The recent article on The Register, "The backup Microsoft never promised you," dropped a hard truth that many IT managers and MSPs are trying to ignore: Microsoft 365 and Azure data is not immune to ransomware, and Microsoft is not responsible for backing it up.
For those of us in the trenches, this isn't just a compliance issue—it's an operational nightmare waiting to happen. When a Synced ransomware attack hits an M365 tenant, it doesn't just encrypt files; it generates a storm of system events. Your ticketing system floods, your RMM flaps with "access denied" errors, and your phone starts blowing up.
But here is the reality: most IT teams learn about these critical outages from their users, not their tools. Why? Because the signal is buried in a mountain of noise.
The Problem: Signal Failure in a Crisis
The fundamental issue isn't that we lack monitoring tools; it's that we lack coherent monitoring. In a typical environment, an MSP or internal IT department relies on a fragmented stack:
- RMM (e.g., NinjaOne, Datto, ConnectWise): Great for patching and basic endpoint health, but often blind to cloud-layer anomalies like mass permission changes in Azure AD.
- Standalone Helpdesk: Focused on ticket volume, not infrastructure topology.
- Cloud Native Monitors: Azure Monitor tells you a VM is down, but it doesn't tell you that the Helpdesk just received 50 tickets from that specific department.
When ransomware strikes, these tools fail to communicate. A ransomware event triggers a cascade:
- The RMM detects 50 workstations failing to authenticate.
- The Network Monitor sees a spike in outbound traffic.
- The Helpdesk gets 50 "I can't open my files" emails.
To the on-call engineer, this looks like 100 separate problems. They get paged repeatedly. Burned out by "alert fatigue," they silence the notifications. Meanwhile, the actual crisis—a mass data deletion event in SharePoint—is passing silently under the radar because no tool correlated the authentication failures with the file access logs.
How AlertMonitor Solves This
At AlertMonitor, we realized that alert fatigue isn't a volume problem; it's a signal quality problem. The platform was built to unify these disparate signals into a single, coherent narrative for the on-call team.
Instead of 100 alerts, AlertMonitor correlates the event:
- Contextual Enrichment: Every alert carries full context—device, client, what changed, and what "healthy" looks like. If an Azure AD user is deleted, AlertMonitor doesn't just say "User Missing"; it tags the client, lists the affected resources, and shows that this is a deviation from the baseline established over the last 30 days.
- Smart Deduplication: Those 50 "Authentication Failed" alerts from the RMM? In AlertMonitor, they are collapsed into a single high-severity incident: "Mass Authentication Failure detected at [Client Name]."
- Intelligent Escalation: We move beyond simple "round-robin" paging. You configure policies based on the signal. A critical cloud anomaly (like a mass M365 file deletion) routes immediately to the Senior Systems Engineer, skipping the Tier 1 tech who is already swamped with password resets.
The result is that on-call staff respond to meaningful signals, not cascading noise. When the "Microsoft backup" gap causes a data loss event, your team isn't scrolling through pages of disk space alerts—they are triaging a single, high-priority incident with all the data they need in one view.
Practical Steps: Hardening Your Alert Strategy
You cannot rely on Microsoft's shared responsibility model to save you from operational chaos. You need to own your monitoring stack. Here is how to start today using AlertMonitor.
1. Correlate Your Backup Health with On-Call Status
Since Microsoft isn't backing up your data, you likely have a third-party solution (Veeam, AvePoint, etc.) running on a Windows Server. Do not wait for the backup admin to tell you it failed.
Use this PowerShell script to check the status of your backup services and disk space on the repository server. Integrate this into AlertMonitor to trigger a Critical Alert if the service stops or space drops below 10GB.
$ServiceName = "VeeamBackupSvc"
$DriveLetter = "D:"
$MinFreeSpaceGB = 10
# Check Service Status
$Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue
if (-not $Service -or $Service.Status -ne 'Running') {
Write-Output "CRITICAL: Backup service $ServiceName is not running."
exit 1
}
# Check Disk Space
$Drive = Get-PSDrive -Name $DriveLetter.Replace(':','') -ErrorAction SilentlyContinue
if ($Drive.Free -lt ($MinFreeSpaceGB * 1GB)) {
$FreeGB = [math]::Round($Drive.Free / 1GB, 2)
Write-Output "CRITICAL: Backup drive $DriveLetter has only ${FreeGB}GB free (Threshold: ${MinFreeSpaceGB}GB)."
exit 1
}
Write-Output "OK: Backup service running and disk space sufficient."
exit 0
2. Configure Maintenance Windows to Prevent Noise During Recovery
When you are recovering from a ransomware attack, the last thing you need is your RMM alerting you that "Agent is offline" while you are rebuilding the machine.
In AlertMonitor, create a "Global Maintenance" policy. When a Critical Incident is declared (e.g., "Active Ransomware Response"), automatically trigger a maintenance window for the affected client. This suppresses low-level noise so the on-call team can focus on the resolution without battling their inbox.
3. Map Your Topology
Upload your network topology into AlertMonitor. Ensure that your Azure AD Connect servers and your local domain controllers are explicitly linked. If the sync server goes offline, AlertMonitor should flag this as a risk to your Identity Provider, not just a generic "server down" alert.
Conclusion
The backup Microsoft never promised you is a gap in your data protection strategy. The alert fatigue your team suffers from is a gap in your operational strategy. By unifying your RMM, Helpdesk, and Monitoring data into AlertMonitor, you ensure that when the worst happens, your team is alert, informed, and ready to respond—rather than burnt out and confused.
Related Resources
AlertMonitor Alert Management & On-Call Operations AlertMonitor Platform Overview Book a Demo Alert Management & On-Call Operations Resources
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.