Disclaimer: Microsoft Office 365 is embedded within Microsoft 365. Nonetheless, Office 365 and Microsoft 365 are often used interchangeably to describe the complete service. We will follow this practice throughout the article.
Microsoft 365 is a virtual version of the offline Microsoft Office software, with several extra options to access — Outlook, SharePoint, Exchange, OneDrive and Teams.
Microsoft 365 is a cloud service allowing individual users to access their data from anywhere, at any time.
While online access is convenient, users must mitigate the risk of data loss and avoid losing access to their email. If left unprotected, M365 can pose data control issues, security vulnerabilities, and regulatory exposure. (the latter concerns businesses only)
Now, many users perceive that Microsoft 365 takes care of everything, from data storage to cybersecurity enhancement. However, that's not the case.
Microsoft's primary purpose for Office 365 is to maintain uptime of the service at all costs.
They ensure constant data access to users via data replication and datacenter-to-datacenter geo-redundancy. This way, if a data center fails, the user will be switched to another one and won't notice any downtime regarding data access.
Nonetheless, Office 365 enables data access in whatever form the user has provided. And if data gets corrupted accidentally due to a disaster or a cyberattack, things can get nasty.
"Why?" you say. Let's explore.
See, Microsoft simply ensures that your data is available. The service isn't concerned with the readability of the data. Period.
Office 365 covers infrastructure-level security — physical, logical and application-level security. On the other hand, the user is responsible for internal and external data security.
Internal Security refers to countering accidental file deletion, unauthorized access to malicious third parties, employee error, etc.
External Security refers to countering malware attacks (specifically, ransomware), viruses, rogue apps and similar threats.
To summarize, Microsoft is responsible for processing your data and allowing continuous access to it. You, as a user, are responsible for keeping data going into the platform secure and in a readable (not corrupted) state.
Suppose you're using Office 365 as a primary service. In that case, you probably have files and documents related to various programs and platforms: Word, Excel, PowerPoint, Publisher, Access, Teams, Exchange, OneDrive, SharePoint and most importantly, Outlook.
We specifically list Outlook last, not because it's least important, but due to its critical nature to individual users and businesses.
Email access and contents are vital to any user, even if you only use Outlook for personal correspondence. If you rely on the email service for work projects as well, then it's even more crucial to keep it secure.
If the data set for migration to Office 365 gets corrupted, the service will sync the contents of your account with the corrupted file. In such a scenario, you can suffer from limited data access and control, data loss, enhanced security vulnerabilities, and regulatory exposure (again, the latter regards businesses).
This is why it's best to have a reliable backup of your data in a separate physical location or the cloud. If disaster strikes, you can restore your system to a secure state, sync your Office 365 account and proceed with your day.
If you don't have copies of your data in secure storage, even a single corrupted file can wreak havoc on your data residing on primary devices and in Office 365.
This article will explore email backup from all sides — what it is, why to do it, and how to do it adequately.
Let's dive in!
What is Email Backup?
Keeping emails secure and accessible can be approached in two primary ways – email archiving and email backup.
While many users perceive the two approaches as interchangeable, they are different. Let's explore why archiving and backup differ, so we can toss the first and focus solely on the latter in this article.
Email archiving aims to store copies of all your emails, including any file attachments, for an indefinite time. It keeps archives as exact copies of the originals, with quick find options and permanent availability.
Even if the corresponding email server is temporarily down, you could still access archived emails.
The main use cases for email archiving are:
- To eliminate mailbox quotas and PST files
- To reduce storage requirements via de-duplication and compression
- To aid backup and restore processes and alleviate email workloads
- To enable complete and tamper-proof email retention in the long run
- Fast searches via full-text indexing
- To restore lost emails quickly
On the other hand, email backup stores data and systems (the emails and the email server) regularly for short- and medium-term purposes. It provides a snapshot of entire data sets, which can be sent to physical or cloud storage.
If an incident occurs – system failure, power surge, malware attack, human-inflicted error – you can restore a complete copy of your backed-up data from storage. The process is commonly known as "disaster recovery".
The primary use cases for email backup are:
- To eliminate PST files
- To reduce storage requirements via de-duplication and compression
- To provide a complete, tamper-proof email history for short-, medium-, or long-term, depending on your backup practices
- To enable quick searches via full-text indexing
- To restore lost or otherwise corrupted emails easily
Both approaches can be used to assist in meeting regulatory compliances for businesses.
However, if you're a small business owner, it's best to rely on backup rather than archiving. Backup allows for more robust cybersecurity tools and can be used on all types of data besides emails, especially if you subscribe to a reliable backup solution.
Even if you choose to use archiving as the primary method of keeping emails accessible, it's recommended to backup email archives to fortify them further.
Why would I need to back up my Microsoft 365?
We've discussed some reasons for backing up your Microsoft 365, but there's more.
Firstly, many users perceive OneDrive as a complete cloud backup service. Nonetheless, OneDrive only stores a synchronized copy of your files in the Microsoft cloud.
This means that OneDrive will periodically mimic your machine's files (and their state) and update the copy in cloud storage. If you delete a file or a document, or if data gets corrupted on your local device, the change will automatically transfer to OneDrive.
To keep it simple — if a file is deleted or infected on a primary device, it will be deleted or infected on all synchronized devices.
With a dedicated Outlook backup solution, you wouldn't have to worry about OneDrive syncing a compromised file; you'd have all essential data in secure storage, ready for restoration.
Aside from OneDrive lacking true backup capabilities, there are several other drawbacks to skipping on a backup solution.
Let's go over them below.
- Microsoft service outages (or disruptions) may result in downtime and data loss
Even if we're talking about a tech giant, power surges and service disruptions aren't unusual for Microsoft. They can result from software or hardware failure — regardless of the reason, you may lose temporary or permanent access to your data.
When an outage occurs, you won't have control over it. You'd depend on Microsoft to fix the issue and resume their services. If you don't have a backup of your data in external storage, you'd be a sitting duck until you can proceed with your day-to-day or work projects.
As an individual user, you may not find downtime annoying. However, small business owners may feel differently.
According to an Infrascale report from 2020, 25% of SMBs reported an average per-hour downtime cost between $20,001 and $40,000. Even if most downtime doesn't last a full hour, 17% of those surveyed experienced it for just that amount, while 6% said downtime lasted more than an hour.
While most SMBs shared that downtime occurs from five to 30 minutes, running an SMB is different from having the resources of an enterprise. Every dollar can make a difference, especially if you're running a fresh startup.
And as Microsoft states in its Microsoft services agreement, they're not responsible for your data during outages and disruptions. So, if downtime strikes, you're on your own to restore your working processes as quickly as possible.
- Office 365 recovery tools are limited
Office 365 enables deleted items recovery. Nonetheless, its native tools are minimal.
The basic recovery options allow restoring accidentally deleted emails via the Deleted Items tab. However, the feature works only for recently deleted files; long-deleted, erased files, compromised mailboxes or failed migrations are all out of Microsoft's restoring capabilities.
We're going to explore the cons of the native recovery tool below:
- Time-limited recovery
The default retention time for data kept in Office 365 is 14 days. It can go up to 30 if you play around with preference settings. However, purged items or items that have been deleted for more than 30 days are gone for good.
Unless you have a Microsoft 365 backup on an external drive or a dedicated cloud, you won't be able to restore such items.
- Lacks point-in-time recovery option
If your mailbox suffers corruption with the version history option turned off, you may be in trouble.
As M365 doesn't offer a point-in-time recovery, you can't select a "clean" version of your data and restore it. This, in turn, means that your data will be lost for good.
- Restoration process is complicated
Dedicated backup and recovery solutions provide users with the most intuitive interface. As they are designed to support backup and disaster recovery processes, even a beginner can navigate the software.
However, Office 365 is built to provide data access, not data recovery.
Compared to professional solutions, 0365's recovery is time consuming and sometimes challenging. Its recovery option is placed in the In-Place eDiscovery and Hold feature. The feature has many steps and conditions to complete before you can recover data.
- Doesn't follow the best practices in user data backup
We've ranted on about the 3-2-1 backup rule before. We do it because it's crucial regarding data security and integrity.
Having three separate backups stored on two media carriers, with at least one of them off-site, is the best approach to comprehensive backup.
On the other hand, Microsoft stores cloud backup data in the same location as the source data. So, the backup is vulnerable to the same threats as the source data, which doesn't contribute anything to your data's security.
However, M365 isn't a backup solution, and as such, it's not supposed to provide the best backup practices.
- Perma-deletion in Office 365 is irreversible
There are two ways to delete data on almost any media carrier:
- Soft-deletion (temporary) that allows for data recovery, and
- Hard-deletion (permanent) that doesn't allow for data recovery without a backup
Unless you have a backup, data in O365 is permanently lost for restoration in the following cases:
- When you temporarily delete it (soft-delete) and don't restore it for longer than 30 days;
- When you manually remove the data from the Recoverable Items folder;
- When you delete the user account associated with the data
- When you hard-delete a file in M365
Now, the last case carries an exception. If a hard-deleted file were previously preserved by the retention policy, you'd be able to access it via eDiscovery. Nonetheless, eDiscovery is designed to retain data to use as evidence in a legal case, not to restore data for users.
In addition, eDiscovery is available only to higher Office 365 subscription plans.
- Office 365 account deletion also deletes all data on said account
Office 365 account deletion is standard practice for companies. For individuals — not so much. However, home users and SMBs can still suffer from O365 account deletion in several cases:
- Following a data migration to another account or a data management suite
- As a result of an accidental account deletion
- As a result of a malicious account deletion (be it internal or following a successful cyberattack)
Regardless of the reasons, deleting an M365 account erases all its data.
Microsoft has included all possible account deletion scenarios in their services agreement and recommends regular data backups to secure data access in such an event.
- Office 365 isn't designed to counter all potential external threats
We've mentioned that O365 doesn't follow best backup practices. In addition, it also lacks the means to protect your data from all external cyber threats.
Ransomware, viruses, malicious apps, hijacking, and data theft pose a severe risk to your data's safety. Microsoft 365 offers a range of security tools, so users can set phishing protection preferences, basic data loss prevention, manage access and threat levels, etc.
However, Microsoft supports the "shared responsibility" data security model.
They imply that you are part of a security and compliance partnership. While Microsoft protects 365 services, you are responsible for securing stored data, identities and devices.
This is why it's best to rely on a third-party cybersecurity solution. Having the most optimal protection against all threats is the surest way to be chill about the safety of your data.
What can be backed up from Microsoft 365?
As we've mentioned, M365 doesn't support a native backup solution.
You can use the rollback option to "reverse" OneDrive to a version up to 30 days old and recover soft-deleted files. However, contacts and calendars you store on OneDrive are nonrecoverable.
Now, say you have a dedicated backup solution on your side. If the service is advanced enough, you'd be able to backup virtually any data from Microsoft 365.
Starting with the most crucial for many individual users, you can keep Outlook.com emails secure in storage. The same goes for OneDrive — you can initiate regular backups to a third-party cloud and guarantee your data is accessible at all times.
With Acronis, you can send your Microsoft 365 mailbox and OneDrive content directly to the Acronis cloud. The backups will also preserve email attachments, so you don't have to back up those separately. The same goes for OneDrive files, folders and subfolders.
You can also backup Microsoft Exchange Server contents — emails, calendars, contacts, archives, planning data and project files. You can access the above from a smartphone, tablet, PC, laptop or any other web-based system.
As for the SharePoint Server, you can backup content, knowledge base, news, applications and data.
If you're also using Microsoft Teams, you can backup archived messages, meetings schedules, apps, files and other personal or business-related data.
Your backup volumes may vary depending on your purposes for using Microsoft 365. However, Acronis Cyber Protect Home Office will update existing backups to keep storage space optimized.
Nonetheless, you can instruct the software to create fresh backups if you wish to save different versions of your data on the cloud.
Ways to backup Microsoft 365
Let's explore both approaches below.
Manual Microsoft 365 backup
Manual M365 backup uses the e-Discovery feature and follows three phases.
- Assign an e-Discovery admin
- Initiate a new content search
- Export searched results to PST
Below are the system requirements to enable manual PST backup:
- Windows 7 or above, 32-bit or 64-bit version
- Internet Explorer 8 or above
- NET Framework 4.5
If you don't like using Internet Explorer, you can install click-once add ins for Chrome or Firefox.
Now, off to the steps to perform the manual backup:
- Log into your O365 account with administrator credentials
- Open the Admin center → select the Security option
- Go for the Permission option (from the left pane) → choose "e-Discovery manager" from the list
- Once a new window pops, select the "Edit" button (opposite the e-Discovery admin)
- Select the e-Discovery administrator → click "Save"
- From the left pane, go for the Search option → select "Content search"
- A new window will pop up → here, click on the "New search" option
- Type in the name and description for your search → click "Next"
- A location window will pop up → here, select the Locations or manually search for mailboxes you want to backup via the PST file → click "Next"
- Choose the keywords and apply conditions as needed → click "Next"
- Review the search settings; if you want to change them, click "Back"; if not, click "Submit"
- Select the created search from the search list → click "Action"
- Select the “Export result” option → choose an output option → click on “Export”
- Go to the "Exports" tab, select the last export and go for the "Download results" button → scroll down and copy the Export key
- The e-Discovery export tool will pop open → paste the copied export key → browse locations to save the PST file.
- Click "Start" → e-Discovery will begin an O365 backup process
Even if you get the hang of manual backups, they have some limitations worth exploring.
Firstly, manual backup is a time-consuming and more complicated process. It also fails to backup specific data. (contacts, calendars)
In addition, you'd need at least a bit of technical knowledge before performing a manual backup. Lastly, there's a high chance for data alteration and no complete guarantee for a full, accurate backup.
To summarize, manual backup may be challenging for casual or inexperienced users. Nonetheless, if you're confident in your tech skills, you can play around with the backup settings and successfully create a satisfactory manual backup.
Additionally, you need access to reliable storage — preferably, an encrypted, external HDD or a dedicated cloud service.
If you prefer to automate backups and cut down on effort and nerves, let's explore how to do it correctly below.
Automated Microsoft 365 backup
Below, we'll explain how to automate backups using Acronis Cyber Protect Home Office.
- Firstly, log into your Cyber Protect Home Office account → go to "Devices"
Here, you'll see two sections labeled "Office 365". One relates to local agent backup, and the other enables cloud-to-cloud backup. The local agent only offers an Exchange backup but can send it to a local repository.
The cloud-to-cloud option can't send backups to local storage but enables SharePoint and OneDrive backup and recovery.
- If you want to initiate a full M365 backup, go for the Microsoft Office 365 cloud option
- Once you open the cloud menu, choose an account to add a backup plan to
- Once you've selected an account, click on "Backup" on the right pane
- Then go for the "Add a backup plan" → "Create new"
- At the top of the menu, you can choose what to back up — Office 365 mailboxes, SharePoint or OneDrive
- The second option lets you decide where to send the backups; however, as you're using the cloud option, backups can only reside in cloud storage
- The third option relates to backup frequency; with cloud-to-cloud backups, you can initiate backup as often as once per day
- The fourth menu option lets you choose the backup retention period — this option determines how long Acronis will hold your backups on the cloud; you can set the timeframe for daily, weekly, and monthly backups here
- In addition, you can choose whether to "Archive mailbox" before transferring it to the cloud; the same goes for applying encryption
Once you've set up and completed at least a single backup, you can go back to the main menu and choose to recover either the entire OneDrive backup or individual files or folders.
As for Outlook backup, you can choose to recover the entire mailbox or individual email messages.
All backups can be recovered to the original account or any other account in the subscription group.
Do I need software to backup Microsoft 365?
Regarding Microsoft 365, almost all backup options here rely on software.
An exception can be an absolute manual backup, where you archive emails and copy and paste them to an external media carrier.
If you have the patience and free time, go for it. However, there are quicker and more convenient methods to back up your data.
We've gone over the cons of the native backup options for Microsoft 365, so we won't dwell on them again. Instead, we want to explore the benefits of automated, paid backup solutions for individual users and SMBs below.
Easy file access
Office 365's purpose is to enable quick file access to all users. However, if the service is down for whatever reason, you won't be able to access your files from any device.
If you keep a backup on a dedicated cloud, you'd always have access to your data. In addition, you'd be able to recover backups from any device, as long as it has an active account connected to your backup service.
Added cybersecurity features
Modern cybersecurity solutions offer anti-malware and antivirus protection alongside automated backup.
While M365 doesn't guarantee file protection (as this is your responsibility according to their shared responsibility model), it's best to safeguard your files to the maximum.
With Acronis, you can operate on any device in your group with anti-malware and antivirus protection enabled at all times. This minimizes the risk of getting a file corrupted and accidentally syncing it to OneDrive.
Moreover, encrypting backups ensures that even if a file or app on your primary device gets infected, you can recover a fresh, healthy version of it and proceed with your day.
Ease of use
Microsoft Office 365 isn't a data backup platform; it's logical for its backup options to be less optimized than dedicated backup solutions.
Instead of configuring e-Discovery backups whenever you want to back up your emails, you can automate backups and only access them when necessary.
If you're an individual user, it's easy to miss a backup if you get distracted. It's harder for small businesses to skip a backup, but the possibility is live unless you have a dedicated staff member to do it. Automation denies the risk of forgetting to initiate a backup.
Once you've set your backup preferences, the service will create and store backups regularly to local storage or the cloud.
Native cloud failure protection
If OneDrive suffers from downtime, you won't be able to access your data until the service is back on.
With a dedicated cloud backup solution, you'd benefit from a redundancy cloud structure. This means that even if one cloud goes offline, there's always another cloud to allow data access to users.
If you're responsible for your data's security, you might want to fortify it sensibly. The process can be tricky if you aren't using a comprehensive solution.
You'd need a solution to protect data at rest, another for backups, and maybe a third to help you with security patches.
Individuals and businesses can knock substantial weight off their shoulders with a dedicated data backup solution. While casual users can automate all data protection processes and save time and frustration, SMBs can calculate cybersecurity costs efficiently.
If implemented properly, a dedicated backup solution can save SMBs a lot of coins and ultimately raise their productivity while negating downtime.
Microsoft 365 backup software — Acronis Cyber Protect Home Office
Acronis Cyber Protect Home Office lets you backup critical Microsoft 365 and OneDrive data flexibly. The solution allows maximum security and ease of use, so even backup beginners can get the task done.
You don't have to use additional tools to back up different kinds of data. With Acronis, you can backup OneDrive files and folders, Outlook emails, individual email attachments, and even access permissions.
As for recovery, you can restore individual files or full backups in seconds, negating any potential downtime.
You can also choose recovery destinations — local storage for Exchange accounts and cloud storage for all else. Regardless of the selected repository, you can apply backup encryption and anti-ransomware protection for all data. Thanks to the advanced MI-based protection, the solution will detect potential threats to your data and negate them at sight.
Lastly, you can streamline endpoint protection easily via integrated and automated URL filtering, patch management, vulnerability assessments, and more.
Acronis is a Swiss company, founded in Singapore. Celebrating two decades of innovation, Acronis has more than 2,000 employees in 45 locations. Acronis Cyber Protect solution is available in 26 languages in over 150 countries and is used by 18,000 service providers to protect over 750,000 businesses.