Backup strategy was the first thing that really failed, and it only became obvious when we got called in after a phishing incident. A few important accounts had been compromised, and at first it sounded like a routine cleanup: reset passwords, review sign-ins, lock down MFA, move on.

It wasn’t routine. 

The moment we opened the environment, the whole thing looked like it had been held together with hope and expired assumptions. The company thought it had backup coverage. It did not. 

They were leaning on Veeam, but the server stack was ancient. Windows Server 2012 had been sitting there long enough to become a liability, and the backup system hadn’t been properly maintained. The result was brutal: no working image backups, no file backups, no Exchange backup, no OneDrive backup. When the moment came to prove recoverability, there was nothing to prove. 

That is how businesses get burned: not by a dramatic failure all at once, but by slow neglect that looks harmless until the first real incident, which is exactly why a good backup strategy is so important.

Table of Contents

OneDrive Is Not a Backup Strategy

A lot of people talk about OneDrive like it is a safety net. It is not. It is synchronization.

That difference matters.

If a user deletes a file, OneDrive syncs the deletion. If ransomware encrypts files, sync often helps spread the damage. If someone changes or removes content and the retention window passes, that data is not coming back just because it lived in the cloud. Microsoft’s own backup model is built around defined recovery windows and policy-based protection, not “everything is safe forever.”

That is where the fantasy ends. Cloud storage is not the same thing as backup, and cloud productivity tools are not a substitute for an independent recovery plan. Microsoft 365 Backup exists as a separate product for exactly this reason, and Microsoft documents policies for OneDrive, SharePoint, and Exchange as explicit backup configurations rather than automatic protection.

What Was Missing

This environment had all the classic warning signs.

They were in a hybrid setup, with some machines enrolled in Intune and most still tied to a traditional on-prem domain controller. The file server was the center of gravity for user data. SharePoint was not the real source of truth (and not even being properly used). Desktop and Documents were scattered across endpoints, while the server side depended on an aging physical system that had no real resilience.

That is the kind of environment that breaks hard when governance is weak.

The problem was not just that backups were missing. The problem was that nobody had a clean answer to a simple question: if this server dies today, how fast do we get the business back? Without a working image-based backup, the answer is ugly. File-based backup can restore documents, but it does not rebuild the server, the roles, the configs, the domain services, or the operational state. Image backup is what gets you back when you need the whole machine, not just the files.

What We Put In Place

We started with image-based backup through NinjaOne for the critical systems. That covered the parts that file backup cannot replace: full server recovery, bare-metal restore, and a path back when the machine itself is the problem. NinjaOne’s endpoint backup model supports both file-level and image-level recovery, which is exactly why that distinction matters in a broken environment.

Then we handled the data layer.

The file server got protected directly, because that was where the business actually stored shared work. For endpoints, we backed up user Documents and Desktop folders, because those are the places where real work ends up when policy and reality stop matching. That is not glamorous, but it is the difference between “we can recover” and “we can explain the loss.”

Finally, we fixed Microsoft 365.

We put in a proper SaaS backup with Dropsuite for Exchange and OneDrive. That matters because Microsoft 365 retention is not the same as independent backup, and retention limits exist whether teams like it or not. Microsoft documents recovery windows and retention behavior, including specific backup policy setup for OneDrive, SharePoint, and Exchange.

The Real Consequence

The phishing attempt was the trigger, but it was not the real problem.

The real problem was what would have happened next if the attackers had moved from account compromise to data destruction. No image backup. No SaaS backup. No trustworthy file recovery. No clean rollback. Just a business trying to rebuild from fragments while people ask why the backup system was “supposedly” there.

That is what bad backup planning buys you: confusion, downtime, and damage you could have prevented.

And this is where a lot of MSP-style advice gets weak. It talks about “best practices” like they are optional preferences. They are not. You either have recovery paths or you don’t. You either know what restores fast, what restores fully, and what covers cloud workloads, or you are guessing.

The Lesson

If your environment still has an old domain controller, a fragile file server, or a SaaS stack that people assume is self-protecting, you already have risk on the table. If your backup story is “we have OneDrive” or “Veeam is installed,” that is not a strategy. It is a sentence people say right before an incident proves them wrong. Microsoft 365’s native controls have defined limits, and image backup exists because file backup alone cannot rebuild everything when the server is the thing that fails.

The fix is boring, but boring is the point:

• Image backup for systems you cannot afford to rebuild from scratch.
• File backup for shared data and endpoint content.
• SaaS backup for Exchange, OneDrive, and SharePoint.
• Restore tests, because a backup you never verified is just a comforting icon.
• That is the difference between being “covered” and actually being able to recover.

Read our article on The 4 Best Practices for Small Businesses Using Cloud Backup Services

The Bottom Line

You don’t need perfect governance overnight. You need a baseline that actually works when things go wrong.

If you’re still figuring out whether your servers, endpoints, and Microsoft 365 data are truly backed up, you already know what the answer probably is.

If you want a partner who will tell you the truth about your backup posture and fix it without the fluff, let’s talk.

Book a quick call with us, and we’ll show you exactly where you stand and what you need to fix first.