SharePoint Legal Hold and S3 Versioning Gaps
A university uses Microsoft 365 E5 for 22,000 users: 40 TB Exchange Online, 18 TB SharePoint, and 9 TB OneDrive. Native retention provides 30-day recoverable items; 200 mailboxes are on litigation hold. A third-party SaaS backup retains data for 1 year. An admin deleted a 2 TB SharePoint site collection 70 days ago; a legal hold was placed 10 days ago for a lawsuit. Separately, AWS holds 150 S3 buckets and 60 TB. Versioning is enabled on 40 buckets, MFA delete on 5, and no cross-region replication. A developer deleted 4 TB from a non-versioned bucket 3 days ago. The university has a 72-hour RTO for SaaS and 24-hour RTO for S3.
1. Can the SharePoint site be recovered from native tools, third-party backup, or both? What does the legal hold change?
Read the worked answer
Native Microsoft 365 retention cannot recover a site collection deleted 70 days ago because the native recoverable-items window is 30 days. The third-party backup with 1-year retention is the viable source, provided it captured the site before deletion and can restore at site-collection granularity. The legal hold placed 10 days ago does not resurrect content deleted 70 days ago; it preserves content that exists at the time of hold and may preserve future deletions. To satisfy the lawsuit, restore the site collection to a temporary location, verify content and metadata, then place the restored site under hold or export it to a review platform.
Judgment: do not restore over the original URL until legal confirms scope, because an overwrite could destroy other evidence. Also check whether the third-party backup has immutable retention and whether the backup vendor supports eDiscovery export. The 72-hour SaaS RTO is achievable if the restore is scoped to the 2 TB site rather than the entire tenant.
2. What S3 protection gaps exist, and how should they be closed for the 4 TB deletion?
Read the worked answer
The 4 TB deletion occurred in a non-versioned bucket, so S3 cannot recover the previous object versions natively; the data is likely gone unless an external backup exists. Versioning on only 40 of 150 buckets leaves 110 buckets exposed to overwrite and delete. MFA delete on only 5 buckets means an attacker with compromised credentials can permanently delete versions in the other versioned buckets. No cross-region replication means a regional event or destructive action affects the only copy.
Close the gaps in this order: enable versioning on all buckets that hold regulated or irreplaceable data, then enable MFA delete or, better, S3 Object Lock in compliance mode for backups, then add cross-region replication for critical buckets. For the 4 TB loss, check whether any external backup, snapshot, or downstream copy exists; if not, treat it as unrecoverable and document the lesson. Do not claim the 24-hour S3 RTO is met until restore has been tested from the external copy, not just from versioning.
3. Which SaaS data is most at risk, and what retention design would you recommend?
Read the worked answer
SharePoint and OneDrive are most at risk because native retention is only 30 days and user-driven deletions are common; Exchange has litigation hold on 200 mailboxes but the remaining 21,800 mailboxes still rely on the 30-day native window. The 2 TB site deletion at day 70 proves the gap. Recommend a tiered retention design: native retention for short-term user recovery, third-party backup with at least 1-year retention for all workloads, and legal-hold integration so hold status is visible in the backup platform. For regulated data, use immutable backup copies and restrict deletion of backup snapshots. Test restore of a site collection, a mailbox, and a OneDrive folder quarterly against the 72-hour RTO. Also validate that the third-party backup captures SharePoint permissions and metadata, not just files, because legal holds often depend on version history and audit trails.