Skip to main content
  • EN

 

For this blog series, I will look at M365, which many people use daily, and why it is necessary to have backups using the Veeam Backup for Microsoft 365.  Now my approach will be coming not from a typical user perspective but from an MSP (Managed Service Provider) perspective.  

I will start part one of this series by going through the shared responsibility model for Microsoft 365 and how Veeam plays a key role there.  As we progress through the series, I will talk more about the installation of Veeam for Microsoft 365 and other best practices.

 

Shared Responsibility Model

The shared responsibility model regarding your data relates to what Microsoft is responsible for and what you as the end-user are responsible for in protecting your data.  Many thought that Microsoft did backups for your data, and that assumption could not be farther from the truth.  When your data resides in Microsoft 365 as the end-user, you are responsible for backing up your data.

What is explicitly each party responsible for, you ask?  Well, here is an outline with a chart also that explains:

 

Microsoft:

  • Global Infrastructure - Uptime of the Cloud service
  • O365 data replication - DC to DC for geo-redundancy
  • Recycle Bin - limited time data recovery and no point in time recovery
  • Security - physical, logical, app-level, and User/Admin controls
  • Regulatory - data privacy, regulatory controls, industry certifications, HIPPA compliance

 

Customer:

  • O365 Data - access and control of the data
  • Office 365 Backup - a copy of data stored in another location, including full data retention
  • Point in Time Recovery - ability to recover to a specific point in time
  • Data-Level: Internal - accidental deletion, malicious insiders, employee retaliation, evidence tampering
  • Data-Level: External - ransomware, malware, hackers, rogue apps
  • Owner Role - corporate and industry regulations

 

 

And a few more reasons why you need a backup solution for Microsoft 365:

 

 

This is where having a solution like Veeam for Microsoft 365 allows the Service Provider and end-user to protect their data that resides in the Microsoft Cloud.  This can be on-premise for both the end-user and provider or within the Service Providers infrastructure for the end-user.

This will conclude Part 1 of the Veeam Backup for Microsoft 365 backup series.  In part 2 I will start to get in to the application for Veeam and discuss some configuration and best practices.  For now I will also leave these URLs below for resources and references regarding Veeam Backup for Microsoft 365.

 

Veeam Backup for Microsoft 365 - https://www.veeam.com/backup-microsoft-office-365.html

And another great resource recently released by Dave Kawula, Cristal Kawula, and Cary Sun -

Veeam Backup for Microsoft 365: Operational Guide

 

One thing I’ll add Chris is a lot of people sometimes wonder if they need a backup. You identify points above, I like to do a Google (or Bing!) search of the following:

Recover M365 from ransomware

Ignore the first few ads (Veeam included LOL) and the first substantive search result should be this page: Recover from a ransomware attack - Office 365 | Microsoft Docs

Note the word backup is mentioned in there 9 times. You need a backup for M356 data.

One thing I’ll add Chris is a lot of people sometimes wonder if they need a backup.

 

It’s interesting because I can’t say that my clients know or don’t know if their M365 needs backups before I talk about it.  Each and every migration/deployment of M365 I automatically add backups of their data to, and they simply agree with it.  Either they never thought of it and just agree with it or they already knew because it’s never really been a question.  Same goes for if we onboard a client already in M365.  It just paired up with spam filtering and both services are genearally just assumed to be required, but of a client set themselves up, I can certainly see that being overlooked until it’s talked about.

 

My concern is always for other products/tools that reside in the cloud for my clients on how it’s backed up.  Obviously Veeam can do SalesForce, but for me it’s more about the EMR/EHR’s, Quickbooks online, etc.

One thing I’ll add Chris is a lot of people sometimes wonder if they need a backup. You identify points above, I like to do a Google (or Bing!) search of the following:

Recover M365 from ransomware

Ignore the first few ads (Veeam included LOL) and the first substantive search result should be this page: Recover from a ransomware attack - Office 365 | Microsoft Docs

Note the word backup is mentioned in there 9 times. You need a backup for M356 data.

Thanks Rick.  I can add this to part 2 of the series and start with that.  I can also add this link to my blog too.  Appreciate the feedback. 😁

One thing I’ll add Chris is a lot of people sometimes wonder if they need a backup. You identify points above, I like to do a Google (or Bing!) search of the following:

Recover M365 from ransomware

Ignore the first few ads (Veeam included LOL) and the first substantive search result should be this page: Recover from a ransomware attack - Office 365 | Microsoft Docs

Note the word backup is mentioned in there 9 times. You need a backup for M356 data.

Added to the blog - not updating the post above but it is in my blog site. 😎

Great graphical representation of the shared responsibilities and points shared @Chris.Childerhose! Thanks to @Rick Vanover for always complementing our guides.. 

Great graphical representation of the shared responsibilities and points shared @Chris.Childerhose! Thanks to @Rick Vanover for always complementing our guides.. 

Thanks. Yes always glad to have Rick chime in. 👍

One thing I’ll add Chris is a lot of people sometimes wonder if they need a backup.

 

It’s interesting because I can’t say that my clients know or don’t know if their M365 needs backups before I talk about it.  Each and every migration/deployment of M365 I automatically add backups of their data to, and they simply agree with it.  Either they never thought of it and just agree with it or they already knew because it’s never really been a question.  Same goes for if we onboard a client already in M365.  It just paired up with spam filtering and both services are genearally just assumed to be required, but of a client set themselves up, I can certainly see that being overlooked until it’s talked about.

 

My concern is always for other products/tools that reside in the cloud for my clients on how it’s backed up.  Obviously Veeam can do SalesForce, but for me it’s more about the EMR/EHR’s, Quickbooks online, etc.

We tend to also do deployments with Backup already included so the end users don’t have to worry about it. When they do ask, we say we already have them covered!

Brilliant post @Chris.Childerhose It’ll come in very useful when convincing users why backsup are always needed, even in the cloud.

Brilliant post @Chris.Childerhose It’ll come in very useful when convincing users why backsup are always needed, even in the cloud.

Thanks.  Stay tuned as this will be a multi-part piece. 😁

Comment


Terms & Conditions