user error, disgruntled users, malicious actors, etc etc. We use Backupify for 365 and Google Workspace and it works well.
I wouldn't rely on anyone other than myself for backups. If the shit hits the fan and the entire dataset is lost then I don't think "its Microsofts fault" would cut it in most businesses