Recently, Tony Redmond wrote a blog post, Basic Features sin Exchange Online undermine case for third-party backups. I respect Tony but have to disagree with some of his points in the blog post. I will explain in this blog post why I feel some of his points are misleading.
Full Discloser, as many of you know, I work for SkyKick, and we have recently rolled out a Backup Service for Office 365.
Here is an excerpt from Tony’s blog – “The report says that a disgruntled employee can empty and purge their Deleted Items folder to remove information, making “data recovery and restoration difficult, if not impossible to perform.” Hmmm… First, the mailbox of a disgruntled employee might be on hold (if it contains anything important), in which case any action by the mailbox owner cannot destroy data. But even still, Exchange Online mailboxes have Single Item Recovery enabled by default, meaning that all deleted items are retained in the Recoverable Items structure until the standard 14-day retention period expires. So the statement isn’t quite as powerful as you might assume on first reading.”
The overall issue I see with Tony’s blog is that it assumes Enterprise class clients. Numerous business of all sizes are moving to Office 365, and some have IT staff that can manage and maintain the required details to enable data restoration with the built-in tools, but many do not. First for the mailbox to be on hold, it assumes that the mailbox at a minimum has an Exchange Online Plan 2 License, or has the Enterprise 3 license suite applied. Per the Service Description for Exchange Online, in-place hold and litigation hold is not available for Exchange Online Plan 1 or Enterprise 1 licenses. Second, it is assumed that, if properly licensed, Hold Policy has been applied to the mailbox prior to the malicious deletion. Third point, regarding recoverable deleted items, it assumes that the deletion of the data is discovered within the retention period. Fourth, restoring a single item(s) from hold is much easier said than done. This requires a search for the item(s) and then exporting the item(s) to PST and finally ingesting the items to the proper mailbox.
Tony also mentions restoring an inactive mailbox, but again that requires that the mailbox had the proper licensing and was also put on hold prior to deleting it.
I totally recommend that a company looks into the need for a backup solution for Office 365. Many people have the wrong perception that Microsoft is backing up their Office 365 data and will restore data upon request. But as Tony mentioned in his blog post, Microsoft does not backup, but uses several database copies to ensure availability of the service.
Looking at SkyKick Backup solution, we enable companies, via a SkyKick partner, to easily backup all Office 365 data, Exchange, SharePoint and OneDrive for Business. We also streamline the restore process but enabling simple click and restore functionality. One other added benefit, once you configure backup, you do not need to manage it going forward. SkyKick will discovery automatically new user mailboxes, SharePoint Sites and OneDrive for Business sites and immediately add them to the backup with no additional admin intervention.