Do we really need Backup of O365 with E3 and E5 licenses?

[Fezanator]

Hello all,

I've had a conversation with another backup vendor in relation to O365 backup. Their stance is that you only need to back up data with E1 and E3 licenses as Microsoft does "journaling" and "infinite mailbox retention" on emails. Though it's not backup in the true sense of the word, it does question the need for an additional copy. I've actually come to question this approach due to the following reasons:

* I couldn't find anything that talks about "journaling" and "infinite mailbox retention" specific to E5 licenses. My sources are the following:
- https://www.networkworld.com/article/30 ... tml?page=3
- https://technet.microsoft.com/en-au/lib ... imits.aspx
* Given the 3-2-1 approach, I would still need to have an offsite copy of the data (though I would question the concept of having 2 copies onsite)

I may have opened a can of worms by posting this topic but I'd like to get your thoughts on the statement above.

Regards,

Fred

[Mike Resseler]

Hi Fred,

I wouldn't say you opened a can of worms. We have that discussion on a regular basis

MSFT indeed does journaling and infinite mailbox retention on certain licenses, but only after you have set it up as an administrator. It doesn't do that by default. Even then, as you said, that is NOT backup.

Microsoft still has limitations
- Restore of complete mailboxes or folder inside a mailbox
- e-discovery on Mails outside of the mailbox or to somewhere else
- protection from accidental deletion or violently (through Admins)
- Backup of hybrid exchange environments
- Search ability in objects, even with multiple or hybrid environments (Admin)
- What happens if your company goes into insolvency / bankruptcy and didn´t pay the bills to Microsoft. With a backup you can access data during the insolvency proceedings, even if Microsoft disables the accounts.
- Legal/ legislation could be another case depending on the vertical/ country. Some of those require you to have a copy of the data available at another location.
- Portability: Think of the GDPR regulation (but it is not the only one) that requires you to give the information about a certain user. If you demand it with Veeam (as an employee) we can easily export your data to a PST file and give it to you. Something which is very difficult through Exchange Online
- I think every organization should realize that the biggest "disasters" happen from user and/or admin mistakes. Where MSFT does provide some protection against it. If someone does the deletion, it is deleted.
- 3-2-1 rule as you said already yourself


Maybe one of the more important items is the responsibilities from MSFT versus the O365 customer.
MSFT is responsible for:
* Hardware failure
* Software Failure
* Natural disaster
* Power Outage
Customer is responsible for
* Human Error
* Programmatic errors (with plug-ins connecting to the service)
* Malicious insiders
* External Hackers
* Viruses/ Malware

Last but not least, on our website we have research from Gartner that you can look at: http://link.veeam.com/XEi0taB1pn00GB73j03LL40

The list is probably not even complete and others may even have more arguments. But this is what I could come up with during my morning coffee

Hope it helps
cheers
Mike

[JLundgren]

Hello Mike,

could you elaborate on the argument:

* e-discovery on Mails outside of the mailbox or to somewhere else

Exactly what can VBO do that O365 cannot ?


Regards,
JLundgren

[Mike Resseler]

Johnny,

When using VBO you will have the items outside of the Microsoft Online service. So you could use our Veeam explorer technology to do discovery on those items. (If you are familiar with those tools)

[JLundgren]

Thanks,

also what do you mean with exporting to a PST is difficult, as stated below ?

- Portability: Think of the GDPR regulation (but it is not the only one) that requires you to give the information about a certain user. If you demand it with Veeam (as an employee) we can easily export your data to a PST file and give it to you. Something which is very difficult through Exchange Online

Regards,
JLundgren

[Mike Resseler]

I will try to explain it with two examples. (Let me know if I fail)

1. An employee leaves the company.
Under GDPR, he/ she can request his/ hers data and as a company you need to deliver that in a readable format. Exporting the users data (for example, his folder private or HR or ... in his emails) can then be "restored" or exported to PST through our Veeam explorer and delivered to the person
2. A European citizen requests the data about him (maybe some project that was worked on)
Same system. Collect the right information/ emails/ calendar items/ ... and export it to a PST and deliver it

Makes sense?

Thanks
Mike

[JLundgren]

Yes, I understand. When the users data is spread out in different mailboxes and you need to pinpoint all of it for export.
Then the common 3rd party PST-export tools that exist (including Oulook itself) is not enough.

Thanks, Mike.