Full Report
SPONSORED FEATURE: Your M365 and Azure data might not be as safe as you think from ransomware; time for a reality check
Analysis Summary
# Best Practices: Microsoft 365 and Azure Cyber Resilience
## Overview
These practices address the "Responsibility Gap" in cloud services. While Microsoft ensures service availability (uptime), the customer is legally and operationally responsible for the security, retention, and recovery of data, identities, and configurations within M365, Azure, and Entra ID.
## Key Recommendations
### Immediate Actions
1. **Acknowledge the Shared Responsibility Model:** Formally document that Microsoft is not responsible for data restoration after a ransomware attack or accidental deletion beyond limited native retention windows.
2. **Audit Identity Access:** Review Entra ID (formerly Azure AD) for compromised credentials or "stray" accounts, as identity is now the primary attack surface.
3. **Implement MFA:** Ensure Multi-Factor Authentication is enforced across all M365 and Azure accounts to mitigate AI-powered credential stuffing.
### Short-term Improvements (1-3 months)
1. **Deploy Independent Backup:** Establish a third-party, air-gapped backup solution (e.g., Datto SaaS Protection) that stores data outside the Microsoft ecosystem.
2. **Protect Entra ID Configurations:** Implement specific backup for Entra ID to ensure that if a tenant is compromised, you can restore user identities, groups, and permissions.
3. **Review Retention Policies:** Configure native M365 labels and governance settings as a first line of defense, while recognizing they are not a substitute for true backup.
### Long-term Strategy (3+ months)
1. **Shift to "Cyber Resilience":** Move focus from mere "protection" (which can fail) to "rapid recovery" capabilities.
2. **Standardize Multi-Cloud/Hybrid Protection:** Ensure that data in IaaS, PaaS, and SaaS environments are protected to the same standard of quality and recoverability.
3. **Automate Recovery Testing:** Regularly simulate ransomware scenarios to verify that data can be restored to a "known good point" within SLA timeframes.
## Implementation Guidance
### For Small Organizations
- Use automated SaaS backup tools that require minimal management overhead.
- Focus heavily on protecting M365 mailboxes and OneDrive, as these are the most common entry points for phishing.
### For Medium Organizations
- Implement centralized management for backups across M365, Azure VMs, and SQL databases.
- Align backup schedules with business-critical RPOs (Recovery Point Objectives).
### For Large Enterprises
- Prioritize the recovery of Entra ID to prevent "identity lockout" during an attack.
- Ensure backup data is immutable and stored in a separate sovereign cloud or independent environment to prevent cross-tenant contamination.
## Configuration Examples
*Note: Based on the article's focus on independent platforms.*
- **Immutable Storage:** Configure backup sets so they cannot be modified or deleted by the primary M365 administrator credentials (to prevent an attacker with admin rights from deleting backups).
- **Identity-First Recovery:** Configure backup agents specifically for Entra ID objects (users, roles, and groups) to ensure the "order of operations" during recovery allows users to log back in once data is restored.
## Compliance Alignment
- **NIST Cybersecurity Framework:** Aligns with the "Recover" function.
- **DORA / GDPR:** Meets requirements for data availability and resilience under stringent regulatory environments.
- **CIS Controls:** Specifically Control 11 (Data Recovery).
## Common Pitfalls to Avoid
- **The "Native Myth":** Assuming Microsoft’s "Deleted Items" folder or "Litigation Hold" constitutes a disaster recovery plan.
- **Identity Neglect:** Backing up files but forgetting to back up the Entra ID identities required to access those files.
- **Single Point of Failure:** Keeping backups within the same Azure tenant that hosts the production data.
## Resources
- **Datto SaaS Protection:** [hXXps://www.datto.com/products/saas-protection/]
- **Microsoft Shared Responsibility Model Documentation:** [hXXps://learn.microsoft.com/en-us/azure/security/fundamentals/shared-responsibility]
- **Kaseya/Datto Resource:** [hXXps://www.kaseya.com/resource/msp-buyers-guide-to-choosing-microsoft-entra-id-backup/]