Backing Up Microsoft 365 and SaaS Data: Who’s Responsible?
Software-as-a-service applications now hold a great deal of business-critical data. Email, documents, collaboration channels, customer records and project information increasingly reside in cloud applications rather than on servers the organization manages. A common assumption follows: the provider must be backing it all up. That assumption is often mistaken, and it can prove costly.
The Shared Responsibility Model
SaaS providers typically operate under a shared responsibility model. The provider is responsible for the availability and resilience of its infrastructure. It ensures the service runs, data centers are protected and hardware failures do not cause data loss. The customer, however, is generally responsible for its own data, including protecting it against deletion, corruption and malicious activity. Native retention features exist, but they are designed primarily for availability and compliance, not comprehensive backup and point-in-time recovery.
Common Data Loss Scenarios
Data in SaaS applications can be lost in many ways. Users delete files or emails accidentally. Departing employees’ accounts are removed, along with their data. Ransomware can encrypt synchronized files. Malicious insiders can delete information deliberately. Misconfigured retention policies can purge data unexpectedly. Native recycle bins and retention periods may not cover all of these scenarios or may expire before the loss is discovered.
What Third-Party Backup Provides
Dedicated SaaS backup solutions create independent copies of data outside the provider’s environment. They allow granular recovery of individual items, entire mailboxes or sites, and point-in-time restoration. Longer retention periods support compliance and protect against losses discovered late.
Where to Store SaaS Backups
Backups can be stored in a separate cloud, in the organization’s own data center or in a backup provider’s service. Storing backups outside the original provider’s environment adds a layer of protection against provider-wide issues and account compromise.
Security and Compliance
SaaS backups should be encrypted, protected by strong access controls and, ideally, immutable. Regulatory requirements may dictate retention periods and storage locations.
Including SaaS in Recovery Planning
SaaS data should be part of the organization’s overall backup and recovery strategy, with defined recovery objectives and regular testing.
The Bottom Line
SaaS providers protect their infrastructure, but customers are usually responsible for protecting their own data. Native features help but rarely provide complete backup and recovery. Independent SaaS backup protects against deletion, ransomware and insider threats. Organizations should review their provider agreements and close any gaps. Treating SaaS data with the same care as on-premises data is now a basic requirement of sound data protection.