Files That Get Dumped in the Night - A Microsoft 365 Horror Story

It’s was an exciting week last week. We had a data breach! (not really as it transpires, but we had something strange and potentially horrifying happen)

One of our engineering team had been working on a project, and went to update some of the files only to find they were no longer there... also no longer in the recycle bins in SharePoint - so he gave me a call.

I discounted the usual suspects of ‘My dog ate my homework, but I mean I haven’t really done it’, and ‘they’d never been saved’ as the delve logs clearly show them being saved, but now no sign of them. Also no sign of a deletion event.

Quite the mystery! Now looking in the default toolkit in Microsoft 365, there was no logs of change, or deletion to any of his files. So stumped, we turned to one thing we do have - which quite a number of folks don’t have for Microsoft 365 - the backup!

One thing that people don’t realise is that Office doesn’t have long term retention beyond the recycle areas, and a determined admin can purge these. Fortunately, we have one that is independent of 365 and is immutable.

A quick search and we found the files in the folder, and could recover them. 

Also, after a quick search in the backup logs forward of that point, we found the same files, no longer in the same place but in a sub folder. And a culprit of another engineer who’d accidentally click-dragged them in Explore and not noticed. Cake fines will be imposed at the next review!

So all in all, not really a breach, just accidently moved to a subfolder. But thanks to a good backup strategy of Microsoft 365, we had assurance that we could recover them, and find out what had happened.

Dave McCarthy - Chief Technology Officer

Do you have a Microsoft 365 Backup plan? If we didn't, this could have really been a horror story.

Remember, your Microsoft 365 data is not backed up in a way that most organisations require. Typically, there's only a 30-day retention period inbuilt into Office 365, and Microsoft SharePoint Online is only backed up every 12 hours, with just a 14-day retention period.