I wouldn't say you opened a can of worms. We have that discussion on a regular basis
MSFT indeed does journaling and infinite mailbox retention on certain licenses, but only after you have set it up as an administrator. It doesn't do that by default. Even then, as you said, that is NOT backup.
Microsoft still has limitations
- Restore of complete mailboxes or folder inside a mailbox
- e-discovery on Mails outside of the mailbox or to somewhere else
- protection from accidental deletion or violently (through Admins)
- Backup of hybrid exchange environments
- Search ability in objects, even with multiple or hybrid environments (Admin)
- What happens if your company goes into insolvency / bankruptcy and didn´t pay the bills to Microsoft. With a backup you can access data during the insolvency proceedings, even if Microsoft disables the accounts.
- Legal/ legislation could be another case depending on the vertical/ country. Some of those require you to have a copy of the data available at another location.
- Portability: Think of the GDPR regulation (but it is not the only one) that requires you to give the information about a certain user. If you demand it with Veeam (as an employee) we can easily export your data to a PST file and give it to you. Something which is very difficult through Exchange Online
- I think every organization should realize that the biggest "disasters" happen from user and/or admin mistakes. Where MSFT does provide some protection against it. If someone does the deletion, it is deleted.
- 3-2-1 rule as you said already yourself
Maybe one of the more important items is the responsibilities from MSFT versus the O365 customer.
MSFT is responsible for:
* Hardware failure
* Software Failure
* Natural disaster
* Power Outage
Customer is responsible for
* Human Error
* Programmatic errors (with plug-ins connecting to the service)
* Malicious insiders
* External Hackers
* Viruses/ Malware
Last but not least, on our website we have research from Gartner that you can look at: http://link.veeam.com/XEi0taB1pn00GB73j03LL40
The list is probably not even complete and others may even have more arguments. But this is what I could come up with during my morning coffee
Hope it helps