SaaS backup: why your Microsoft 365 and other cloud data still needs one
Your SaaS provider keeps its service running. Keeping your data recoverable after a deletion, a ransomware attack or a bad sync is still your job.
A common assumption is that data in Microsoft 365, Google Workspace or Salesforce is backed up because it is in the cloud. The provider does protect against its own failures. It keeps copies across data centers so a hardware fault or a fire doesn't lose your email.
What it doesn't promise is to undo your mistakes, or an attacker's.
What the shared responsibility model says
Microsoft's shared responsibility guidance lists the things that stay with the customer in every cloud model, SaaS included: your data, your identities and accounts, access management, and your configurations. Data loss caused by someone with valid access, such as a user deleting a folder, a sync tool overwriting files or an attacker encrypting a OneDrive, falls on your side of that line.
Built-in features help, but they are not a backup. Recycle bins and retention settings have time limits and are managed with the same admin accounts an attacker would target.
What a SaaS backup should do
A real backup is a separate copy, kept somewhere a compromised admin account can't erase, that you can restore from at a specific point in time. Microsoft's own Microsoft 365 Backup product describes its backups as append-only and immutable, meaning they can't be changed after they are saved, which is the property that matters.
| Requirement | Why |
|---|---|
| Separate from production admin accounts | An attacker with admin rights shouldn't be able to delete backups |
| Immutable or append-only | Backups can't be altered or encrypted |
| Point-in-time restore | You can roll back to before the problem began |
| Granular restore | You can recover one mailbox or file without rolling back everything |
| Covers the apps that matter | Email, files and sites, but also CRM, HR and other SaaS data |
Choosing an approach
There are two main routes: the provider's own backup add-on, such as Microsoft 365 Backup, or a third-party SaaS backup service that covers several applications. The provider's own option is simpler to switch on. A third-party service keeps your backup outside the provider and often covers more applications in one place.
Whichever you choose, test a restore. Time how long it takes to bring back one mailbox and one large SharePoint site.
What IT teams should do
- List the SaaS applications that hold data you can't afford to lose.
- Check how long deleted data stays recoverable in each one today.
- Choose a backup for at least email, files and your CRM.
- Run a test restore and write down how long it took.