A charity client faced a serious HR and data security issue after a member of staff left the organisation under difficult circumstances.

It later became clear that information had been sent from their work mailbox to a personal email account, and the sent messages had then been deleted. A formal employment dispute followed, and the charity needed a reliable record of what had happened.

The role of 3^rd party backups

Because we managed an independent Microsoft 365 backup for the organisation, we were able to recover the deleted emails and other relevant historic mailbox data after they were no longer available for recovery from Microsoft.

This showed what had been sent, when it was sent and where it had gone. It also helped identify other activity relevant to the investigation.

The recovered information:

• Supported the charity’s position during the employment proceedings
  • Provided a much clearer audit trail
  • Helped its trustees and advisers understand the sequence of events

Depending on the timing and Microsoft 365 retention settings, deleted emails can sometimes be recovered directly from Microsoft 365. However, that recovery window is limited. The separate backup gave the charity an independent, longer-term recovery source when it mattered.

Could Data Loss Prevention have helped?

Backups help after something has happened. Data Loss Prevention—or DLP—is designed to identify or prevent sensitive information from being shared inappropriately in the first place.

With suitable licensing and careful configuration, DLP policies can detect defined sensitive information being emailed outside an organisation. They can then warn the user, block the message or alert an administrator.

DLP is not a magic switch, and policies need to be properly designed and tested. In this case, however, it might have highlighted the activity earlier or prevented some of the information from leaving.

Some practical lessons from the incident:

• Microsoft 365 backups are not only useful for ransomware or accidental deletion. They can also prove valuable during internal investigations and employment disputes.
  • Backup and retention arrangements should be deliberate, documented and tested rather than left at their default settings.
  • DLP and backup perform different jobs: one helps prevent or flag risky sharing, while the other helps organisations recover and investigate.
  • Clear data-handling, acceptable-use and leaver procedures still matter. Technology supports good policies; it does not replace them.

Hopefully, most organisations will never need to rely on their backups for this reason. This case was a useful reminder that good controls are often most valuable in situations nobody expected.

“We’ll just set it up ourselves.”

It’s something we hear quite often – and sometimes that works perfectly well.

But recently, we saw a situation where a business ended up locked out of their Microsoft account after trying to configure things internally.

What should have been a quick and easy request turned into:

• 2 weeks of disruption

• 20+ support calls to Microsoft

• hours spent trying to reach a human being

• growing costs and lost time

The difficult part?
The original issue was actually very small and would have been prevented entirely with the right setup process.

Modern cloud systems are brilliant when everything is configured correctly – but they can also be unforgiving when key settings are missed.

Sometimes expert help isn’t about making things more complicated. It’s about preventing small issues becoming very big ones.

A title can go here

Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ipsum suspendisse ultrices gravida dictum fusce. Nibh mauris cursus mattis molestie. Ipsum nunc aliquet bibendum enim facilisis gravida neque. Ullamcorper velit sed ullamcorper morbi tincidunt. Aliquam sem fringilla ut morbi. Malesuada bibendum arcu vitae elementum curabitur vitae. Porttitor rhoncus dolor purus non. Erat nam at lectus urna.

Another title

Sed arcu non odio euismod lacinia at quis risus sed. Dictum sit amet justo donec enim diam. Vitae purus faucibus ornare suspendisse sed nisi lacus sed viverra. Dolor purus non enim praesent elementum.

Lorem ipsum dolor sit amet, consectetur adipisicing elit. Asperiores, libero ullam, quaerat aspernatur adipisci, rem odio commodi tempora ratione dolor dolorem minima. Quasi beatae aliquam consequatur. Possimus commodi, esse error?

Lorem ipsum dolor sit amet, consectetur adipisicing elit. Pariatur quasi illo veritatis quibusdam asperiores itaque, nemo suscipit provident ipsum perspiciatis eius nulla officia laudantium doloremque. Tempora esse, beatae ducimus nesciunt.

Another title

Lorem ipsum dolor sit amet, consectetur adipisicing elit. Atque consequatur quibusdam sunt, voluptate necessitatibus assumenda eaque a ea maxime dolor, minima dolorum sit dolorem beatae, pariatur nam quas qui! Voluptates.

Lorem ipsum dolor sit amet, consectetur adipisicing elit. Voluptas magnam suscipit praesentium cupiditate repellendus, architecto nisi, quia quo porro, totam sint nostrum. Fuga est unde ipsum similique laudantium, laborum suscipit?