Data retention and backup are two essential pillars of data security and management for enterprise. For Microsoft 365 users, retention policies are available and can help manage important data and ensure compliance.

Features, like litigation hold, are often used for these purposes. However, there are significant drawbacks to Microsoft 365’s retention policies and relying on litigation hold as retention and backup--which could lead to irreparable damage to a company’s data operations, security, and liability.

Read on to learn how Microsoft 365 retention works for it’s different features, and how it can have significant drawbacks as a backup plan.

How Microsoft 365 Retention Works

In short, Microsoft 365 retention policies are only available to senior E3 and E5 Microsoft plans and their accounts. If included in Microsoft 365 plans, you can enable retention for most applications and their data. By turning retention data on, all existing data (at the time retention is turned on) is captured, as well as any subsequent data, and preserved for a set amount of time.

It’s important to note that each M365 application has different retention capabilities--and drawbacks-- which we’ve briefly summarized below.

  • SharePoint & OneDrive: Retention for SharePoint & OneDrive is available, but it doesn’t capture everything. When retention is enabled, versions are retained for libraries and folder structures can be recovered from eDiscovery. However, SharePoint memberships and sharing and access permissions aren’t preserved.
  • Exchange Online: Messages, attachments, and entire mailbox folder structures are preserved with retention. Site themes and settings, calendar items and tasks with no end date are not retained.
  • Teams: All Team chats and channels (both public and private) are retained. But, this does not include message attachments by default. To do so, users will have to separately enable retention for SharePoint and OneDrive users.
  • Groups & other: Retention policies can be enabled for Groups, but will only retain SharePoint data linked to Groups. Otherwise, any unlinked data will be lost. Additionally, no user membership, permissions, and other metadata is retained.

Many companies rely on M365 retention capabilities because it’s a direct feature and relatively easy to set up. While the convenience of enabling retention, like litigation hold, is tempting, there are some serious shortcomings in terms of data backup and security. Furthermore, users must have a thorough understanding and ability to set up retention across the board, to prevent any accidental data loss. If you don’t have a good grasp on the ins and outs of M365 retention policies, this only adds to the risk of losing data.

 

One primary feature M365 offers is litigation hold, which companies often lean on as their backup “plan.” In addition to the drawbacks of M365’s retention capabilities, we’re going to break down why litigation hold is also a risky backup plan.

The Shortcomings of Litigation Hold as Backup

As we mentioned above, litigation hold is often used as a backup plan, though that is not it’s primary intention or service. A litigation hold requires a company to preserve all data related to legal action. M365 offers some native functionality for litigation hold, but it is designed to preserve user data for e-discovery purposes--not restore lost data.

While some companies rely on litigation hold as a form of backup, it’s a common misconception that it will indeed backup and restore your data. In fact, there are some significant drawbacks of using litigation hold as your backup policy:

  • If data in M365 falls victim to a cyber attack and becomes encrypted, so will all the data on litigation hold. Although the data can’t be deleted, it also can't be restored--and gaining access to the data isn’t a guarantee. Considering how widespread ransomware is today, this alone is reason enough to deploy a third-party SaaS backup solution.
  • As a native feature of M365, litigation hold lives in the same environment as the data it’s holding. Meaning, if an encryption occurs, everything in the environment becomes susceptible--including data that may not be on litigation hold.
  • Data on litigation hold can still be altered, which can compromise a legal investigation and processes. If a document in OneDrive is created and placed on litigation hold, and then edits the document, users will only have access to that edited version of the document.
  • Older versions of files cannot be preserved when on litigation hold. Only the most recent version of a document is preserved, which means users lose and previous versions of files altogether.
  • The primary goal of litigation hold is not to restore data or user accounts by mass. Instead, it is primarily used to preserve data only item by item or folder recovery.
  • There is no way to restore data from one user to another. So, if you have a user leave a company and need to turn that data over to a new user, that function isn’t possible. Consequently, litigation hold doesn’t allow you to remove users while maintaining their data, so you must continue paying Microsoft for the license--which is an unnecessary cost.
  • Litigation hold doesn’t allow you to delete emails or attached files, so your storage capacity needs (and cost) increase exponentially over time.
  • With little to no protection against cyberattacks, like malware and ransomware, there is no guarantee that your data will be restored or protected.
  • Furthermore, M365 operates off a shared responsibility model and does not provide comprehensive backup and data protection.

Litigation hold, in sum, is not a reliable backup plan for companies. Numerous gaps in restoration and a lack of protection plan from cyber attacks leave company data incredibly vulnerable to data loss. However, companies can better protect and backup their data with third-party backup vendors, like Backupify.

Backupify for Microsoft 365

View More


How Third-Party Backup Can Help You

Using a third-party backup vendor can help you secure, restore, and backup all your data. Here are some benefits of using a third-party vendor for backup:

  • When using an external SaaS system to backup your data that lives outside of M365, your data remains preserved and protected from cyber attacks and encryption.
  • Vendor clouds also keep your data private and secure, preventing all your data becoming visible during a litigation hold and legal action.
  • SaaS backups enable rapid restore of user data. Backupify, for example, backups data from M365 three times a day. So, if accidental data deletion or ransomware impacts your data, you can revert back to a time before the data loss occurred.
  • You can archive users that have left your organization. Whereas, with litigation hold, you’re unable to delete the user and end up having to continue paying for the M365 license. Backupify automatically archives user data after the license has been removed.
  • SaaS backup allows you to restore archived user email and documents to current user accounts in record time. This eases the burden of a busy IT team, and provides you with a more automated service.
  • Data loss can be expensive, and SaaS backup providers can help you prevent paying hefty ransoms, production downtime, and even regulatory fines.
  • Having an SaaS backup provider can help you with significant cost savings, including reduced downtime, better security, and customizable plans.

Backupify Fills the Gap in Retention & Backup

Protecting and backing up your data shouldn’t be complicated, or filled with limitations and caveats. At Backupify, we make sure of that.

Backupify offers an automated, easy to use SaaS backup system for Microsoft 365 and other applications. With our private cloud, robust security measures, and multiple daily backups, your data stays secured, protected, and available whenever you need it. In addition to providing litigation holds, Backupify can preserve your data and offers simple seat management and other great tools.

Interested in elevating your backup plan? Try a free demo today.