<https://www.acronis.com/en-sg/blog/posts/how-msps-can-back-up-microsoft-365-for-their-clients/#hasPart_FAQPage_mainEntity1_acceptedAnswer_Answer>
<https://schema.orgtext>
"Microsoft 365 tools store and process a vast amount of\nsensitive data, such as email messages, documents, spreadsheets, presentations\nand files. However, these solutions are not fool-proof. Aside from\ncyberattacks, data loss can also occur due to accidental or malicious deletions,\ncloud or data center disruptions, plugin and application conflicts, and other\nerrors. In light of such eventualities, you need a third-party&nbsp;<a href=\"/products/cyber-protect/backup/\" rel=\"\">backup solution</a>&nbsp;that makes up for the four Microsoft 365 limitations reviewed below. \nLimited retention\nperiod \nMicrosoft 365’s retention window is 30 to 90 days. This can be a\nproblem if you need to recover data that does not fall within this timeframe.\nAdditionally, suppose you manually remove data from the Recoverable Items\nfolder or hard-delete a file. In this case, the data is permanently gone unless\nyou subscribe to eDiscovery, a plan designed to retain data for use as evidence\nstrictly in legal cases. \nLimited recovery\noptions \nMicrosoft 365's built-in recovery options are limited and\nmay not recover all data types. For example, under the basic recovery options,\nyou can restore accidentally deleted emails via the Deleted Items tab. But this\nonly works for recently deleted files, not long-deleted files, compromised\nmailboxes, or failed migrations.\nOneDrive weakness \nAlthough OneDrive is cloud storage, it stores synchronized\ncopies of Microsoft 365 data. This means that when data is corrupted on your local\ndevice, any data on the OneDrive cloud is automatically infected as well.\nAdditionally, Microsoft 365 does not follow the&nbsp;<a href=\"/blog/posts/backup-rule/\" target=\"_blank\" rel=\"noopener\">3-2-1 backup rule</a>&nbsp;where you have three\nseparate backups stored on two media carriers and one off-site. Instead, any\nbackup data is stored along with the source data, making your backups\nvulnerable to the exact same threats as the source data.\nSecurity risks and\ncompliance requirements \nMicrosoft 365 operates via a shared responsibility model when it\ncomes to data security which requires users to provide additional security for\ntheir data. Any clients in heavily regulated industries also have compliance\nrequirements that mandate data retention for years. Therefore, relying solely\non the M365 retention window is a violation and could lead to sanctions. \n"
<https://www.acronis.com/en-sg/blog/posts/how-msps-can-back-up-microsoft-365-for-their-clients/>