Object Lock (Immutability)

This chapter is intended to describe Object Lock Immutability support for Microsoft 365 / Google Workspace Backup. For information on how Object Lock (Immutability) is supported for backup plans in new backup format with GFS, refer to the following article.

This chapter covers the following topics:

• About Object Lock (Immutability)
• Retention Modes for Immutable Data
• Grant Administrators Permissions to Manage Object Lock (Immutability)
• Allow Object Lock (Immutability) in Backup Destinations
  • Amazon S3
  • Wasabi
  • Backblaze B2
• Disable Object Lock (Immutability) for Storage Account
• Manage Object Lock (Immutability) using Retention Policies

About Object Lock (Immutability)

Object Lock (Immutability) is a feature that locks backup datasets for a period specified by default or custom retention policy. If Object Lock (Immutability) is allowed for the backup storage, all backups with configured retention policy that are created in this backup storage become immutable for the retention period. Within this period, backup data is kept unmodified. Object Lock (Immutability) is not applicable for the backups without a configured retention policy.

Object Lock (Immutability) is supported by the following storage providers:

• AWS
• Wasabi
• Backblaze B2

If the storage with Object Lock (Immutability) enabled is selected for Microsoft 365 / Google Workspace Backup, you will see the Object Lock icon on the main menu of Service Dashboard.

The Object Lock (Immutability) feature support depends on the retention policy assigned. If the Immutability is applied along with retention policy settings, backups that are subject to the retention policy become immutable for the period specified by retention policy. Refer to the table below for details on how it works.

Object Lock on Backup Destination	Default Retention Policy	Custom Retention Policy	RESULT	Comment
✔️	✔️	✔️	Backup locked	Unable to delete backup data until the period set by custom retention policy expires
✔️	✔️	❌	Backup locked	Unable to delete backup data until the period set by default retention policy expires
✔️	❌	✔️	Backup locked	Unable to delete backup data until the period set by custom retention policy expires
✔️	❌	❌	Backup NOT locked	Backup data can be deleted
❌	✔️	✔️	Backup NOT locked	Backup data can be deleted

| Top |

Retention Modes for Immutable Data

Generally, two object lock retention modes are supported for immutable storage:

• Governance mode (default, all storages work in this mode)

  In Governance mode, protected objects in backup storage are locked (users cannot overwrite or delete an object version or alter its lock settings using Management Console or Backup Agent). These objects can only be deleted using cloud storage provider tools. By design, when you create a destination bucket using the Management Console, the Governance mode is used for all destination buckets with Immutability enabled.

• Compliance mode

  In Compliance mode, protected objects in backup storage are locked completely (users cannot overwrite or delete an object version or alter its lock settings using Management Console or Backup Agent). These objects cannot be deleted until their retention period defined in the retention policy settings ends. Management Console or Backup Agent provide no option to switch object lock retention mode for existing destination buckets. If you need to use the Compliance mode for the case, you can check this option with MSP360 support.

| Top |

Allow 'Manage Object Lock (Immutability)' Permission for Your Administrators

If you intend to delegate the Immutability management to your administrators, grant the appropriate permission for them. To do this, proceed as follows:

1. Open the Management Console.
2. In the Organization menu, select Administrators.
3. Click Edit or Add Administrator to create a new one.
4. Switch to the Permissions tab.
5. Find the Manage Object Lock (Immutability) option, then select the appropriate checkbox.
6. Click Save.

| Top |

Allow Object Lock (Immutability) for Storage Account

If you need to comply with the regulations, maintenance or legal requirements, or anything else that requires an immutable backup dataset, enable this feature for an appropriate storage account. If you do not have any storage destinations with the allowed Object Lock (Immutability), you can create a new destination bucket in Management Console.

AWS S3

Ensure that GetBucketObjectLockConfiguration permission is granted.

To allow Object Lock (Immutability) for AWS S3, proceed as follows:

1. Open the Management Console.
2. In the Storage Accounts, select the required account to allow the Object Lock (Immutability) or create a new storage account.

3. Expand the actions, then select View Backup Destinations.
4. Click Add Destination Bucket to create a new backup destination for immutable backups.
5. In the Destination Bucket property box, fill in the required data (create or select an existing bucket), then click Enable Object Lock (Immutability).

6. Confirm the action: read the confirmation message, select the I Confirm Enabling Object Lock (Immutability) check box, then click Confirm.
7. Once you are done, proceed to Microsoft 365 / Google Workspace Dashboard to create retention policies for specific services or exported PST files. The allowed Immutability enables this feature on the specified bucket only and does not apply this feature to any backups or exported files. You should create retention policies for every service or exported PST file to apply object lock period for them as described below.

| Top |

Wasabi

To allow the Object Lock (Immutability) for Wasabi, proceed as follows:

1. Open the Management Console.
2. In the Storage Accounts, select the required account to allow the Immutability or create a new storage account.

3. Expand the actions, then select View Backup Destinations.
4. Click Add Destination Bucket to create a new backup destination for immutable backups.
5. In the Destination Bucket property box, fill in the required data (create or select an existing bucket), then click Enable Object Lock (Immutability).

6. Confirm the action: read the confirmation message, select the I Confirm Enabling Object Lock (Immutability) check box, then click Confirm.
7. Once you are done, proceed to Microsoft 365 / Google Workspace Dashboard to create retention policies for specific services or exported PST files. The allowed Immutability enables this feature on the specified bucket only and does not apply this feature to any backups or exported files. You should create retention policies for every service or exported PST file to apply object lock period for them as described below..

| Top |

Backblaze B2

To allow the Object Lock (Immutability) for Backblaze B2 destinations, proceed as follows:

1. Open the Management Console.
2. In the Storage Accounts, select the required Backblaze account to allow the Immutability or create a new Backblaze storage account.
3. Expand the actions, then select View Backup Destinations. If you just created a new Backblaze storage account, just follow the storage account creation wizard.
4. Click Add Destination Bucket to create a new backup destination for immutable backups.
5. In the Add Destination Bucket box, select the Create new bucket option, specify the new bucket name, then select the Enable Object Lock (Immutability) check box. If you want to use the existing bucket, click ..., then select the required bucket from the list.

6. Confirm the action: read the confirmation message, select the I confirm enabling Object Lock (Immutability) check box, then click Confirm.
7. Once you are done, proceed to Microsoft 365 / Google Workspace Dasboards to create retention policies for specific services or exported PST files. The allowed Immutability enables this feature on the specified bucket only and does not apply this feature to any backups or exported files. You should create retention policies for every service or exported PST file to apply object lock period for them as described below.

| Top |

Disable Object Lock (Immutability) for Storage Account

If you change the retention policy, storage account, or disable the Object Lock (Immutability) for storage account, all backup data locked with the Object Lock (Immutability) will be kept for the period specified in the retention policy settings applied at the moment these data was backed up.

If you need to suspend or terminate immutable backup keeping, proceed as follows:

1. Open the Management Console.
2. In the Storage > Storage Accounts, select the required account.
3. Expand the actions, then select View Backup Destinations.
4. Click the ... button to edit an existing destination.
5. In the Edit Destination Bucket property box, clear the Enable Object Lock (Immutability) check box.

6. Click Save.

| Top |

Create Retention Policies

Refer to the following articles for details on how to configure retention policies:

• Microsoft 365
• Google Workspace

| Top |