The Backup Limitations of Microsoft Office 365 Common retention misunderstandings demystified. BACKUP BASICS

Perception versus reality You may be asking — why do I need backup? Microsoft backs everything up for me. Not so fast! Microsoft is only responsible for the Office 365 infrastructure. Not the data. Perception Microsoft backs up all Office 365 data Reality Truth be told — your perceptions about what is actually being backed up versus what is really being backed up are probably out of sync. This is understandable. The rapid adoption of the cloud and popular ecosystems such as Office 365 have left little time for proper education. SharePoint & OneDrive are backed up Calendars & tasks are backed up The reality: Microsoft is not in the backup-as- a-service (BaaS) business. With Office 365, it’s your data. You own it. You control it. You are responsible for it. Period. Emails & attachments are backed up Deleted files are backed up

Office 365 data responsibility grid Source: https://tinyurl.com/za2x3vl PRIMARY SUPPORTING REGULATIONS SECURITY Infrastructure and Uptime of the Cloud and the Apps Within Office 365 Recycle Bin (aka Trash) as temporary Data Recovery Data Processor Role providing privacy tools, regulatory controls, industry certs, HIPAA, etc. IT Structural Role providing user & admin security, physical security, app security, etc. Microsoft’s Responsibility Data Center Geo Redundancy Office 365 Backup External copies of All Data across All Apps Internal Data issues such as Accidental Employee Theft and Accidental Deletion to External Data issues like Phishing and Ransomware Manage Data according to Regulatory Rules, and Internal Compliance, HR & Legal requests Access/Control of Your Office 365 Data in Exchange Online, SharePoint, OneDrive, etc. Your Responsibility Data Storage, Retention & Recovery

Data retention: What Microsoft backs up 7 DAYS 30 DAYS 90 DAYS 1 YEAR 2 YEARS 5 YEARS Inbox or Folder Data Within O365 Moved to Archive Deleted Items (Recycle Bin) Permanently Deleted Auto Archived Data (Set at 1 Mo) Deleted SharePoint Sites / Items Recycle Bin 1 Recycle Bin 2 Deleted OneDrive Files Staff Leaves Company Note Microsoft administrators often misunderstand what backup is provided in Office 365 and what is not, then discovering too late that they cannot restore client data. A Dropsuite survey showed a high number of Admins were using the recycle bin as a backup repository. Recycle bins are trash cans, not a safe place to store valuable client data. Sources Microsoft Default MRM Policy: https://tinyurl.com/y943bm9h SharePoint Server backup: https://tinyurl.com/yadxa2dr OneDrive For Business File Restore: https://tinyurl.com/yasxm4pz Note: An admin may have the ability to extend retention rules based on the Office 365 license used, or Microsoft may alter retention rules.