Cohesity Alta SaaS Protection 2.x.x Administrator's Guide

• Size

• Last modified date

• Type

• Start by testing the policy in a small or less-used environment. This will help Administrators and End Users understand how the policy works before it is deployed widely.

• Check the section 'Considerations Before Enabling the Delete Policy' to understand the implications of deletion of files at source. This will help you decide the correct policy settings and exclude the Sites and Locations where deletion should not be performed.

• Decide on one of the following:

  • Only to archive certain items into Cohesity Alta SaaS Protection and delete them from SharePoint.

  • Back up all the data in SharePoint Sites/OD while also deleting certain files.

  • If only deleting certain files (that is you have decided for 'Only to archive certain items into Cohesity Alta SaaS Protection and delete them from SharePoint'), make it so that you have a Custom Backup Policy and Delete Policies should match each other for the connector.

    • Consider prioritizing larger files: For faster space savings, target larger files first (for example, files over 5 MB modified more than a year ago, or whatever is your date criteria).

    • Adjust criteria over time: Later, adjust both Custom Backup and Delete policies to suit your ongoing plan (for example, files over 1 MB modified more than a year ago).

  • If deleting files based on policy and backing up all files (that is the other option 'Back up all the data in SharePoint Sites/OD while also deleting certain files'.), follow the guidelines in step 4; however, when setting the ongoing criteria, clear out the settings in the Custom Backup Policy so that all files will be part of the backup, but only files that meet the delete policy are eligible for deletion.

General considerations:

• Cohesity Alta SaaS Protection deletes files from the SharePoint Online after creating a primary backup copy in its storage. No additional copies are maintained by default, so it's crucial to avoid accidental deletion of the primary backup, for example, due to a misconfigured Cohesity Alta SaaS Protection deletion policy (used to manage retention of data within Cohesity Alta SaaS Protection storage, not to be confused with connector delete policy).

  You can consider purchasing the Extra Data Backup (EDB) option to maintain a secondary backup copy.

• Sometimes automated processes within SharePoint online OR external applications integrated with SharePoint Online rely on a file to be present for their functioning. Such processes OR applications can be disrupted due to this deletion of the file. Such locations should be excluded from the delete policy.

• If the policy deletes files based on the last modified date, frequently accessed but unmodified content may also be deleted.

  Carefully consider whether such content should be deleted, as it can lead to frequent restore requests.

• Evaluate what should be retained at the source before enabling this policy to configure the deletion exclusions properly.

  If files are accidentally deleted, administrators may need to perform mass restores through the Cohesity Alta SaaS Protection Administration portal, which can be time-consuming and impacts the user experience.

Scope of application in SharePoint:

• Cohesity Alta SaaS Protection only deletes files and not sites, lists, and folders.

• The policy applies only to files within the libraries, which are based on document libraries (for example, whose list base type is a document library).

• The following items cannot be deleted using the connector delete policy:

  • ASPX files

  • Items in hidden lists or catalog lists.

  • Files which have been stubbed by Cohesity Alta SaaS Protection and have the '.stub.url' extension.

    Important - It is important to understand the implications of the above, when applying this policy. Cohesity is not responsible for any loss of functionality in SharePoint because of actions of this policy.

  • If the meet the criteria specified in the deletion policy, it may stop working if files associated with them are deleted.

  • IRM-Enabled Lists: Files that meet deletion criteria will be deleted.

    • They cannot be opened if downloaded from Cohesity Alta SaaS Protection.

    • Restores of such files only work if the IRMS settings of the source list stay unmodified.

  • Retention policies and legal holds: Files which have Retention Labels or reside in a site which have a Retention Policy or Legal Holds will be deleted from their primary locations.

    • They will be retained in the Preservation Hold library and hence may not result in space savings.

    • Deletion of such files may not be desired as this may conflict with any compliance policies at source.

  • Sensitive encrypted labels: Files encrypted with sensitive labels will be deleted. Currently restores of these files have limitations.

    • For the files with Sensitivity labels configured for encryption, only restores from scratch for a single version can be performed.

    • Restoring multiple versions and overwrite restores are not supported, as SharePoint does not allow the creation of a new version on top of such files.

  • Deletion can disrupt functionality for Loop integration and InfoPath integration.

  • Files which are in Site Assets, Site Pages, SharePoint designated System Lists may also be deleted.

  • This is not an exhaustive list, and Cohesity is not liable for any undocumented functionality loss.

Connector Delete Policy Evaluation, Configuration, and Interaction:

• Configure exclusions based on last modified date or size (last accessed time is unsupported).

• The policy is applied from the second full backup, after all the data is successfully backed up by the first full backup. This is not applicable to incremental backups.

• The connector delete policy applies only to full backups and does not apply to incremental backups occurring between two full backups.

• Cohesity Alta SaaS Protection will not remove the current version of a file in SharePoint unless it is the only version of the file still in SharePoint. It leads to the following behavior when both versions of a file in SharePoint with two versions match a delete policy:

  • Backup 1: The older version is deleted. The current version is left.

  • Backup 2: The file is deleted.

• If both the delete and stubbing policies apply to the same file, the delete policy takes precedence, permanently deleting the file from SharePoint.

Interaction with Cohesity Alta SaaS Protection deletion policies (used for retention of data within Cohesity Alta SaaS Protection)

• Cohesity Alta SaaS Protection marks files as Removed from source if they're no longer found in the same location during a subsequent backup after the initial one.

  Note:

  Files deleted at the source by a connector delete policy will also be marked as Removed from source in Cohesity Alta SaaS Protection in the following backup. Cohesity Alta SaaS Protection does not distinguish between deletions made by the connector delete policy or independent deletions at source.

  Note:

  Cohesity Alta SaaS Protection deletion policies (used for retention of data within Cohesity Alta SaaS Protection) can be configured to delete files in Cohesity Alta SaaS Protection marked as Removed from source. As noted above, Cohesity Alta SaaS Protection cannot differentiate between what was deleted at source by Cohesity Alta SaaS Protection (by a connector delete policy) and what was deleted at source by end user action, based on the 'Removed from source' property. This makes it challenging to set up such Cohesity Alta SaaS Protection deletion policies, if there is a need to differentiate the origin of deletions.

Copy/Move of locations containing Files deleted by Cohesity Alta SaaS Protection:

• If a location which previously had files deleted by Cohesity Alta SaaS Protection through a connector delete policy is copied or moved in SharePoint, the currently present data at the source at the copied/moved location be backed to the new location.

  Note:

  Any data that was previously deleted by Cohesity Alta SaaS Protection will remain at the old location.

Backup of Previously Deleted Restored Files:

• After file is restored, Cohesity Alta SaaS Protectionn treats it as a new file during the next backup, resulting in two records. The original file marked as Removed from source (deleted by the connector policy) and the newly ingested file.

End User Access:

• End users can access Cohesity Alta SaaS Protection data through the End-User portal, but their permission level must have the Open Items List Permission in SharePoint. If users' permission level only have View Items or View Application Pages permissions (such as in Restricted View, View Only, or Download Only permission levels), they won't have access to deleted files in the portal.

• For details on how Cohesity Alta SaaS Protection synchronizes permissions, refer to See End-user SharePoint data access in Cohesity Alta SaaS Protection.

• Any enhancements/fixes made by Cohesity Alta SaaS Protection to capture new/existing permissions will not be reflected on files which have already been captured and deleted at source from SharePoint.

• End users can download or restore data, but can only restore files to SharePoint sites where they are primary administrators.

Files Synchronized with laptops, PCs, and Sharing links:

• These will stop working.