Data Protection Tool

2023 Guide to Datto SaaS Protection for M365 and Google Workspace

Picture of Dale Shulmistra

Dale Shulmistra

Data Protection Specialist @ Invenio IT


Datto SaaS Protection

Datto SaaS Protection is a SaaS backup solution that protects data stored in Microsoft 365 and Google Workspace. At a time when businesses are increasingly relying on the cloud, protecting data stored in SaaS applications is more important than ever.

If you’re not backing up the data in Microsoft 365 or Google Workspace, then you’re leaving your organization at risk. A loss of SaaS data can be just as disruptive to operations as an on-site server failure. And, you can’t assume the SaaS provider will have your back, either.

In this post, we take a closer look at the role of Datto SaaS Protection in your disaster recovery planning and why it’s crucial.

Datto SaaS Protection builds upon the foundation of a cloud backup solution formerly known as Backupify, which Datto acquired in 2014. Backupify has since been integrated into Datto’s data-protection solutions and have been expanded to include additional features, such as malware scanning and phishing protection.

What does Datto SaaS Protection do?

Datto SaaS Protection protects files stored in Microsoft 365 and Google Workspace by performing automatic backups and malware scanning. The tool integrates with M365 and Google Workspace via API access. Once integrated, it can be automated to back up the data within those services up to three times a day. Backups can also be performed manually when needed.

But the protection doesn’t stop there. Datto SaaS Protection now combines M365 Backup with Datto’s advanced SaaS Defense tools, creating a new solution called Datto SaaS Protection +. So in addition to performing backups, Datto looks for signs of malware infections and phishing attempts. It scans files and OneDrive folders for malware, so that companies can take action at the first signs of malicious activity. Compromised files can be recovered instantly with a simple one-click restore feature.

For the backups, the solution captures point-in-time snapshots of each users’ data, such as email, contacts and calendars. When data loss occurs within M365 or Google Workspace, Datto SaaS Protection can quickly restore it directly to the user’s account, or the data can be downloaded to an admin’s device.

In addition to merely creating backups, Datto SaaS Protection delivers continuity. Since the solution leverages Datto’s own cloud and operates independently from Microsoft 365 and Workspace, organizations can continue to access their SaaS data even if M365 or Google goes down.

Why is M365 Backup so important?

SaaS data loss is extremely common. And when it happens, it can hurt your bottom line more than you think.

The loss of a single cloud folder, for example, can kill productivity and also take hours for IT teams to tediously recover (if it can be recovered at all). On a larger scale, if an entire account is wiped out by ransomware or is prematurely deactivated, the incident could derail your operations for days.

As businesses continue to adapt to a post-pandemic world, they’re becoming more decentralized: employees are working remotely and using SaaS more than ever for email, file sharing and collaboration. But if that data isn’t being adequately protected, it creates a dangerous vulnerability.

What causes SaaS data loss?

1 in 3 companies relying on SaaS solutions have reported losing data in the cloud. The biggest culprit? Accidental deletion. A staggering 47% of the data-loss events were due to files being inadvertently moved, overwritten or trashed.

But that’s only one of several ways that cloud data gets wiped out.

Common causes of SaaS data loss include:

  • Malware and ransomware: Sync-and-share services like Google Drive merely copy your local files and store them in the cloud. So, if local files are encrypted or otherwise infected by malware, the cloud versions are toast, too.
  • Overwritten data: This typically occurs when files or folders are being moved and a user accidentally writes over existing data, wiping out the old stuff. If the mistake isn’t realized fast enough, the overwritten data is gone for good.
  • Bad integrations: SaaS data loss often occurs when other third-party apps are integrated with Google Workspace or Microsoft 365. This could be due to a bad, buggy app itself, or because of misconfigurations in the integration process.
  • Cancelled user licenses: An employee leaves the company, so it makes sense to cancel their M365 account, right? Not so fast. If the user had critical files stored in their account, or critical emails that their successor would need, then that data is now gone. This is an extremely common cause of SaaS data loss.
  • Malicious deletion: You don’t want to believe that any of your employees (including those who are terminated) are capable of intentionally deleting your data, but it happens more than you might think.
  • Accidental deletion: This is the single biggest cause of SaaS data loss: files being deleted, either by accident or because the user believed they were no longer important.

Why can’t the data be recovered by the SaaS application?

A few reasons.

First, unlike data stored on your local servers, your SaaS data is not protected by your on-site backup systems.

Second, most SaaS providers do not provide their own backup protection, beyond a limited period for restoring deleted files, emails, etc. Most service-level agreements (SLAs) have clear language about this process. When deletion occurs on the user end, it’s the user’s responsibility. After all, that’s how these applications should work: when the app receives a command to delete something (whether intentional or not), the app follows the command.

Now, if the provider’s own systems are at fault (i.e. a cloud server failure), then it becomes the provider’s responsibility. And you can generally count on Google and Microsoft to restore your data if/when such an incident were to occur. Beyond that, you’re on your own.

Now, let’s look at the two cloud services that can be backed up by Datto SaaS Protection.

How does Datto SaaS Protection back up Microsoft 365?

Microsoft is clear in its SLA that its core responsibility is uptime—making the service available 24/7. But even if there’s an outage, “you may not be able to retrieve Your Content or Data that you’ve stored,” Microsoft writes. So, it’s critical to have M365 backups that are kept in an external (non-mapped/synced) storage.

Datto SaaS Protection meets this need by protecting all data within Microsoft 365 and storing it on a secondary, georedundant cloud:

  • OneDrive: All files and folders, including folder structures
  • Contacts: All contact data, with the exception of photos
  • Calendars: All calendar events, meeting attendees, attachments, notes, etc.
  • Mail: All emails, attachments, folders, etc.
  • SharePoint data: All documents, sites, forms, data, etc. 

Backups are performed automatically three times a day. The platform even detects new users and automatically archives data for departing employees, so that data is not accidentally lost if M365 accounts are allowed to expire prematurely.

How does it back up Google Workspace?

The backups for Google Workspace provide the same level of protection and are just as critical for organizations that rely on Google’s collaboration tools. Accidental deletion, malware and deprovisioned licenses are all a threat to your Workspace data (and your bottom line).

Datto SaaS Protection backs up Google Workspace data and ensures that everything can be restored when needed, even if you’re years beyond Google’s data retention period:

  • Gmail: All email, attachments, folders, etc.
  • Drive: All documents, files and folder structures
  • Calendar: All calendar events, meeting attendees, attachments, notes, etc.
  • Contacts: All contact data
  • Shared drives (formerly Team Drives): All shared files

Like M365, your Workspace backups are performed automatically three times a day and can also be manually performed on demand whenever needed. Recovery is just as easy: admins can restore deleted data directly back into a user’s account, or the data can be downloaded.

How can lost files be located?

Let’s say an M365 user has lost a single email containing an important spreadsheet, and it may have been deleted months ago. Is it gone forever?

Not if you’re using Datto SaaS Protection.

Datto’s M365 Backup features a robust search tool that allows you to quickly locate missing data on a granular level. The search parameters make it easy to find a long-lost email, as well as contacts, files, or entire folders.

How much data can we keep in M365 Backup?

For businesses that have large volumes of constantly growing SaaS data, Datto SaaS Protection offers an unlimited storage option.

This ensures your data will be protected as your organization grows, whether you have 2 dozen users or 2,000. Admins also have control over data retention, so you can retain your older backups for as long as necessary.

How does Datto SaaS Protection protect against phishing?

Datto SaaS Protection detects phishing attempts by analyzing the composition of emails, chats, or documents in Microsoft Exchange, OneDrive, SharePoint, and Teams. If a phishing attempt or other malicious activity is detected, it is blocked before it reaches the end user.

Datto SaaS Protection’s threat detection is unique from other security solutions, which typically rely on known cyber threats that have been previously detected. That is an important layer of protection, but what about new threats (commonly referred to as zero-day threats) that have never been previously detected? With phishing attempts in particular, the tactics used would not necessarily raise any red flags with conventional anti-malware systems. Datto SaaS Protection’s threat detection goes a step further by detecting those unknown threats. If anything suspicious is detected in an email—malicious links, bad sender info, unusual activity—the threat is stopped in its tracks.

For managed-service providers (MSPs), Datto SaaS Protection also provides detailed visibility into every threat detected. The solution features a simple dashboard that allows MSPs to see why each threat was flagged as malicious, the penetration flow, and the evasion techniques used.

Here are some examples of the various threat types that can be detected:

  • Malicious files requiring a password for accessing them (for example, PDF or ZIP files)
  • Macro malware that exploits the VBA (Visual Basic for Applications) programming in Microsoft 365 macros to spread viruses and other forms of malware
  • Malicious payloads within email attachments that can sit harmlessly for some time until triggered.
  • WMI commands (Windows Management Instrumentation) which can perform dangerous functions within local and remote systems, such as gathering information for discovery and remote execution of files

And again, this threat detection is fully integrated with the M365 Backup. So if an unknown threat still gets past the initial safeguards, any compromised data can be restored with just a few clicks.

Does Datto SaaS Protection merely detect threats or prevent them?

Both. In fact, Datto SaaS Protection gives you control over how it handles threats. You can choose from two modes of operation: Monitoring or Prevention.

  • Monitoring Mode: This mode detects threats without taking any action. It flags a threat as malicious within the dashboard, but it doesn’t quarantine it. This is an effective way to view which threats would be blocked by Prevention Mode, without actually taking action.
  • Prevention Mode: This mode detects and prevents the threats before users see them. This allows you to fully automate your threat defense by automatically blocking each threat as it’s identified. And you’ll still have full visibility into all threats via the dashboard, so you can see what’s being blocked.

What if we need to stay compliant with data regulations?

Companies in industries like healthcare and finance need to be careful how they store their data. Installing a third-party backup tool could suddenly make them not compliant with laws like HIPAA, if the data is not stored properly.

Datto SaaS Protection keeps organizations in compliance by storing M365 and Google Workspace data in secure data centers that are HIPAA-compliant SOC 2 Type II-audited. Additionally, you benefit from data retention control, monitoring tools, audit logs, uptime and availability SLAs, and export capabilities, all of which give you full control over your data and reporting.

What if Google Workspace or M365 goes down?

Even if Microsoft or Google has an outage, Datto SaaS Protection stays online, because it’s not dependent on those services’ clouds. You can continue to access any files or folders that have been backed up the same day (or earlier).

This is an important capability because it helps businesses maintain continuity. When SaaS goes down, it doesn’t have to freeze your most critical projects. Organizations can work with their Datto Partner to quickly regain access and even export the files to their devices, so they can keep working and the business can keep moving forward.

Why Datto for SaaS Backup?

Datto is a trusted industry leader in data protection. In addition to its SaaS backup tools, Datto is known for its advanced BCDR solutions, including the Datto SIRIS and ALTO, which are widely regarded as the best backup systems for SMBs today. Datto has more than 20 locations and 1 million users across the globe.

For SaaS backup specifically, Datto’s solutions offer greater protection and features than any other solution on the market. We’ve touched on some of these features above, but let’s break down the benefits even further.

Features & Benefits

  • Automated & Continuous Backups: With M365 Backup and Workspace Backup, the backups happen automatically around the clock, so you don’t even have to think about it. Whenever needed, you can also perform backups on demand with the push of a button.
  • Robust Data Protection: Datto SaaS Protection doesn’t just protect a few files. It backs up all your data in Microsoft 365 or Google Workspace. That includes emails, calendars, chats, contacts and more, across all M365 services: Exchange, OneDrive, SharePoint, Teams and more. In the event that an entire account has been lost – as can happen when a license expires – your admins can restore everything with just a few quicks.
  • Quick & Easy Integration: All your critical cloud data can be protected in a matter of minutes. A click-through onboarding process makes the setup a snap.
  • Fast & Effortless Restore: M365 Backup enables you to quickly restore (or export) data from a specific point in time before a data loss event occurred. You can restore data back to its original location, export it, or even restore it from one user account into another (which is useful for situations involving expired licenses).
  • Flexible Retention Options: Every organization has its own data-retention needs. That’s why Datto SaaS Protection offers different retention options for Workspace and M365 Backup (including an unlimited option for organizations that require it).
  • Simple, intuitive UI: The solution makes it easy to manage backup, recovery and threat detection from a single pane of glass. You can also quickly view the number of licenses in use.


The use of SaaS applications like Microsoft 365 will only continue to rise in the years ahead. It’s imperative that organizations protect the data in these cloud-based systems, or risk costly data loss and business disruptions. Datto SaaS Protection is a multi-layered solution that performs automatic M365 backups and/or Google Workspace backups, while also preventing malicious cyber threats. It’s an essential tool that should be leveraged by every organization that uses M365 or Workspace as part of its business operations.

Get more information

Learn more about Datto SaaS Protection with M365 Backup or Google Workspace Backup. Request a free demo or contact our business continuity professionals at Invenio IT. Call (646) 395-1170 or email

Get More out of your Datto SIRIS with these expert best practices.
Invenio it logo

Join 23,000+ readers in the Data Protection Forum

Related Articles