In recent years, cloud backup has become synonymous with peace of mind for IT managers and teams. Data is in the cloud, so it's protected.
This perception, however, hides a misconception that can be costly. Providers like Microsoft Azure and Google Cloud offer highly resilient infrastructures, but the responsibility for protecting the data that travels through and resides in these environments is not entirely theirs.
There is a formal model that defines the extent of the provider's obligation and where the company's responsibility begins, and most organizations are unaware of this limit or simply ignore it.
The result manifests as data lost due to accidental deletion, environments compromised by ransomware, and impossible recovery situations in the face of an incident that should never have occurred in a cloud environment.
In this article, you will understand why the cloud is not, by itself, a complete backup strategy, what are the most common risks companies face when blindly trusting their provider, and how to structure truly robust data protection in the cloud.
Read on.
When a company contracts cloud services, it implicitly enters into a division of responsibilities with the provider.
This model, known as shared responsibility, precisely defines what each party must guarantee in terms of security, availability, and data protection.
Objectively, Microsoft documents in its own technical knowledge base that data is always the customer's responsibility, regardless of the contracted service model, be it IaaS, PaaS, or SaaS.
This means that, even when using Azure or Microsoft 365, the company is responsible for data classification, encryption decisions, compliance with regulatory obligations, and, especially, for backup and disaster recovery strategy.
In practice, the provider guarantees the physical infrastructure, data centers, platform availability, and geographical replication of the services it offers.
In other words, if a Microsoft data center in São Paulo experiences a failure, services are maintained through redundancy in another region.
However, this redundancy does not protect against accidental file deletion, ransomware that encrypts data within the environment, insider attacks by employees with privileged access, or data corruption that silently propagates for weeks before being discovered.
Therefore, understanding this model is not a technical detail limited to the IT team, but rather a fundamental element for a strategic decision that directly impacts the operational resilience of the entire organization.
Understanding the specific risks of cloud environments without a dedicated backup strategy is the first step to structuring adequate protection.
The following scenarios are more common than companies usually admit. Therefore, read carefully and consider if any of them reflect your company's reality or if you have already experienced some of these situations:
One of the most underestimated risks in cloud environments is accidental deletion due to human error.
On platforms like OneDrive and Google Drive, any file deleted on one device is automatically removed from all synchronized devices within seconds.
In other words, if an employee accidentally deletes an entire folder, this deletion propagates to all other connected endpoints before anyone notices the problem.
A dangerous belief is that ransomware cannot affect data in the cloud. In fact, criminal groups have evolved precisely to compromise administrator credentials and, from there, encrypt or delete data stored on platforms like Microsoft 365 and Google Workspace.
When an attacker gains access with sufficient privileges, they can act within the environment as a legitimate user, initiating mass deletions or overwriting files with corrupted versions, before any alert is triggered.
The version history natively offered by providers, however, has limited recovery windows that rarely cover incidents discovered weeks after compromise.
Employees with access to critical environments represent a frequently overlooked risk vector.
For example, an employee in the process of being terminated, or simply malicious, can delete records, exfiltrate data, or compromise entire repositories before access is revoked.
This internal threat, however, is rarely considered in companies' backup strategies, which focus almost exclusively on external threats like ransomware and intrusions.
Without an immutable and isolated copy of the data, recovery after this type of incident is unfeasible.
One of the most difficult scenarios to detect is progressive data corruption, where files are gradually altered or damaged without generating immediate alerts.
This can occur due to failures in system integrations, synchronizations with unreported errors, or the action of malware operating discreetly.
When corruption is discovered, the versions available in the provider's history have already been overwritten by the corrupted versions, making recovery impossible without an independent backup with adequate retention.
The financial impact of data loss in corporate environments is growing and well-documented.
The average cost of a data breach in Brazil reached R$ 7.19 million in 2025, representing a 6.5% increase compared to the previous year, according to the IBM annual report on the cost of data breaches.
This distinction is probably the most important point for IT managers and leaders who still treat OneDrive, Google Drive, or Dropbox as a corporate backup strategy.
This is because these tools were designed for real-time synchronization and collaboration, not for data protection and recovery.
Synchronization means that any change made on any device, whether an edit, a deletion, or an overwrite, is automatically replicated to all other points connected to the environment.
This is excellent for collaboration, but it represents the exact opposite of what a backup needs to be: an independent copy, isolated and protected against unauthorized changes.
True cloud backup involves copies stored in an environment separate from the production environment, with retention policies that allow data versions from days, weeks, or months ago to be recovered, with protection against deletion and modification, including attempts originating from the compromised environment itself.
Thus, even if ransomware encrypts everything in Microsoft 365 or Google Workspace, the backup remains intact and accessible for restoration.
The 3-2-1 rule, widely adopted in the information security sector, recommends keeping three copies of data on two different types of media, with one of them in a physically separate location.
For modern corporate environments, this rule has evolved to 3-2-1-1-0: the additional copy must be immutable, meaning it's impossible to alter or delete, and zero recovery errors should be tolerated in periodic tests.
When it comes to corporate backup, two scenarios account for most of the practical risks companies face daily: the data residing on SaaS platforms such as Microsoft 365 and Google Workspace, and the data stored on local servers and virtual machines.
Each of these environments has its own characteristics, specific vulnerabilities, and requires a protection approach tailored to its operation.
See:
Emails in Exchange Online, files in SharePoint, conversations in Teams, documents in Google Drive, and records in Google Workspace hold a significant portion of a company's operational knowledge.
However, as previously discussed, the providers of these platforms guarantee service availability, not the recovery of customer data in all possible scenarios.
An accidental deletion propagated across devices, an account compromise with mass deletion, or silent file corruption can result in losses that the provider simply cannot reverse within the native recovery windows it offers.
Therefore, independent backup of these environments, performed by a specialized solution and stored in a repository separate from the production environment, is an irreplaceable part of any corporate data protection strategy.
Hybrid environments, which combine on-premises infrastructure with cloud services, require a backup approach that covers all layers.
Physical servers, virtual machines, and locally stored files often contain critical operational information that, without a structured and tested backup routine, remains exposed to hardware failures, human errors, and attacks originating from the internal network itself.
Furthermore, the absence of external copies of this data means that a physical incident, such as simultaneous equipment failure or a disaster in the local environment, can result in permanent loss with no possibility of recovery.
This makes a backup and monitoring strategy carried out by specialists crucial.
An effective cloud backup strategy combines appropriate technology, well-defined policies, and continuous validation. Essential elements for a robust corporate environment include:
· Production environment-independent backup: stored in an isolated repository, inaccessible with the same credentials used for the main environment;
· Configured immutability: protection against alteration and deletion during the retention period, covering at least attacks targeting backups;
· Appropriate retention policy: recovery windows that cover the average time between compromise and incident discovery, often exceeding 30 days;
· SaaS Coverage: specific backup for data in Microsoft 365, including Exchange, SharePoint, Teams, and OneDrive, as the provider does not guarantee full recovery in these scenarios;
· Periodic restoration tests: a backup that has never been tested is unreliable. Documented and regular tests are the only way to ensure recovery will work when needed;
· Integrity monitoring: automatic alerts for backup failures, data volume anomalies, and modification attempts in repositories;
· LGPD alignment: retention and disposal policies for personal data in backups must reflect the obligations of the General Data Protection Law, avoiding storing data longer than necessary or discarding it before the regulatory deadline.
However, configuring and maintaining all these elements cohesively requires specialized technical knowledge and time that internal IT teams rarely have available while supporting the company's day-to-day operations.
Thus, the decision between structuring this internally or relying on a specialized partner tends to be clearer than it seems.
Frayha structures and manages complete cloud backup strategies for companies that need real protection, not just remote storage.
This includes the implementation of immutable backup with retention policies tailored to each client's profile, specific coverage for Microsoft 365 and Azure environments, Disaster Recovery plans with defined and tested RTO and RPO, as well as continuous monitoring of backup integrity and environment health.
Furthermore, for companies already using Microsoft 365 or Azure licenses, part of the backup infrastructure can be activated and configured from what is already available in the contracted ecosystem, transforming underutilized resources into real protection.
Because today, trusting that the cloud takes care of everything is a risk no serious operation can afford to take.
👉 Request a free assessment and find out if your company's backup strategy truly protects what cannot be lost.
Not entirely. Microsoft guarantees the platform's availability and resilience, but the protection of the data itself, including recovery after accidental deletion, ransomware, or insider attacks, is the customer's responsibility. Microsoft itself recommends, in its official documentation, that companies maintain independent backups of data stored in Microsoft 365.
No. Synchronization tools are designed for real-time collaboration, not for data recovery. The deletion or corruption of a file is automatically replicated to all connected devices, eliminating the copy that would be used for recovery. A true backup needs to be independent, isolated, and protected against changes.
It is a data copy configured so that it cannot be altered, overwritten, or deleted during a defined period, neither by administrators nor by automated ransomware processes. It is considered the most secure protection standard for corporate environments that need to ensure recovery even after attacks targeting backups.
At least quarterly for full restoration tests, with automated integrity checks performed much more frequently. A backup that has never been tested offers no real guarantee of recovery. Furthermore, test results should be documented and reviewed by IT leadership as part of business continuity governance.
LGPD does not technically define how backup should be performed, but it mandates that companies adopt appropriate technical and organizational measures to protect personal data against loss, unauthorized access, destruction, and disclosure. This includes retention policies that prevent storing personal data longer than necessary and access controls to the backup repository. Non-compliance can result in administrative sanctions from ANPD, including fines of up to 2% of annual revenue.
Online meeting with more control, AI, and security. See how to evolve your communication and avoid reworking in companies.
Paying for Microsoft licenses without using everything is a real waste. Learn how to choose the right plan and extract each feature.
Data migration without planning is a real risk. Learn how to do it with security, continuity, and governance. Don't skip this reading!
Schedule a conversation with our experts and discover how we can protect and boost your business, with no obligation.
