In the Microsoft Volume Licensing Service Level Agreement for Microsoft Online Services document, dated August 1, 2023, the terms for each of the individual cloud services are listed with the following information:

• Downtime Specifies exactly what type or types of service interruption legally constitute downtime in the terms of the agreement. Some of the definitions of downtime for cloud services included in Microsoft 365 are shown in Table 4-5.
• Monthly Uptime Percentage Specifies the formula by which the percentage of uptime is calculated for each month, considering the number of minutes the service was considered to be down and the number of user licenses affected by the outage. For example, the following formula subtracts the total number of downtime minutes for all the users from the total user minutes and calculates a percentage from that:

User Minutes−Downtime MinutesUser Minutes

• Service Credit Specifies the percentage of the monthly subscription fee that will be credited to the subscriber’s account based on the calculated monthly uptime percentage. For example, Microsoft’s SLA for Microsoft 365 Apps for Enterprise guarantees 99.9 percent uptime, so the service credit for months that do not meet that percentage is calculated as shown in Table 4-6. Other Microsoft services can have different SLA guarantees, such as Azure Active Directory, which has a 99.99 percent guaranteed uptime.
• Additional Terms Identifies other parts of the document that might define other conditions constituting a refundable service outage. For example, a failure of Exchange Online to detect viruses or filter spam as agreed in the SLA can qualify for a service credit, even if no downtime occurs.

TABLE 4-5 Definitions of downtime in the Microsoft Volume Licensing Service Level Agreement for Microsoft Online Services

TABLE 4-6 Service credit for monthly uptime percentages in the Microsoft Volume Licensing Service Level Agreement for Microsoft 365 Apps for Enterprise

Microsoft requires subscribers to file a claim for service credits containing evidence of the outages, as described in the following SLA excerpt:

In order for Microsoft to consider a claim, you must submit the claim to customer support at Microsoft Corporation including all information necessary for Microsoft to validate the claim, including but not limited to: (i) a detailed description of the Incident; (ii) information regarding the time and duration of the Downtime; (iii) the number and location(s) of affected users (if applicable); and (iv) descriptions of your attempts to resolve the Incident at the time of occurrence.

Generally speaking, it appears as though the SLA for Microsoft’s online services is rarely even needed. For example, Table 4-7 lists the worldwide quarterly uptime percentages for the Microsoft 365 cloud services in recent years, and none of the figures even comes close to dropping below the 99.9 percent uptime guaranteed for most of the Microsoft 365 services. This is not to say that there weren’t a few isolated outages resulting in service credits, but the overall record for the Microsoft 365 products is impressive.

TABLE 4-7 Quarterly Uptime Percentages for Microsoft 365, 2019 to 2023

For many IT professionals who are hesitant to move their operations to the cloud, security is the biggest issue that concerns them. The idea of storing sensitive company data on Internet servers, over which they have no direct control—and for which they do not even know the exact location—can be frightening. However, Microsoft has invested an enormous amount of time, effort, and expense into securing its datacenters, and Microsoft 365 includes an array of security tools that subscribers can utilize to provide defense against outside intrusions.

Every security situation is a matter of judgment. Administrators must evaluate the organization’s data and decide how much security it requires. In cases of highly sensitive data, the prospect of storing it in the cloud should rightly be frightening. In such cases, it might be necessary for an organization to maintain local storage and split the enterprise functionality between cloud-based and on-premises systems.

As noted elsewhere in this book, Microsoft maintains dozens of datacenters worldwide. The fact that Microsoft’s cloud services are storing data for thousands of organizations means they have the incentive and the capital to build datacenters with equipment and physical security that only the largest corporations could conceivably duplicate. For most prospective Microsoft 365 subscribers, the cloud will provide greater physical security, higher availability, and more fault tolerance than they could provide themselves.

Therefore, if the Microsoft datacenters can be considered safe against physical theft and most natural disasters, the remaining security concerns are centered around protecting identities, devices, and documents. These concerns threaten any enterprise network, whether on-premises or in the cloud. Unauthorized users can conceivably gain access to sensitive data wherever it is stored, and IT professionals must always try to prevent that from happening.

Security is a continuously developing challenge, with threats growing as quickly as the means to protect against them. For administrators who want to use Microsoft products to keep up with the latest developing threats, there is no question that the latest and best security tools that Microsoft makes are to be found in cloud-based platforms, such as Microsoft 365. Perpetual products, such as Exchange Server and Office 2021, are being left behind in their security capabilities in favor of Software as a Service (SaaS) products like Microsoft 365, Exchange Online, and the cloud-based SharePoint.

The Microsoft 365 security components include the following:

• Microsoft Intune Provides device and application management services that allow mobile devices to join the network only if they comply with security policies that ensure they are appropriately equipped and configured
• Azure Information Protection Enables users and administrators to apply classification labels to documents and implement various types of protection based on the labels, such as access restrictions and data encryption
• Data Loss Prevention Enables the automated discovery of documents that contain common data patterns, such as those of credit cards and Social Security numbers, using preconfigured sensitive information types
• Microsoft Defender for Cloud Apps Analyzes traffic logs and proxy scripts to identify the cloud apps that users are accessing and enables administrators to analyze app security and sanction or unsanction individual apps
• Microsoft Entra ID Protection Evaluates the sign-in activities of individual user accounts and assigns them risk levels that increment when multiple negative events occur
• Microsoft Defender for Identity Uses machine intelligence to prevent, detect, and remediate security threats unique to the Azure environment by analyzing user behavior and comparing it to known attack patterns
• Microsoft Advanced Threat Analytics Captures network traffic and log information and analyzes it to identify suspicious behaviors related to known phases of typical attack processes

Another aspect of Microsoft 365 that might help to convince traditionalists that a cloud platform can be secure is its use of intelligent analysis to identify behavior indicative of an attack. Tools like Microsoft 365 Defender gather information from Microsoft 365 devices, applications, and services and use endpoint behavioral sensors, cloud security analytics, and threat intelligence to prevent, discover, investigate, and remediate potential and actual threats.