A department’s shared folder is gone. A staff member’s OneDrive has been encrypted by ransomware. Someone who left last spring had the only copy of a file the advancement office needs today. When one of these reaches the help desk, the question is the same: how quickly can the data come back?
Microsoft 365 now holds the daily work of most private colleges and universities, from admissions email and budget files to faculty course materials, department sites, and Teams conversations. Microsoft keeps the service available and builds resiliency into it, but the institution remains responsible for protecting its data and being able to recover it. Veeam Data Cloud for Microsoft 365 gives campus IT a way to do that without building and running backup systems of its own. Below, we look at who is responsible for what, what each part of Veeam’s service does, and how a recovery plays out on campus.
Who Is Responsible for Microsoft 365 Data?
Microsoft runs the service, and the campus owns its data. Microsoft describes cloud security as a shared responsibility. In a service like Microsoft 365, Microsoft runs the datacenters, networks, servers, and operating systems behind Exchange, SharePoint, OneDrive, and Teams. Microsoft also builds resilience into the service. Exchange Online, SharePoint, and OneDrive keep replicated copies of data in geographically separate datacenters to protect against physical disasters.
The institution’s side of the line is its data and identities. Microsoft states that customers always keep responsibility for their data, endpoints, accounts, and access management, whatever kind of cloud service they use. Backup covers a different set of risks than replication does. Microsoft points to two kinds of events an institution must be able to recover from quickly: ransomware that encrypts large amounts of data, and accidental or malicious deletions and overwrites.
Microsoft also offers its own Microsoft 365 Backup service, and partner backup solutions, including Veeam’s, can build on its storage.
What does Veeam Data Cloud for M365 back up?
It backs up Exchange, SharePoint, OneDrive, and Teams, the apps campuses use every day. Veeam Data Cloud for Microsoft 365 delivers the backup software, infrastructure, and storage together as one service.
Depending on the configuration, IT can control how long Veeam keeps backups. That matters for institutional records and for the accounts of people who have left. Also depending on the configuration, Veeam can use Microsoft 365 Backup Storage to keep copies inside the Microsoft 365 security boundary, and keep a separate copy in another Azure location.
What Can IT Restore?
IT can restore anything from a single email to an entire SharePoint site. Most recoveries are small: an individual email, file, folder, or other piece of Microsoft 365 content. After ransomware or a large deletion, IT can restore entire SharePoint sites and OneDrive accounts in bulk. In either case, search and eDiscovery tools help IT find the data it needs.
How are the backups themselves protected?
Veeam protects stored backups with immutability, encryption, and access controls, because a backup helps only if it is still intact when the campus needs it. Veeam describes service-level immutability, a protection designed to keep stored backups from being altered. It also lists 256-bit encryption among the protections for backup data. To limit who can reach the backups, Veeam lists multifactor authentication, role-based access control, and IP address access ranges.
Can Veeam protect Microsoft Entra ID too?
Yes, through a separate service, Veeam Data Cloud for Microsoft Entra ID. Everyone on campus signs in through Microsoft Entra ID, so the accounts and groups that control access are worth protecting too. Our passkeys post covers how people sign in. This service protects the identity data behind those sign-ins.
The service protects Entra ID users, groups, application registrations, and other objects. It can restore users, groups, attributes, app registrations, logs, and related metadata. With Entra ID protection in place, if someone on campus accidentally deletes a group, IT can restore it from backup instead of rebuilding it by hand.
What does a recovery look like on campus?
Consider a staff member in the admissions office who opens an infected attachment during the busiest week of the application season. Ransomware starts encrypting files in their OneDrive and in the admissions team’s SharePoint library, which syncs to their laptop. The recovery unfolds like this:
- IT contains the incident first, isolating the laptop and securing the staff member’s account so the damage stops spreading.
- IT turns to the backups, which are kept separately in Veeam’s service rather than on the affected laptop or in the live Microsoft 365 data alone. They are protected by the immutability, encryption, and access controls described above.
- IT searches the backups of that OneDrive account and SharePoint library and selects a recovery point from before the encryption began.
- The most urgent file comes back first. The application review spreadsheet the team needs for that afternoon’s committee meeting is restored on its own, without waiting for everything else.
- IT restores the rest in bulk, bringing back the whole OneDrive account and SharePoint library rather than going file by file.
- The office gets back to work with the recovered versions of its files from before the attack.
Containment stops the damage, separate and protected backups make the recovery possible, and granular and bulk restore get the office working again.
How Does ScholarBuys Help?
ScholarBuys works alongside private and independent colleges and universities as an extension of their IT staff. Since 2008, our team has helped campuses choose the Microsoft solutions that fit how they actually operate, and through our partnerships with independent college associations in 14 states, we help each institution use its consortium membership to find the best solution for its needs. Today, more than 325 private colleges and universities partner with ScholarBuys.