Many organisations that use Microsoft 365 make wrong assumptions about the security of the data that’s held and collaborated on every day in the Microsoft Office suite. And some of these assumptions can prove costly in the event of a cyber or malicious insider attack. Even a seemingly trivial mistake made by an individual, like deleting a Microsoft team at a stroke deletes documents, Teams chats, planner boards, OneNotes, and so on, often representing months of work.

Many organisations don’t think about these possibilities until a critical incident occurs. Of course, it may be too late by then to recover from a ransomware demand, a loss of intellectual property, or the setback caused by important data that’s been deleted.

The bottom line is that the least terrible thing that can happen will be an interruption to production or workflow, with associated costs. The worst is that the business may be unable to bear the cost of recovery from a ransomware attack (an eye-watering average of $3.35m this year) and cease to exist. We all face this reality in 2022, with ransomware attacks getting bolder and smarter and more of our daily business activities “going digital.”

It’s understandable that Microsoft as a company takes a security-first approach to protect its infrastructure from compromise of all sorts, but M365 tools cannot roll back entire SharePoint sites, mailboxes or Teams Groups when things go badly wrong. But the broad-brush approach isn’t practical in protecting critical data that changes all the time and that people and systems rely on. When margins are tight, the ability to roll back just a few hours can preserve business continuity and get the organisation back on track – before a single client notices.

Speaking exclusively to Tech Wire Asia, Max McNamara, the Director of Solution Engineering of AvePoint Australia, said, “88% of company Boards now actually believe that cybersecurity is a business risk rather than a IT risk – i.e., it’s a business problem, not an IT problem. So, they’re actually saying ‘this is a problem, we need to solve at a company level.’ [A data loss] is not just going to cost money, it’s the reputational damage, the intangible value of the brand that you can’t measure.”

Experienced IT professionals know the value of sound backup and recovery strategies but also know that implementing and practising them can be complex and, therefore, often expensive. Backups and replications must be prioritised, made to happen often, and executed in ways that remain compliant with the organisation’s data policies. Restoring lost information – often in a very granular way – is also essential and needs to be rehearsed and quickly achievable.

It’s difficult to establish these types of procedures inside the Microsoft 365 environment, and many administrators don’t realise what the limits are on their abilities until some disaster takes place. Board-level decisions to invest in cybersecurity insurance are increasingly less effective, with some insurance companies not paying out in circumstances where the insured has not been meticulously proactive.

Business continuity today effectively mirrors data continuity so even small mistakes made by non-IT staff are amplified. The permanent deletion of an email or OneDrive folder is simply done, but can have serious consequences because rolling back to last week’s backup may also roll back the user’s entire profile – at the cost of hours and hours of correspondence and work.

Further up the food chain, IT administrators working in Microsoft 365 are also human. As Max points out, “An example would be security settings in the platform, or user identities – [information] that doesn’t have a versioning history, and [data] that’s not natively kept in the M365 platform. Once they’re changed or deleted, it can take three to four days to manually unpick a change that could have been rolled back within minutes had a backup been in place.”

Few companies offer the type of compliant, granular and comprehensive backup and restore of Microsoft 365 workflows that AvePoint does. Its users can rely on data replication up to four times daily, with information securely held in a different cloud location. Pulling data back happens through a single-pane-of-glass interface so IT administrators can easily and very quickly locate what’s needed and restore it to where it’s wanted.

There’s a choice of where snapshots and archives are held, so if organisations already have cloud capacity, that may be the logical choice. AvePoint also has its own highly secure cloud operations, so the simplest and fastest solution may be to leverage that.

John Hodges, the SVP of Product Strategy at AvePoint, said “Let’s take the intangible cloud and make it something tangible that I can look at, and know that my data is nearby.”

Regardless of your off-site backup preferences, AvePoint Cloud Backup covers Groups, Teams, Office, SharePoint, Exchange, and Project Online, and OneDrive for Business. Backups are fully automated and require no manual exports or .csv files. Snapshots are taken in real-time too, so there’s no need to shut down or pause services like Exchange to be assured of database integrity.

Many organisations’ decision-makers are unaware of how deeply their business has become invested in the Microsoft 365 eco-system. As an environment that seamlessly helps companies collaborate, create, and communicate, most users simply default to the platform to complete the majority of tasks. It’s only when a mistake is made or an attack (internal or external) occurs that recovery from an issue becomes a thorny problem.

Investigating the detail of the scope of your company’s agreements with Microsoft for M365 is an excellent investment to make right now. For advice on the best ways and available tools to protect critical data and workflows, we recommend the team at AvePoint. Get in touch with the company here.