Ransomware protection in Microsoft 365

Microsoft has built in defenses and controls it uses to mitigate the risks of a ransomware attack against your organization and its assets. Assets can be organized by domain with each domain having its own set of risk mitigations.

Domain 1: Tenant level controls

The first domain is the people that make up your organization and the infrastructure and services owned and controlled by your organization. The following features in Microsoft 365 are on by default, or can be configured, to help mitigate the risk and recover from a successful compromise of the assets in this domain.

Exchange Online

• With single item recovery and mailbox retention, customers can recover items in a mailbox upon inadvertent or malicious premature deletion. Customers can roll back mail messages deleted within 14 days by default, configurable up to 30 days.

• Additional customer configurations of these retention policies within the Exchange Online service allow for:

  • configurable retention to be applied (1 year/10 year+)
  • copy on write protection to be applied
  • the ability for the retention policy to be locked such that immutability can be achieved

• Exchange Online Protection scans incoming email and attachments in real-time both entering and exiting the system. This is enabled by default and has filtering customizations available. Messages containing ransomware or other known or suspected malware are deleted. You can configure admins to receive notifications when this occurs.

SharePoint and OneDrive Protection

SharePoint and OneDrive Protection have built in features that help protect against ransomware attacks.

Versioning: As versioning retains a minimum of 500 versions of a file by default and can be configured to retain more, if the ransomware edits and encrypts a file, a previous version of the file can be recovered.

Recycle bin: If the ransomware creates a new encrypted copy of the file, and deletes the old file, customers have 93 days to restore it from the recycle bin.

Preservation Hold library: Files stored in SharePoint or OneDrive sites can be retained by applying retention settings. When a document with versions is subject to retention settings, versions get copied to the Preservation Hold library and exist as a separate item. If a user suspects their files have been compromised, they can investigate file changes by reviewing the retained copy. File Restore can then be used to recover files within the last 30 days.

Teams

Teams chats are stored within Exchange Online user mailboxes and files are stored in either SharePoint or OneDrive. Microsoft Teams data is protected by the controls and recovery mechanisms available in these services.

Domain 2: Service level controls

The second domain is the people that make up Microsoft the organization, and the corporate infrastructure owned and controlled by Microsoft to execute the organizational functions of a business.

Microsoft's approach to securing its corporate estate is Zero Trust, implemented using our own products and services with defenses across our digital estate. You can find more details about the principles of Zero Trust here: Zero Trust Architecture.

Additional features in Microsoft 365 extend the risk mitigations available in domain 1 to further protect the assets in this domain.

SharePoint and OneDrive Protection

Versioning: If ransomware encrypted a file in place, as an edit, the file can be recovered up to the initial file creation date using version history capabilities managed by Microsoft.

Recycle bin: If the ransomware created a new encrypted copy of the file, and deleted the old file, customers have 93 days to restore it from the recycle bin. After 93 days, there's a 14-day window where Microsoft can still recover the data. After this window, the data is permanently deleted.

Teams

The risk mitigations for Teams outlined in Domain 1 also apply to Domain 2.

Domain 3: Developers & service infrastructure

The third domain is the people who develop and operate the Microsoft 365 service, the code, and infrastructure that delivers the service, and the storage and processing of your data.

Microsoft investments that secure the Microsoft 365 platform and mitigate the risks in this domain focus on these areas:

• Continuous assessment and validation of the security posture of the service
• Building tools and architecture that protect the service from compromise
• Building the capability to detect and respond to threats if an attack does occur

Continuous assessment and validation of the security posture

• Microsoft mitigates the risks associated with the people who develop and operate the Microsoft 365 service using the principle of least privilege. This means access and permissions to resources are limited to only what is necessary to perform a needed task.
  • A Just-In-Time (JIT), Just-Enough-Access (JEA) model is used to provide Microsoft engineers with temporary privileges.
  • Engineers must submit a request for a specific task to acquire elevated privileges.
  • Requests are managed through Lockbox, which uses Azure role-based access control (RBAC) to limit the types of JIT elevation requests engineers can make.
• In addition to the above, all Microsoft candidates are pre-screened prior to beginning employment at Microsoft. Employees who maintain Microsoft online services in the United States must undergo a Microsoft Cloud Background Check as a prerequisite for access to online services systems.
• All Microsoft employees are required to complete basic security awareness training along with Standards of Business Conduct training.

Tools and architecture that protect the service

• Microsoft's Security Development Lifecycle (SDL) focuses on developing secure software to improve application security and reduce vulnerabilities. For more information, see Security and Security development and operations overview.
• Microsoft 365 restricts communication between different parts of the service infrastructure to only what is necessary to operate.
• Network traffic is secured using extra network firewalls at boundary points to help detect, prevent, and mitigate network attacks.
• Microsoft 365 services are architected to operate without engineers requiring access to customer data, unless explicitly requested and approved by the customer. For more information, see How does Microsoft collect and process customer data.

Detection and response capabilities

• Microsoft 365 engages in continuous security monitoring of its systems to detect and respond to threats to Microsoft 365 Services.
• Centralized logging collects and analyzes log events for activities that might indicate a security incident. Log data is analyzed as it gets uploaded to our alerting system and produces alerts in near real time.
• Cloud-based tools allow us to respond rapidly to detected threats. These tools enable remediation using automatically triggered actions.
• When automatic remediation isn't possible, alerts are sent to the appropriate on-call engineers, who are equipped with a set of tools that enable them to act in real time to mitigate detected threats.

Recover from a ransomware attack

For the steps to recover from a ransomware attack in Microsoft 365, see Recover from a ransomware attack in Microsoft 365.