You have plenty of options to make sure your data is protected in a worst case scenario. Find out what those are.

Whether you are just considering your move to Office 365 or are already there, you’ve no doubt been thinking about operations and disaster recovery.

Microsoft remains committed to transparency when it comes to service health monitoring and outage notifications and updates. They have also put into place a system of geo-redundancy that makes it extremely unlikely for a complete Microsoft service outage to happen across all data centers and all services.

Microsoft Responsibilities

Microsoft ensures that customer data is available whenever it is needed through the following features:

  • Data storage and redundancy: Customer data is stored in a redundant environment with robust data protection capabilities to enable availability, business continuity, and rapid recovery. Multiple levels of data redundancy are implemented, ranging from redundant disks to guard against local disk failure to continuous, full data replication to a geographically diverse data center.
  • Data monitoring: Office 365 services maintain high levels of performance by:
    • Monitoring databases:
      • Blocked processes
      • Packet loss
      • Queued processes
      • Query latency
    • Completing preventative maintenance: Preventative maintenance includes database consistency checks, periodic data compression, and error log reviews.

Administration Responsibilities

It’s up to us as the consumer, however, to ensure we are aware of the level of service we can expect and are monitoring the availability of our own tenants. Need service SLA documentation? Click here. Here are some basics for Office 365:


  • The recoverable Item store is set to only keep deleted items for 14 days.
  • This 14-day value can be increased, but can only be set to a maximum of 30 days on Office 365 plan E1; in plans E3 & E5 it can be set to any value.
  • All Office 365 licensing plans are limited to a 20GB Recoverable Items store per user, at which stage the system will delete oldest emails first.
  • Litigation Hold version of the Recoverable Items store has no size or version limits.

SharePoint and OneDrive:

  • Deleted items remain in the Recycle Bin for 30 days.
  • SharePoint Online data is backed up every 12 hours.
  • Backups are kept for 14 days.
  • One-hour RPO: Microsoft protects your SharePoint Online data and has a copy of that data that is equal to or less than one-hour old.
  • Six-hour RTO: Organizations will be able to resume service within six hours after service disruption if a disaster incapacitates a hosting data center.

Users have a tremendous amount of control over the deletion and restoration of their own personal documents. Administrators have at least 30 days to retrieve data from their tenant as data is soft-deleted first.

Did a user account get deleted accidentally? No problem, recreate it, synchronize it, and access the data. Of course, the two-stage recycle bin in SharePoint has been around for a while now so no problem there either.

OneDrive users have a point-in-time restore utility built-in so be sure users are aware of the feature.

Data Retention in Office 365

Also, don’t forget about retention policies for data across Office 365. These policies can ensure you remain legally compliant with any industry regulations you might have. Managing these policies typically requires two actions:

  • Retaining content so that it can’t be permanently deleted before the end of the retention period.
  • Deleting content permanently at the end of the retention period.

With a retention policy, you can:

  • Decide proactively whether to retain content, delete content or both – retain and then delete the content.
  • Apply a single policy to the entire organization or just specific locations or users.
  • Apply a policy to all content or just content meeting certain conditions, such as content containing specific keywords or specific types of sensitive information.

Outside Help

If you’re interested in defining and managing what you keep, where you keep it, and how often you gather it, you also have a few options:

  • See if a hybrid or scripted solution would work.
  • Use a third party vendor of SaaS solutions that fill this gap.


If you’re interested in what Azure can do for you, there are options for that as well.

  • Failover your on-premises environment to Azure if you can’t move it all yet.
  • Use Azure’s site recovery.
  • Use an Azure partner for disaster recovery.

Final Thoughts

You won’t find 20-plus-year-old strategies anymore for a continuity and disaster recovery scenario. Today it’s more convenient, cost-effective and simpler to find continuity and disaster recovery as a service.

There are still plenty of options available for you to take extra precautions with the data you think is better protected so it’s locked in a safe for a worst-case scenario.