In The Wild: 3rd Party Tools for O365 Data Protection

Brian Critchlow works for the Santa Cruz Seaside Company who owns and operates the Santa Cruz Beach Boardwalk Brian works in the technical services team to help build a great guest experience. The Technical Services Team plays a big role in their success. Here's a snippet from a conversation extracted out of the webcast we recently aired in which we interviewed Brian along with Christophe Bertrand of Enterprise Strategy Group and Theresa Miller of Cohesity. You can view the full webcast and interview here: Why You Need to Protect Your Modern Distributed Workloads

Truth in IT: Brian, tell us a bit about Santa Cruz Seaside and your move to O365.

Brian Critchlow: There's really been a big push to modernize our infrastructure. We had a lot of homegrown  applications previous to this. One thing that we did use in the past was the Microsoft Office products. So that's one of the big reasons that we moved to Office 365 when it came to modernizing our infrastructure because it was almost a seamless transition for our users in regards to exchange, the desktop apps and things of that sort. 

What prompted your move to SaaS? 

Brian Critchlow: For the last, I want to say like 15 years, we had an onsite Exchange mail server which was kind of homegrown in a way. And our our end users and our staff members were very accustomed to using Outlook, Word, Powerpoint, Excel and all those Microsoft apps. So management wanted a push to go to standardized enterprise applications and support and integrations would be would be very easy. 

Brian Critchlow: We looked at O365 and we looked at Google Apps and it just seemed a natural transition to move to Office 365 because our staff wouldn't need to be retrained in how to use the desktop applications or, in the case of Google, the lack of desktop applications. So that's one of the primary reasons. And also, we wanted to increase mobility and to increase collaboration between team members. And those are the big reasons for the move. 

What About Managing Back End Infrastructure? 

Brian Critchlow: It was becoming old so we were reaching a point where we would have to update it anyway and rather than move to an onsite Exchange server at that point it was it was easier just to transition to the cloud immediately. We also lacked redundancy and high availability with our previous onsite service. 

Are you using any other Microsoft native methods to protect that Office 365 data, such as legal hold?

Brian Critchlow: For the first year on O365 we kind of walked on thin ice a little bit and didn't really use any backup or data protection solutions. We dabble a little bit in legal hold and a lot of it was was due to cost you know the implementation costs Office 365 can be significant. We also wanted to test the waters and find out what kind of solutions Microsoft and 3rd parties were offering rather than just jumping into something right off the bat. For the first 6-8 months we weren't using OneDrive or Sharepoint so we weren't holding a lot of employee files in the cloud. It was mostly Exchange was the first application that we transitioned to. 

Truth in IT: Though we don't consider legal hold a backup application, some people try to rely on it. But it's always the recovery that gets them if they do try. It's very time consuming because it's a discovery and search and compliance application not backup. It could have unfortunately left you in a position of falling into the category of maybe not even being able to recover. 

Brian Critchlow: Right. You get that inherent 30 day window if you provision a user that you know ends up in the recycle bin. You also get some versioning control inside OneDrive so there's a bit of inherent safety, I guess you could call it. But I think it also gives a little bit of a false sense of security that it's always going to catch errors and it's always going to protect you if you do something incorrect. And that's just not true especially if it if there's any any missed configurations that happen from the IT perspective. You can have irrecoverable situations. 

Truth in IT: The 30 day thing is interesting too...where the enterprise accepted  that the mailbox information goes away 30 days after that person leaves the enterprise. And they'll say, "Nope we don't need the data." And then something comes up unexpected, perhaps from a legal perspective, for example, someone comes along needs that information and you can't even provide it to the courts. We also appreciate some companies that think less is more when it comes to storing data or archives. I guess we'd encourage IT pros to make sure you're working with your legal and compliance team before you decide to rely completely on that 30 day native option for recovery and that if things to just go away after 30 days is OK.

Have you ever needed to use a third party tool to recover Office 365 data for your enterprise? 

Brian Critchlow: After that first year of walking on thin ice we decided to go with the third party application and that backs up our Exchange, OneDrive and Sharepoint. We have used it once, not due to somebody deleting a bunch of things or some corruption or anything of that sort; which a third party application is great for protecting against those things ransomware as well; but our situation actually was where someone left the company and were in a lot of important files and it wasn't until the 30 days had passed that management had asked to get some of these files back. 

Brian Critchlow: So that's where we used a third party tool to recover those files. And now we have a policy where if you de-provision an employee there's certain steps that you take to ensure that any important files that they retain in their OneDrive are shared with management before that 30 day window expires. 

Truth in IT: Yeah that's really interesting. Did you say that that was for OneDrive specifically? 

Brian Critchlow: Yes, OneDrive specifically...so if you share a file or if you have a file on SharePoint, the file is basically owned by the team or owned by the the group that's managing the SharePoint site or the SharePoint group. But when it comes to OneDrive, it's really like it's on your hard drive almost like on your computer. It's owned and operated by you unless you explicitly share those files to someone else. So when you leave the company if IT doesn't do something about the files that are in your OneDrive those files leave with you. They leave with you but they basically end up in the recycle bin. And unless you unless you actively move them out that's where they'll stay. 

Truth in IT: I think that type of situation is more common than we want to think. If you don't have any additional layer of data protection in place that data loss could be significant or have some pretty severe consequences. 

Brian Critchlow: And there's no there's no built in wizard in Office to stick by when you de-provision someone that says, "...hey there's all these files that you may want to do something about before they all go away...," so it's something that you actively have to think about every single time you de-provision that account and sometimes things get over overlooked and that's where having a third party backup tool can save the day.