Does Microsoft 365 include a backup?

No, and neither does Google Workspace. Both guarantee service availability and replicate data across their own data centers, but neither keeps an independent copy to recover from when something is deleted or encrypted from the inside. The recycle bin and deleted-item retention expire after days or weeks and are reachable with the same administrator credentials, so they are not a backup: mail, shared files and Teams need a copy outside the tenant.

Is a VM snapshot a backup?

No, not while it sits on the same storage as the machine, so it does not count as one of the three copies. A snapshot is a fast rollback point, useful for undoing a bad update, but it shares the fate of the volume hosting it and can be deleted with the credentials that administer the hypervisor. It counts as a copy only once exported to separate media or a separate account, with locked retention and a distinct identity.

What is the 3-2-1 backup rule?

Three copies of the data, on two media types, one off site: the minimum bar for a backup to survive the incident.

The 3-2-1 rule is the minimum criterion for organizing a backup: three copies of the data, counting the original, on at least two different media types, with one copy kept away from the site hosting production. It comes from digital photography and took hold as practice because each number covers a different way of losing data: three copies cover the single failure, two media cover the systematic defect of one technology or firmware, the remote copy covers the event that hits the building, from fire to flooding. In the extended formulation, now the most cited one, it becomes 3-2-1-1-0: one of the copies is immutable or physically disconnected, and the number of verified errors in restore drills must be zero. That first one and that zero are the two additions answering attacks aimed at backups.

Immutability and credentials: the copy that is not a backup

A copy reachable with the same credentials that administer production is not a backup: it is a second target. In ransomware attacks the deletion of backups comes before encryption, precisely because an attacker holding domain privileges or the cloud tenant keys reaches the repository like any administrator. Hence immutability: object lock, WORM, snapshots with a retention period that not even the user who created them can change, or an offline copy on tape. It also takes credentials separate from the domain, multi-factor authentication on the backup console and no network path that lets production mount the repository. A copy in a second bucket of the same tenant, under the same identity and without locked retention, satisfies the rule on paper only.

The honest limit: continuity yes, confidentiality no

A backup, however well built, solves one problem only. Since double extortion became the operating standard of criminal groups, data is exfiltrated before encryption: a perfect restore brings the systems back and does nothing to prevent publication of what has already been copied out. A backup therefore defends operational continuity, not confidentiality, and calling it ransomware protection is inaccurate. The practical consequence is that an organization with impeccable backups still has a data breach to handle, with the notification obligations that follow. Exfiltration takes different controls: segmentation, access management, encryption of sensitive data, detection of anomalous outbound transfers.

Why it matters for decision makers

The 3-2-1 rule is useful because it can be checked in half an hour: count the copies, look at where they live, ask which credentials reach them and whether retention is locked. The service level it should produce, though, is set by RTO and RPO: copy frequency follows from the data you accept losing, not from a nightly habit. And compliance with the rule still says nothing about the ability to resume, which is only demonstrated by a restore test. Finally, worth assessing where the remote copy ends up: data residency applies to backups too, and they often escape the inventory made of production systems.