Do you need to make Exchange Online backups?

Moving from on-premises Exchange into Exchange Online is a big change for multiple reasons. These are different systems that require different administration strategies.

For administrators, one of the best reasons for moving to a cloud service such as Office 365 is that a lot of the tedious and difficult tasks are done for you. Building new servers, checking hard drives for enough space, replacing failed hardware, patching systems and making backups are areas that Microsoft and other cloud service providers will handle for your organization. But one area that requires some attention is Exchange Online backups.

We make backups for on-premises systems, so the same thing goes for a cloud service, right? It's a complicated question, and the answer depends on who you ask.

Microsoft says Exchange Online backups aren't necessary because it deploys hosted email in Office 365 in a way removes the need for traditional backups, specifically through its use of Exchange Native Data Protection (NDP). NDP is a collection of features that includes:

• A minimum of four copies of every mailbox in at least two data centers.
• The single item retention feature that gives users up to 30 days to restore deleted mailbox items.
• The default retention setting in Exchange Online that does not purge mailbox items.
• Microsoft can restore a copy of the Exchange Online database during a period of up to 14 days using point-in-time snapshot with lagged databases.

Third-party vendors that sell backup products will tell you the Office 365 backup arrangement isn't good enough because it fails to fill the gaps in several areas:

• Rouge administrators. If someone in your IT department deletes user data, then there is little Microsoft can do to recover that material.
• Malware/ransomware. If a user introduces a ransomware infection that encrypts your data in place, there is nothing Microsoft can do to restore that data.
• Data loss from Microsoft's end. If some calamity occurs within Microsoft's data centers that completely deletes your data, then Microsoft will have no way to perform a recovery.
• User error. If users delete their own data accidentally, then recovery through features such as single item recovery and legal hold might be possible if the administrator put those features in place.

For the most part, these reasons by these third-party vendors are overstated. If you sell an Exchange Online backup product, then you have to market your offering to prospective clients. But there is a grain of truth that there is a chance something could happen to your data in Exchange Online.

Anything is possible. Without traditional backups, you could lose valuable data. It's your responsibility as the Exchange Online administrator to understand the built-in recovery options offered by Microsoft and determine if those features are enough to meet your organization's needs.

Do you know what I never hear these third-party providers talking about with their Exchange Online backup products? Restores.

Consider this scenario: You're the CIO of a company with 5,000 users who moved to Exchange Online. Say the average user uses 50% of the space in his or her mailbox. You buy a third-party Exchange Online backup product that stores all your data every night.

You come into work on Monday morning and discover your Exchange Online data is gone. You check the online dashboard for your third-party backup product and see that it completed a full backup shortly before the outage started.

Where are you going to restore all that data? In this scenario, you need to restore 250,000 GB of mailbox data. Depending on the cause of the outage, you may not be able to restore that data into Exchange Online. It seems unlikely that you would have the on-premises infrastructure capable of handling a restore of that size. Wherever you decide to restore that data, it's certainly going to take a long time to get done.