The backup Microsoft never promised you

Confidence in an organization's cyber recovery capabilities deserves scrutiny.

If a ransomware attack disables the SaaS data tenanted in the Microsoft cloud ecosystem, the data the business depends on as its lifeblood, the pace at which operations resume rests on assumptions that often prove wrong.

Anyone whose answer is "It's all good.

Microsoft has my back on this one with its comprehensive native retention and recovery capabilities" is due a reality check.

With agile business tools like M365 and Entra ID and solid backend infrastructure in the form of Azure, Microsoft brings a lot to the SaaS party.

Both IT departments and MSPs need to be aware, however, that Redmond operates on the same shared responsibility model as other major SaaS providers.

In the event of a cyberattack, the recovery burden splits between what the cloud provider handles and what falls to the subscriber alone.

MSPs face the additional pressure of meeting stringent SLAs, working with clients’ preferred providers or tooling, and managing their own staffing and profitability accordingly.

Microsoft ensures that its services keep running in the aftermath of a strike but does not promise to restore data to a specific known good point before the disaster.

That gap always sat with the customer, and planning for it before problems hit beats improvising while picking up the pieces.

"There's a common misconception about what Microsoft is responsible for, as distinct from the service they're providing," explains Brent Torre, GM of cyber resilience .

Microsoft's native tools, he points out, address problems like short-term accidental deletion and aspects of data governance.

They are not a backup solution and will not protect against ransomware or recover data.

"Microsoft is clear that whether it's a SaaS application like Microsoft 365, a platform application like SQL Server, or even VMs running in Azure, the customer is always responsible for the information that's in that service, as well as devices, accounts and identities," he adds.