Without a doubt, Microsoft 365 is the world’s most popular productivity platform, and for good reason. It allows business productivity to continue and users to work from anywhere, anytime, as Microsoft hosts email, files, and SharePoint infrastructure, so you don’t have to.

Microsoft 365 offers many valuable services for businesses. Still, it may surprise you that a backup of your Office 365 data is not one of them.  If you are using Microsoft 365, it is critical to understand your responsibility to backup and secure your business-critical Office 365 data.

If you thought that Microsoft 365 protects your data from loss, breaches, and leakage, be aware that is not the case. Microsoft is responsible for providing the infrastructure that makes storing your data on the cloud possible. You are responsible for backing up your data and implementing security measures to protect your data.

“As the data owner, it is up to the customer to manage the risk of common data loss issues such as accidental deletion and ransomware. I recommend looking at a third-party backup tool to manage this risk.”[i]

— Erica Toelle, Microsoft MVP in Office Apps and Services

Microsoft’s Position: It’s Not Our Problem

According to Microsoft’s Shared Responsibility Model,[ii] you own your data, information, and identities. As the owner, you are responsible for these and your devices (PC and mobile). This means that you are responsible for securing your data and identities, on-site devices and resources, and any cloud components you may control. At the same time, Microsoft takes care of the Microsoft 365 physical hosts, networks, and datacenters required to keep cloud services operational.


With more people working remotely, the risks of email data breaches have only increased. Hybrid and remote working make it more challenging to prevent email data loss. An incredible 85% of Microsoft 365 users have experienced data loss during the past year.

“An Alarming 85% of Organizations Using Microsoft 365 Have Suffered Email Data Breaches”[iii]

— Business Wire

Can Microsoft 365 Keep Up with the Threat?

Microsoft 365 provides some native data loss prevention (DLP) capabilities. In theory, this is a good thing. DLP are tools and processes designed to prevent the misuse, unauthorized access, and loss of sensitive data. DLP can also generate reports to meet auditing and compliance requirements and aid in forensics and incident response by identifying vulnerabilities and irregularities.


Microsoft’s native DLP is available for SharePoint Online, OneDrive, and Exchange Online. It includes files shared through Teams, which uses SharePoint Online and OneDrive for file-sharing. Microsoft’s DLP protection searches for messages, files, and other documents that contain sensitive information and applies user-configured policies governing how the data is managed.


You might think that Microsoft has you covered; however, the reality is a bit different. According to a Business Wire report, businesses using Microsoft 365 experience more breaches, with more severe impacts:

• • 93% of Microsoft 365 users report negative consequences following an email data leak, compared to 84% of non-Microsoft 365 users.
  • 15% of Microsoft 365 users experienced over 500 data breaches during the past year, compared to 4% of non-Microsoft 365 users.
  • 100% of IT leaders utilizing static DLP within their Microsoft 365 environment were dissatisfied by its use. In comparison, only 14% of the firms not using Microsoft 365 expressed frustration with their DLP.

Email Data Breaches: Why It Matters

For those using Microsoft 365, data breaches occur far too often. You might think that DLP would prevent that, but Microsoft’s DLP tools can be frustrating to implement. They aren’t intelligent enough to catch human errors that result in data breaches and leaks through outbound email. They also require a high level of admin expertise to maintain.

“Microsoft 365 has seen phenomenal adoption during the COVID-19 pandemic and has brought cost and efficiency benefits to many organizations, but its security limitations are clear to see. We can’t ignore the risk of email data loss from Microsoft 365 and the limitations of static DLP solutions to mitigate the outbound email security risks that organizations face today.”[iv]

— Darren Cooper, Egress Chief Technology Officer

Can You Protect Sensitive Company Data?

In the age of COVID-19, remote and hybrid work environments are here to stay. Still, remote work increases the risks to data security. Home networks are typically more vulnerable than business networks. They are easier to hack than enterprise networks, and personal and business passwords and documents quickly become comingled. It is, therefore, no surprise that email data breaches have quickly become the top cybersecurity priority for all organizations. While it can be difficult for businesses to understand user behavior and how their data is shared online, this knowledge can be critical to staying proactive and maintaining intelligent solutions. This is where having a third-party partner can be invaluable in securing data and preventing data loss.

Every Business Needs a Local IT Partner

Jacksonville, Florida-based Kustura Technologies is a Managed IT Service and Support provider and Office 365 backup vendor that offers simplified, flexible processes which manage backup scheduling to meet any recovery time objective (RTO) or recovery point objective (RPO). They provide fast granular data recovery and advanced search capabilities that allow administrators to quickly find critical data required to operate, and even to meet legal and compliance needs. This not only includes data from key sources but also metadata and configurations for complete data protection and fast recovery from hacking, natural disasters, and even accidental deletion.


Kustura employs a comprehensive approach to data protection designed to make a recovery from data loss a simple and relatively painless process. You can recover hard deleted items, messages and mailboxes, tasks and contacts, litigation hold items, and more in just a few clicks. Their recovery solutions provide a wide range of saving, sending, and exporting options to get recovered data back where it belongs quickly.

Peace of Mind

Partnering with Kustura Technologies gives you options of where to deploy, where to store your data, and when to and what to backup. Their Data Loss Prevention Specialists can quickly assess your current data protection processes and tailor a solution to meet your needs. Click here to learn how easy it is to secure your data and enjoy peace of mind knowing your data is protected.

References:

[i] https://www.veeam.com/blog/native-office-365-backup-capabilities-versus-third-party-backup.html?ad=in-text-link

[ii] https://docs.microsoft.com/en-us/azure/security/fundamentals/shared-responsibility

[iii] https://www.businesswire.com/news/home/20210511005132/en/An-Alarming-85-of-Organizations-Using-Microsoft-365-Have-Suffered-Email-Data-Breaches-Research-by-Egress-Reveals

[iv] https://www.techrepublic.com/article/microsoft-365-email-data-breaches-take-center-stage-amid-wfh-in-a-new-report/