Veeam O365 backups vs Exchange Online Litigation Hold

[Daveyd]

We current backup all of our Exchange on premise backups with Veeam. We are migrating our 1600 mailboxes from on premise Exchange 2010 to O365/Exchange Online.

If our Organization only requires 90 days of Mailbox retention, why would we need Veeam’s Office 365 backup solution when we could theoretically put all of our Exchange Online mailboxes on Litigation Hold for our requirement of 90 days, thereby effectively retaining all user’s email and mailboxes for 90 days with the ability to recover emails back to 90 days. In this scenario, Microsoft themselves would be housing the data on their dime.

This was a question posed to me by Management.

[fgiugliano]

What if there's some catastrophic failure at Microsoft and they accidentally wiped out all of your user data?

[alesovodvojce]

Hi, we are evaluating this option too. Is that true what Daveyd wrote?

If so, then
1) could we multiply the benefit by using Litigation hold AND Veeam O365 backups? Litigation hold will be 90 days and Veeeam will be running backup every 80 days (for example). This way we will lower the costs for backup storage space and network bandwidth... and still should have backed up all mail every time
2) will litigation hold protect us against let's say ransomware, that have gained domain admin rights and deleted users from AD (hence deleting their O365 mailbox as well)?

Regards
Petr

[Daveyd]

What if there's some catastrophic failure at Microsoft and they accidentally wiped out all of your user data?

While a highly unlikely scenario, that is not outside the realm of possibility.

Other pros and cons are appreciated

[Mike Resseler]

Dave,

You are right that a catastrophic failure is highly unlikely but still possible. But there are other differences you need to take into account. What if you are in a financial dispute and they locked access to your subscription.

Litigation hold comes with two questions: What to hold / How long to hold. It comes with an additional cost (depending on the subscription I believe). If you use litigation hold, I still believe VBO makes sense as backup since litigation hold isn't backup. It also brings your emails to another location and can be used to export to PST or even export to a running Exchange server on-prem for testing / DR scenario's or something like that.

A combination can be used also and might be of interest depending on your needs.

But in the end, if your company only needs 90 days of "retention" then you might indeed have enough with litigation hold alone (with the cons of being MSFT only) or you might want to consider a litigation hold and backup from us for e-discovery reasons on-prem, testing purposes or a way to make sure you can "exit" O365 when necessary and keep longer retention by combining VBO on a VM and backup that VM with VBR.

Just some thoughts
Mike

[dellock6]

I'd be really doubtful that no email will ever be needed to be restored that is older than 90 days...

[fgiugliano]

Here's an example that happened to me last year, had Veeam O365 been around then, would of been amazing...
We had a sink hole open up at one of our plants it was huge, very expensive.
We got into a dispute with our insurance company as they didn't want to pay our claim.
The CEO came to me and said the lawyers are asking for all emails related to the sink hole incident for the last year, this was a list of like 10 different people who were involved with the whole situation.
90% of our employees are webmail only, the ones using outlook I had to remote in and drag their files into a folder, the ones that were web only, I had to connect via outllook and then do manually.
I could of used VO365 to open a user's backup and exported the emails I needed into a pst right from my computer without bothering anyone.
Would of saved a ton of time, but also a lot of those emails were way over 90 days had a user deleted any thing critical to the claim, we could of end up paying over 200K in repairs out of pocket.

[Daveyd]

I'd be really doubtful that no email will ever be needed to be restored that is older than 90 days...

My thoughts exactly, however if our Organization's policy is only a 90 day retention, then that is what we have to deal with.

[Daveyd]

Dave,

You are right that a catastrophic failure is highly unlikely but still possible. But there are other differences you need to take into account. What if you are in a financial dispute and they locked access to your subscription.

Litigation hold comes with two questions: What to hold / How long to hold. It comes with an additional cost (depending on the subscription I believe). If you use litigation hold, I still believe VBO makes sense as backup since litigation hold isn't backup. It also brings your emails to another location and can be used to export to PST or even export to a running Exchange server on-prem for testing / DR scenario's or something like that.

A combination can be used also and might be of interest depending on your needs.

But in the end, if your company only needs 90 days of "retention" then you might indeed have enough with litigation hold alone (with the cons of being MSFT only) or you might want to consider a litigation hold and backup from us for e-discovery reasons on-prem, testing purposes or a way to make sure you can "exit" O365 when necessary and keep longer retention by combining VBO on a VM and backup that VM with VBR.

Just some thoughts
Mike

Thanks Mike. I agree with all your points. I am trying to make a case for using Veeam to backup EOL as I definitely see the advantages, although it is financially enticing to put all EOL mailboxes on Litigation Hold for 90 days (we do own the correct licenses - E3 and Exchange Online Plan 2) and have Microsoft store the data at no additional cost to us.