W. Curtis Preston (Mr. Backup) and Prasanna Malaiyandi weigh in on a reddit thread that started with a simple question from a user. He has MSPs trying to sell him a solution to back up Microsoft 365, and he’s wondering if that’s even necessary. As usual on reddit, there are many opinions. Mr. Backup debates the various points being made by the anit-backup crowd, including an article arguing the same point. We start with an overview of why it’s important, then we take on the various arguments used to support not backing it up. We talk about how retention policies are not backup, and why. Even retention lock doesn’t help, and neither do lagged copies of Exchange Online. We also talk about how the e-discovery tool is NOT a restore tool and will not give you what you’re looking for. Finally, we talk about the idea that backup tools can’t do DR for Exchange online, and how that is used to bash them as well. Great discussion on this one.
You can listen to the podcast via any of the above links, or you can watch it here:
Episode Transcript
Curtis: [00:00:00] Yeah, I need another friend for my movie fix. Yeah, I have to, I’ve done multiple
Prasanna: You can have two friends but that’s it.
Curtis: Okay. All right. There you go. And I have podcasts with both of them, so it’s all good.
Curtis: Hi, and welcome to Backup Central’s Restore it All podcast. I’m your host. W. Curtis Preston, AKA Mr. Backup and I have with me, my AirPods fitness consultants. Malia, Prasanna Malaiyandi
Prasanna: yes, I am not sticking my fingers in your ears, just so people know.
Curtis: but you said you could make sure that my AirPods fit properly.
Prasanna: Yes. And apple provides you with a great tool in the iPhone to actually make sure because you got the new AirPods pro,
Curtis: I suppose if I actually pulled the little ma the little manual out, it would probably tell me that
Prasanna: Yup. And actually, when you first paired your AirPods pro with your phone, It should have asked you, do you want to run a fit test?
Curtis: It may have, but I remember when I first paired it, [00:01:00] I was in a hurry and I was on my way somewhere.
Prasanna: Yeah,
Curtis: So if it did ask me, I probably ignored it. But then I was mentioning to you about the the ear tips and that I went with a smaller one. And you were like, did you do the fit test? And I’m like
Prasanna: Yeah. It’s great though, because apple wants to make sure you get the best sound experience possible. So they play music, which is annoying music
Curtis: Yeah, it is a little annoying.
Prasanna: but they measure to see how much noise actually leaks into the microphones on the inside of the tips. So they can detect, is there too much noise leakage or not,
Curtis: Yeah.
Prasanna: Ingenious.
Curtis: Yeah, it’s kinda cool. I Yeah. So I think I have a small and delicate ears,
Prasanna: TMI Curtis TMI,
Curtis: so that’s why I went with the smaller ear tips. I have this giant head, but small delicate ears. So
Prasanna: all this power in this itty little, what is it? Aladdin?
Curtis: [00:02:00] infinite power and itty bitty living space. Yeah, exactly. Yes. Speaking of quotable movie lines, I just I’ve been watching movies that I’ve never seen before lately. And last night I watched the original name of it was everyone comes to Rick’s
Prasanna: I don’t know what the actual.
Curtis: Yeah, the original name of this, of the play that became a movie was everyone comes to Rick’s or everybody comes to Rick’s.
Curtis: You probably know it by its more common name. Casablanca
Prasanna: ah.
Curtis: Yeah, I never saw Casablanca. So I watched Casablanca
Curtis: last night.
Prasanna: I’m surprised you’ve never seen it.
Curtis: I dunno why I dunno. It just, here’s looking at you kid and this is a beginning of a beautiful relationship and it’s a lot of great and by the way, you know what line is not in Casablanca,
Prasanna: What
Curtis: play it again, Sam
Prasanna: Say hello to my,
Curtis: no.
Curtis: no. The line that everyone calls from Casa [00:03:00] Blanca the, play it again. Sam is not in the movie. It’s like the treasure of Sierra Madre. The, we don’t need no stinking badges. That’s actually not from the treasure of Sierra Madre. It’s from the spoof of it, which is, I think it might be blazing saddles.
Curtis: I’m not sure,
Prasanna: Was it? What’s the guy’s name? Not Rob Lowe said it wasn’t Rob Lowe.
Curtis: In what blazing saddles.
Prasanna: No, I, because I’ve heard him say that in like other movies
Curtis: Oh, maybe yeah, it’s a line that people quote and misquote but the famous line is not the line that everyone says, just like he does not say play it again, Sam. He says play it. And he says, you played it for her. You can play it for me. It doesn’t say play it again. But
Curtis: anyway,
Prasanna: things you learn when you actually closely watch a movie.
Curtis: Yeah. Yeah. Yeah, I’ve been on this watching older movies kick because of my other podcast with my good [00:04:00] friend, Jeff Rocklin his podcast is called the things that entertain us feel free to look that up. And I’m going, having a fun, watching some, current movies as well as I watched citizen Kane for the first time on a big screen at
Curtis: the academy the academy, essentially the academy of motion pictures, museum.
Curtis: They have this beautiful theater and got to see citizen Kane for the first time on this big, giant screen, it was introduced by a guy from the academy and talked about the visual effects and stuff that was in the movie.
Prasanna: That’s pretty awesome. Yeah. Unfortunately I don’t watch movies and so Curtis has to get his
Curtis: Yeah. I need another friend for my movie fix.
Curtis: Yeah, I have to, I’ve have
Prasanna: it’s.
Curtis: multiple
Prasanna: It’s OK, you can have two friends but that’s it.
Curtis: Okay. All right. There you go. And I have podcasts with both of them, so it’s all good. Today I found myself on a Reddit thread.
Prasanna: Why do you do this to yourself? Curtis? Why?
Curtis: I was on a Reddit, as is. That’s part of my shtick. [00:05:00] And I found this Reddit thread and the title was how important is backing up O 365. And he says, I have MSPs always pushing for O 365 backup services. Like Druva how necessary is backing up a 365. Isn’t the data geo redundant looking for opinions, thanks
Curtis: and there were a variety of it’s a bit like it’s a bit like posting, I think which is better Democrat or Republican. It’s almost like a troll, right? Because you know that there’s going to be people like me that are going to say, dude the cloud isn’t magic.
Curtis: You need to back up your stuff. And then, these other guys who seem to be they are certainly less concerned about. What I would consider backup. And so they, there are groups that post the opposite and there are people that blog the opposite. So I thought we’d talk, I know we’ve covered this in the past, but I,
Prasanna: In fact it was our fifth episode of why backup SaaS services, I think
Curtis: let’s see [00:06:00] we’ve that was like a hundred and thousand episodes
Prasanna: I know.
Curtis: If it was our fifth episode, that was a hundred and twenty five, twenty nine episodes ago.
Prasanna: So
Curtis: There you go. There you go. And so I thought we talk about this and first off, I’ll throw out our usual disclaimer, Prasanna and I work for different companies. He works for Zoom I worked for Druva.
Curtis: This is not a podcast of either company and the opinions that you hear are ours.
Prasanna: actually Curtis’s.
Curtis: I don’t let him have his own opinion. And then also rate this podcast at ratethispodcast.com/restore. And we’re looking for guests and we’re, we’re start, we’ll start having a guest again here this year, and we would love to have you on, we love to talk about backups, security, data protection, data, privacy barbecue, beer.
Curtis: And backups, barbecue, beer and backups the three BS. So yeah, so please join us. Just message me @wcpreston on Twitter, you can DM me. I accept DMS [00:07:00] from everybody. And also you can email me at wcurtispreston@ g-mail . What do you think about this? Now that you’ve been freed from your associate, you used to be associated with backup for a long time.
Curtis: And now now you’re over there at this other company that has nothing to do with backup.
Prasanna: A lot of people think that, yeah, it’s running in the cloud. Why do I need to back it up? And it’s not even just corporate it’s. And not even specifically Microsoft 365, but look at people using Gmail for their personal email. How many people, I bet if you go around and ask like everyone, do you back up your mailbox, right?
Prasanna: Your gmail
Prasann: right.
Prasann: 99% of people will be like, wait, what?
Curtis: Yeah. I think it was where we were like 99.9, but
Curtis: yeah.
Prasanna: And I think it’s just one of those things where most people, like we’ve always said they believe it’s a SaaS service backups happen automatically. They don’t need to worry about it. They don’t need to worry about like their laptop dying because it’s in the cloud. They just bring a new device and it all works, but they don’t realize that data is still sitting somewhere on something
Curtis: And it’s a [00:08:00] bit annoying to me because I’ve been in the space for a long time. And throughout the years, there have been things that have. Purported as a replacement for backups, right? One of them was or that didn’t need backups. One of them was raid, when raid came out, we didn’t need backups.
Curtis: And then then there
Curtis: were
Prasanna: and snap and replicate
Curtis: Yeah but even like with snapshot, there were people that just had snapshots. I didn’t even have the replication and they would say, oh, I don’t need backups because they have snapshots. Dude, those are snapshots of the primary.
Prasanna: Sitting on the primary.
Curtis: Yeah. Sitting on the primary. And that’s what I’m going to go for here. So first off I’m going to say the same thing that I often say just a flat-out. Emphatic statement that Microsoft and Google are not backing up your email. They’re not backing up your SharePoint, et cetera.
Curtis: Your OneDrive, if you don’t know, OneDrive is essentially a an interface to SharePoint. And if you don’t believe [00:09:00] me, go look at your service contract, everything that they provide for you, everything that they have agreed to provide for you is in a contract. Go look at your contract. You will not find any words that sound like backup, restore, recovery, any of these things, they are not there.
Curtis: And if you look up something called the shared responsibility model, you will see that your responsibility that backups clearly fall under your responsibility. Their responsibility is availability of the platform, not availability of your data. There’s very different concept there, right?
Curtis: Availability of the platform.
Prasanna: The same thing holds true for not just Microsoft 365 and like Gmail, but even AWS. They have the same thing, with the shared responsibility model where they make sure that yes. Services available, but backups all the rest is yours. Unless you explicitly buy service like AWS backup or something else like that.
Curtis: The difference between AWS and Microsoft ,though, is that’s [00:10:00] clearly spelled out in the documentation of every service that you look at. It will tell you what backups are included. what backups are not included where the backups are and what you can do to make them better. Whereas with Microsoft, they just don’t talk about it, which is just really weird.
Prasanna: I think they don’t talk about it because they don’t want people to really, they think people don’t need to worry about it. Like I think AWS brings it up because they realize you need to worry about this. I think Microsoft thinks we don’t need people to worry about this.
Prasanna: Why do people have to worry about it’s the cloud, everything should be available, but it’s
Curtis: I would say they don’t want people to worry about it.
Prasanna: But they don’t give you a solution though, either.
Curtis: They don’t give you a solution to the problem. Again, proponents. Of the no backup philosophy would state that they do give you ways to protect your data. And the most common thing that is, is touted. So first off they talk about the availability of the platform.
Curtis: They talk about [00:11:00] replications and and how that it’s part of this availability group. And and that’s all great. But again, that’s all about availability. That’s not about. Backups.
Curtis: And
Prasanna: Backups and restores
Curtis: But th they also tout things like retention policies, the most common thing that I see touted by people that want to th that say, you don’t need to back up the data is retention policies.
Curtis: And the thing is, here’s news. Most people don’t know anything about retention policies, right? Most people don’t even know that they exist. Including a lot of backup vendors. They don’t know that they exist. And so they just talk about the recycle bin. They’re like oh the recycle bin is only two weeks or whatever, and they go after the recycle bin and.
Curtis: Proponents of 365 will then say there are retention policies. And if you really want to store data, if you want to make sure that data doesn’t get deleted, even if it’s purged from the recycle bin, then you should create a retention policy for that. And and it would save it. [00:12:00] My, my big thing though, with the retention policy idea is that all that’s really doing is keeping the email or the file or the record in 365,
Prasanna: It’s almost like a soft delete, right?
Curtis: It is a delete
Prasanna: It’s gone from the user’s perspective. It’s gone from the admin’s perspective, but it’s not yet gone from the system’s persective
Curtis: right? It’s just basically, I’ve said this before 365. And G-Suite and Salesforce, all of these apps, they’re all really just a big, fancy database with an interface in front of it. And it’s not like you actually have a, it’s not like for the Unix folks. It’s not like you’re your 365 email is in an inbox format.
Curtis: That’s in a directory somewhere. It’s in a database. And each email is represented by a record in that database. And when you delete the email, what happens is it sets a flag that says deleted. And [00:13:00] if you that, and also if it’s got a retention policy, it sets a flag that it’s going to be retained.
Curtis: So even if it’s deleted, it just looks like it’s been deleted, but it’s really just sitting there. And that, that is not a backup. And why is that? Not a backup.
Prasanna: Because it lives within the same system. So it doesn’t follow the 3, 2, 1 rule.
Curtis: Yes,
Prasanna: See, I got it this time.
Curtis: And by the way, I just want to, I just want to say something and I’m gonna, I’m going to try not to return in kind, but there was this article from practical365.com and right off, they started out with an ad hominem attack in the beginning of the article. Right. Basically saying that people, vendors like Druva that are stating that you need to back up…
Curtis: Oh, here we go. So when you research it, though, you’ll find lots of content telling you that you do need to, but more often than not, the content is sponsored, paid or authored by a company selling a 365. backup [00:14:00] or continuity solution.
Curtis: Some are written with the express aim of convincing the reader that backups are essential. I would say they all are because they are anyway. But the idea that’s literally paragraph two basically, oh anybody who says you need to backup 365, it’s just because they sell it. And yeah, I work for Druva, but I’ve always felt like
Curtis: you need
Prasanna: you should back up.
Prasanna: your day.
Curtis: I’ve only worked for Druva for four years. I’ve always felt you need to back up SaaS resources.
Prasanna: And an example would be look at Salesforce. They brought back in a backup solution.
Curtis: They did
Prasanna: In-house that they had gotten rid of, but they decided that they’re going to continue building out. And the only reason that they would do that is because their customers are probably asking them, we need something.
Curtis: So if I look at this article, the first thing that he goes after is retention policies. And it says retention policies are not backups by themselves, but they’re part of the picture.
Prasanna: Which I wouldn’t disagree with. Just like
Curtis: right, I don’t have any problem with it, but yeah, go ahead.
Prasanna: Yeah. Just like we talked about with [00:15:00] storage arrays, Right, Snapshots are part of your overall data protection strategy. It’s not just the only thing that you use.
Curtis: Steve Goodman is the author. He talked about that. It’s not backups, but it says, it just ensures that data isn’t removed from the service. And he then alludes to the fact that people of my ilk will suggest well, the problem with that is that an admin, a malicious actor could go in and change your retention policy and thus delete everything . You could create a retention policy of zero, move everybody into that retention policy and suddenly all their email is deleted. And you know how we know that’s possible.
Prasanna: Because it happens.
Curtis: Because it happened there is a giant story
Prasanna: Oh, I remember we did this.
Curtis: Yeah, that was the story. August, 2020. It was KPMG. They created a policy. It was an accident. But that’s what backups are for, right? [00:16:00] Is they created a retention. They needed to delete one particular person’s data. So they created a, but they already had a retention policy that said that data is retained for 90 days or whatever.
Curtis: And so they create a retention policy that says zero, and then they were supposed to move that user into that retention policy. And instead they moved everybody into the retention policy and thus deleted 145,000 users personal chats. While I will just say that a lot of backup providers don’t backup personal chats, and the reason for that is that Microsoft does not provide an API to get that data. The, and this does prove the point that retention policies are not perfect.
Prasanna: Foolproof
Prasanna: And they would, of course tout preservation lock. If you turn on preservation lock, even if a bad actor goes in and shortens all your retention down to zero that will only apply to data for the future. Not data from the past. The only problem with that is people that have turned on preservation lock, then suddenly find [00:17:00] out how much data it takes up.
Prasanna: And then they’re like, holy cow. And,
Prasanna: they can’t do anything
Curtis: end up and they can, but they can’t fix it.
Prasanna: Yeah, and this reminds me on storage arrays. Most storage arrays offer two types of retention lock, one called compliance, and one called governance. Compliance is the one that you set and you can never unset it. Like the preservation mode.
Prasanna: And a lot of people would start off with that.
Prasanna: And then they would realize, oh man, this is eating up a lot more space than I expected. And there’s nothing they could do because it’s set that way. And so you either end up creating a different volume and start using that other volume with a different mode on it in order to keep the data for as long as you need, because everyone’s Yeah. I want to keep the data forever. And then you start looking at your bill and how much data it’s consuming. And you’re like, I did not expect that.
Curtis: Yeah. And so I think that again, there’s nothing wrong with a retention policy, but it isn’t backup because it doesn’t copy the data anywhere else. And anything, if anything, catastrophic happens to your [00:18:00] configuration? Yeah. It is that data’s gone right now. People say, has this never happened? I don’t know.
Curtis: But here’s the thing. The cloud isn’t magic. Microsoft isn’t magic. Could it happen? Yes, it could. And by the way, I want to throw out something that, that some commenters on the thread have brought up like, has anything like this ever happen to you. So I’ve had Microsoft 365 for 10 years, and I’ve never had a problem.
Curtis: You know what, I’ve been in the industry for 30 years, I’ve never had to do a disaster recovery either. That doesn’t mean I’m not going to have a DR plan.
Prasanna: Yeah
Curtis: I’m prepared. So the second section here he
Prasanna: The part before you move on,
Curtis: oh yeah.
Prasanna: you brought up a point about the 3, 2, 1 rule, how keeping all the data local,
Curtis: Yeah,
Prasanna: means that it doesn’t meet the requirement, but I believe some people would also say, yeah, but Microsoft 365 allows you to replicate the data to other geos.
Curtis: I can’t speak to the geo replication capabilities of Microsoft 365, but I will [00:19:00] just say replication is not backup right. For the same reason that, so yes, you can replicate, but replication is. Similar. It has other holes that when corruption happens in one place, it can automatically replicate the corruption to other places.
Curtis: This is why we came out with concepts like continuous data protection in the backup world because replication by itself is not helpful. It doesn’t appear that they offer this as a service as an additional service, but that. There is a database availability group for exchange and that there are other lagged copies, but I will just say this, I have specifically, and you can call me on this and you can tell me I’m full of it.
Curtis: But I have specifically as a customer of Microsoft, 365, druva is a customer of Microsoft 365. I have specifically asked them, can I use a lagged copy of Microsoft 365 exchange online to restore my service. [00:20:00] And the answer was an unequivocal. No.
Prasanna: because like you said, it’s intended for the service availability, not for users to be able to restore the backup.
Curtis: So while this author of this article is talking about these lagged copies again, that’s the other thing that that folks that are proponents and that understand 365, they often bring up lagged copies, show me documentation that says that I’m allowed to use a lagged copy to restore my database and I’ll back off. Because I have documentation directly from Microsoft that says that I cannot use that copy. So
Prasanna: I remember you called into support and actually talked to someone
Curtis: yeah, I did. Yeah. Anyway, so the next section that he has here is it recovery inside the service as possible, but requires skill? The first sentence is that “the weakness in 365 is how complex it is to understand how to recover data.”
Prasanna: Why?
Curtis: To which I just want to hang my head
Prasanna: yeah.
Curtis: restore should not be difficult.
Prasanna: [00:21:00] Yeah.
Curtis: This is something brought up by the other person that we’ve often tangled with. When you’re having your worst day, the last thing you want is a complicated restore process.
Prasanna: It’s like the conversation we had last week about you restoring backup central,
Curtis: Yes. It was a little more complicated than I thought it was going to be, but it worked out and I went to the people, I went to the people to help me out. They’re saying administrators can use things like the search mailbox to recover data or use the e-discovery.
Curtis: By the way, I have tried to use the e-discovery functionality in 365 to restore. Data. And I’ll just say this, it like a lot of other tools. It is definitely not a backup tool. E-discovery is, you know what that tool is made for Prasanna. I’m going to give you one guess.
Prasanna: E-discovery?
Curtis: Yeah. So it turns out it’s really good at e-discovery and not so good at restoring stuff.
Curtis: First off, I found the e-discovery tool, clunky. I found creating the case was clunky. [00:22:00] Getting the data from that case was clunky. Getting the data back into, a mailbox is also clunky
Prasanna: Because It’s not intended to be used that wau
Curtis: It’s not intended to be used that way. Also it doesn’t include the concept of folders. It also doesn’t understand the concept of point in time.
Prasanna: It’s a little bit like when you have our archive versus backup discussions,
Curtis: yes, it is. Exactly. E-discovery is an archive
Prasanna: Yeah. They’re very different use cases and therefore they have different semantics. And when you try to make archive be used for restore or backup use for archive, the world’s collide and bad things happen.
Curtis: Yeah. When I hear someone suggesting that you can use e-discovery to restore a mailbox, I would like to see them do that on video. I really would.
Prasanna: Maybe for one email it’s not bad.
Curtis: Yeah, for exactly, for one email, it’s not bad but for a bunch of users who have had their email obliterated or OneDrive obliterated, and you’re pointing them at e-discovery or that the admin has to go to [00:23:00] e-discovery it doesn’t understand the concept of point in time.
Curtis: In other words, you can’t put your mailbox or OneDrive back to the way it looked two days ago. It just, it doesn’t understand that concept. What it understands is give me all. Files or all of the emails that went to Curtis all of them in this timeframe. Which is not the same thing as give me all the emails that were in Curtis’s email box yesterday, it doesn’t understand that concept.
Curtis: And then the last recommendation was PowerShell commandlets too, which I just want to hang my head. Again, it should be easy. And if the data has been purged and it’s only held in a retention policy, it’s going to be complicated and the only way to get it is the e-discovery interface.
Curtis: And I found that clunky.
Prasanna: Your last line of defense. But it shouldn’t be your first option.
Curtis: Yeah. I live in this crazy world where people do dumb stuff all the time, and then they need a way out of it and that way should be simple. And the thing is [00:24:00] the way we back up 365. We would restore right back to where it came from. We would restore the folder structure that it came from and, et cetera, et cetera, et cetera, it would just, it’d just be restore Curtis to the way he looked yesterday.
Curtis: That’s what backups are for, if you don’t think that matters. I don’t know what to tell you. We’re probably not going to share drinks.
Prasanna: well, and if I’m the Microsoft 365 admin and I got this request and it’s I’ve never really used the e-discovery tool or whatever other tool. And now I’m trying to figure it out as I have a CEO breathing down my neck or someone very important or whatever else it is. If I’ve never done this operation.
Prasanna: Or it’s not dead simple, then there’s probably going to be a mistake being done. And someone’s going to be very unhappy.
Curtis: And then there’s the final and this one, again, it’s a very common thing that people bring up on that side of the discussion. And that is this final heading is Microsoft 365 backup products have key gaps that limit the security and productivity of your organization. [00:25:00] So the point being made here is because Microsoft doesn’t provide Druva and other companies like Druva APIs to get all of the data.
Curtis: Therefore our backups are invalid I just want to, again, throw my hands in the air. We acknowledge that and we plead with Microsoft to stop offering new services without backup KPIs. But. Because we can’t protect something like Yammer, for example, doesn’t mean we can’t protect exchange
Prasanna: The rest of this stuff. Yeah.
Curtis: And they also list teams and we do a pretty good job with teams. I know at Druva we do some things that a lot of other companies don’t, and, but we are limited by the API APIs
Prasanna: what functionality it allows you.
Curtis: Yeah, and they list some stuff like sensitivity labels, AIP, or MIP functionality and to ask about how they backup and restore that data.
Curtis: And [00:26:00] I don’t disagree with any of that, but I don’t understand how, because we can’t get everything. We shouldn’t get what we can. And I, as a customer of Microsoft would say to them, Hey, why don’t make
Prasanna: Yeah. And I think the other thing is, as a backup vendor, you need to be open about, Hey, here are all the things we can’t do. Rather than just saying yeah, we back up everything. It’s good to go.
Curtis: Good point. Yeah.
Prasanna: I think Druva, at least last I looked right. Was very upfront about here are the Microsoft 365 services we can back up here are the things that we can’t support. And like you mentioned, it’s typically because APIs don’t exist.
Curtis: The irony of this particular issue is they’re saying that the reason why our backups aren’t valid because we can’t get everything. Guess what? Their backups don’t get everything. And again, I just called what I just called, what they do, backups, what they do, aren’t backups.
Curtis: But their Protection mechanisms. Don’t get everything. There are a handful of things, just like there are handful of things that we can’t get. There are a handful of things that a person who only has [00:27:00] 365 tools cannot recover off the top of my head. I don’t have them. Vanessa at Druva I know is, is a 365 expert.
Curtis: I’m not one. And we have talked about some things that, again they’re not as common as some of the other things, just like Yammer is not that common among the, and if you’re listening to this use Yammer, I’m not saying nobody’s using Yammer. I’m just saying it’s certainly not as common as say exchange online. Teams has become a lot more common in the last couple of years due to COVID. And due to them, adding some functionality to answer slack, right?
Prasanna: And
Curtis: I’ve used teams and I’ve used slack and I’ll take slack any day, but
Prasanna: I was just going to also mention that you brought up Vanessa. So we did actually record a couple episodes with her episodes, 85 and 86, where she did talk about the architecture of Microsoft 365, that needs to be backed up and why you need to back up Microsoft 365.
Curtis: Yep. We should point people to those episodes because I’m pretty sure she went into some of those [00:28:00] things.
Prasanna: I learned a lot from that discussion as well about Microsoft 365.
Curtis: When I look at, so there was a part one and a part two. When I look at the second part, he talks about prevention is better than cure.
Curtis: I don’t disagree. I would not tell a customer not to use retention policies . But I will say this, if e-discovery is a regular part of your workflow, I will put our e-discovery capability up against the built-in e-discovery tool any day of the week. And if you’re paying extra, the ones that I really don’t understand are guys that are customers that are paying extra to get E5, and that mainly what they need is to e-discovery functionality. We cost way less than the cost difference. The cost differential is $15 a user
Prasanna: Do you want to mention what E5 is just for
Curtis: I, yeah. E5 is a Microsoft licensing level, so it’s E1, E3, E5, right, and the biggest difference between E3 and [00:29:00] E5 is the e-discovery capability. And also the eh things like looking for ransomware notification and things like that.
Curtis: And we offer the same functionality. And, but, and again, I would say. I would put our e-discovery functionality up against theirs any day of the week
Prasanna: so you get both backup and e-discovery for less than the price
Curtis: and actual backup not fake backup. I don’t know.
Prasanna: It’s a little bit like a religious war,
Curtis: It really is a religious war. I will say that, that I don’t understand why. The cloud makes this any less of an issue.
Prasanna: Magical!.
Curtis: I don’t disagree that 365 is not a really well-designed product. It’s just, it’s not magic and so bad things can happen. And no, I can’t describe all of the bad things that could happen. But that’s why we have backup. That’s why we have backup everywhere else in IT, and I don’t understand why 365 is somehow magically different.
Prasanna: Yeah.
Curtis: I want to throw [00:30:00] another claim that you hear from people is one of the claims that some people mentioned is what if 365 goes down, you have a backup of it. And these guys were like where are you going to restore it to?
Curtis: Okay. So today, There is an assumption that Microsoft would come back up. Okay. Second is that what you do have is an E discovery capability. You do have ability to search and get access to the most important email that you can download to your laptop. The most important document that you’re working, that you can get down.
Curtis: No, you’re not going to have the entire service, but you can get the most important things that you were working on.
Prasanna: Yeah. Or if you had a presentation in an email somewhere, or the email service down, at least you can go fetch that information while the services.
Curtis: Exactly. We’re not going to be running your email for you. It’s not DR for email.
Prasanna: But if Microsoft goes down and Microsoft 365 is down, there’s a lot of companies that are going to be in pain,
Curtis: and that was oddly enough that they said the same thing and one of the, one [00:31:00] of the articles or comments, it was like, yeah. Okay. So what are you saying? But as long as companies that don’t have a third party backup will be essentially dead in the water, unable to work on anything that was recent while 365 is down. And by the way, 365 has gone down,
Prasanna: yeah.
Prasanna: Yup, It reminds me, do you remember when Salesforce did that upgrade where they ended up messing with a bunch of user metadata? I think the user objects and they told people go to your backups. And a lot of companies were like, we don’t have anything or go to your sandboxes.
Curtis: That was really weird because. A script of theirs damaged customer data. It changed it so that everybody could see everything
Prasanna: Yeah.
Prasanna: But that’s why you need backups.
Curtis: that’s why you need backups. And yes, we have had customers Druva has had customers restore data from their backups in Microsoft 365. It’s hard to get them to come out and talk publicly, but I know that we have at least one [00:32:00] customer that agreed to a case study that we can that we publish on druva.com. But I don’t know. I just, I don’t understand.
Curtis: I don’t disagree it at 365. Isn’t a, a solid product. Isn’t a, well-designed product and actually does a lot of, it has a lot of really convenient, like what I would call restore convenient features. They mimic backup though. They’re not backup. They are essentially snapshots. And everything is all stored inside the same system, and just because a catastrophic failure hasn’t happened of some 365 customer yet doesn’t mean it won’t ever happen.
Curtis:
Curtis: We have had incidents of the other things like ransomware and rogue admins and stuff,
Prasanna: I think just trying to bubble it up even higher level, even though we’ve talked a lot about Microsoft 365, I think this applies to any SAS or cloud solution that a customer is using. That they may not even realize like service now or Zuora or Zen [00:33:00] desk, or you take your pick of cloud services.
Curtis: Exactly. Any service where you’re creating data in that cloud, right? It does. Yeah. Thanks for bringing that up. It really does apply. And the only reason why I’m harping on 365 and have multiple times is it only seems to be with the 365 customer base and their fandom where I get this problem. No one, I don’t know anyone arguing that G suite backs up their data.
Curtis: Occasionally we get this, the Salesforce stuff, but that’s pretty easy because it’s documented Salesforce documented it, amazon documents pretty good on, on their stuff, but
Prasanna: Microsoft
Curtis: just, they just don’t say anything. It’s annoying and I wish they’d come out and be, they do, by the way in there, this is the weird part is there’s 365 for end users.
Curtis: And there’s 365 for businesses and the 365 for end-users. They specifically state you should back up your stuff. But in the in the commercial version of the product, they [00:34:00] just don’t say anything. They don’t say we have a backup of your stuff. You’re good. You don’t need to backup your stuff
Curtis: but they all, they also don’t say you do need to backup your stuff.
Curtis: So it’s just, it’s a combination of the fact that Microsoft is not upfront about this. And then you have multiple people that are saying that it’s not needed.
Prasanna: And they may not be upfront about it because maybe in their minds, they think what they’ve provided is backup.
Curtis: Then put it in writing, baby. That’s all I got to say. I go back to my days of watching judge Judy, it was not in writing. It doesn’t count. And I don’t know. I, it just seems like on your worst day, the worst, the problem is the worst, the ransomware attack or the malware attack or the bad actor attack is worst.
Curtis: The problem is going to be. And again, I don’t care, even if you’ve turned on retention policies and you’ve turned on the preservation lock, even if you’ve done all of that stuff. [00:35:00] For anything, that’s not in the recycle bin,
Curtis: putting that back is going to be a giant pain in the butt. And do you really want that to be what happens to you on your last day?
Curtis: And again, another claim that the guys may look like because of the APIs and the limits and the throttle limits and everything, it’ll take you a really long time to restore an entire Microsoft 365 tenant to which I go, yes, I don’t disagree with that. But you could be picky about it. You could just pick the last, week or so is worth of emails and just restore those for now while you continue working and then restore the older stuff
Prasanna: later.
Prasanna: Yeah. Or prioritize which users get restored first.
Curtis: MIne!
Prasanna: There’s so many options all
Prasanna: Always yours, Curtis, but I people don’t think about that. The other thing is, at least you’re able to restore your data. Even if it takes 50 days, at least you got your data back versus what, if you don’t get your data back, what are you going to do?
Prasanna: It’ll be like, what’s that Gmail com or the Google [00:36:00] company that accidentally deleted their account and couldn’t restore it. And then the company closed down because it had all their intellectual property?
Curtis: Yeah. I the name of company is escaping me, but
Curtis: And then they tried to Sue Google.
Curtis: Yeah. Yeah. Nothing happened with that. Did it?
Prasanna: I don’t think so. Yep.
Curtis: Yeah,
Prasanna: So don’t be like that
Curtis: public about it. Yeah, don’t be like that company. The cloud is not magic. SaaS is not magic. Microsoft is not magic. And Microsoft is not upfront about what they’re doing to protect your data.
Curtis: They got a really, a lot of really nice features, but all of the data is still all in one place. Even if it’s in an availability group again, that replicated copy that lag copy is not available to you. Don’t believe me, ask Microsoft. If the world blows up and I need to use the lagged copy of, my database to restore my environment.
Curtis: Can I
Prasanna: if they said yes, Would your answer change or would your opinion about Microsoft 365 change Curtis, I’m going to put you on the hot spot
Curtis: Good [00:37:00] question. If they said yes, I would ask them to put that in writing. Right as a customer. I would ask them if that, if it is yes, although I’m pretty sure it’s not going to be yes, but if it is yes, then why is that not in the documentation? What is the scenario that I need to, what is the process that I need to go through to restore my completely blown away exchange online or SharePoint online environment.
Curtis: And it’s not there. Back up your 365 and your G suite and your Salesforce and all the other,
Prasanna: Until Microsoft changes their mind, but until then back it up
Curtis: But even that I’m just gonna say this. So Salesforce, for example, now offers a for-pay backup service. But anyway, it’s a little expensive, but cause we have to compete with it now.
Curtis: We were looking at pricing when the pricing came out, was quite surprising. Just how much they’re going to charge for the backup service, but. I still would not want to use a backup service built by the people that the original was made from, again, given the choice, I would choose a third party backup service, just my,
Prasanna: I’m going to challenge
Curtis: you on that,
Prasanna: Curtis
Curtis: you, you’re going to [00:38:00] make the argument the other way, aren’t you?
Curtis: Because they know the data best
Prasanna: They know the data. And I’ll give you an example
Curtis: you know what? They don’t know best
Prasanna: what?
Curtis: Backup.
Prasanna: I agree. I will give you a counter example, which is Oracle and RMAN.
Curtis: Okay.
Prasanna: Great. I think if Microsoft provided a similar mechanism as Oracle does
Prasanna: RMAN,
Curtis: Service to backup Oracle,
Prasanna: No.
Curtis: our Oracle doesn’t PR or Oracle doesn’t,
Prasanna: So
Curtis: know what I’m saying?
Prasanna: But with RMAN, right? They understand the data, they understand the format and they say we could either write it to an NFS target or an S3 target, which Oracle will do on its own. Or you could plug in a backup vendor’s, libraries, if you will into Oracle RMAN and have it manage moving the data.
Curtis: With respect to my friend. I don’t think that’s a valid comparison because one is a software tool, right? And the other is a service. So my point is that Salesforce as a service is running on infrastructure right next to that infrastructure will be [00:39:00] where the backup service is running.
Curtis: And I’m not talking about a 3-2-1 thing thing. I’m just saying the same people have designed the same two pieces of infrastructure, and they may have made the same catastrophic decisions on both parts.
Prasanna: I agree.
Curtis: That’s not the same as
Prasanna: I agree.
Curtis: a software backup tool. anyway. All right did you have fun?
Prasanna: I did. I always like talking about Microsoft 365 with you, for some reason. I think it might’ve been the first topic that you brought up to me that had your blood boiling before we started the podcast,
Curtis: Yeah.
Prasanna: I do remember when you were on those calls with Microsoft and you’re like, oh my God, I can’t believe it did you know?.
Curtis: Yeah. Yeah. Thanks to the listeners. Otherwise it’s just me and you talking to microphones. And remember to subscribe so that you can restore it all.
