Where are backups stored (on-prem / offsite / offline / MSSP / cloud)?
The carrier is not curious about geography. It is asking which failures a single copy survives, and how many independent copies you have.
What the carrier is actually asking
The carrier is asking for the storage topology: how many copies, in which locations, under whose administration. On-premises, offsite, offline, a managed provider, and cloud are different failure domains, and the strength of the answer comes from combining them rather than from choosing one.
Why it is underwritten
A single copy fails to one event. Two copies in the same building fail to a fire. Two copies under the same credentials fail to one compromised administrator. Underwriters read this answer for independence, which is why the well-known convention of three copies, two media types, one offsite still shapes their expectation, now usually extended with one immutable or offline copy.
Where the answer lives in Microsoft 365, Entra ID, and Azure
The cloud portion of the topology is readable. The rest is attested and should be described precisely.
| Platform | Where the setting lives | What has to be true |
|---|---|---|
| Azure | Storage account replication setting and region | Geo-redundant where the data warrants it, with the paired region understood |
| Azure | Subscription and tenant placement of backup storage | Backup storage separated administratively from production, since separation of identity matters more than separation of location |
| Azure | Network access and private endpoints on backup storage | Not reachable from the public internet, and not reachable from production networks that do not need it |
| Backup product | Repository list with location and immutability state | The full topology, with which copy is protected against deletion. Attested |
| Provider contract | Where a managed provider holds copies and under what terms | Location, retention, deletion rights, and what happens at the end of the contract |
A copy in another region administered by the same account survives a fire and not a compromise. A copy in the same city under separate credentials with a locked retention policy survives the compromise. Carriers care most about the second, so describe the identity boundary alongside the location.
What a defensible yes requires
- At least two copies exist in different failure domains, with one of them offline or immutable.
- The offsite copy is administered by credentials that do not govern production.
- Cloud backup storage is not publicly reachable and has account key access disabled or controlled.
- Where a provider holds copies, their location, retention, and deletion rights are known and in writing.
- The topology is documented, so a recovery does not begin with a discussion about where the copies are.
How this answer goes wrong
The frequent gap is a topology that is offsite in name only: a second appliance in a branch office, joined to the same domain, administered by the same accounts, replicating from the primary. It is a second copy and it is inside the same blast radius as the first. The other gap is the provider answer given without reading the contract, particularly the deletion and exit terms.
Frequently asked
Is cloud storage enough on its own?
It can be, if one copy is immutable and administered separately. Cloud is a location; the controls on the copy are what answer the question.
Does the three-two-one rule still apply?
It remains the shape carriers expect, usually extended to require one immutable or offline copy. The underlying idea, independence of failure domains, has not changed.
What if our MSSP handles backups?
Then their access model becomes part of your answer. Ask where copies sit, who can delete them, and what the exit process is, and keep the answer in writing.
Does geo-redundancy count as offsite?
For regional failure yes. For compromise no, because both replicas answer to the same identity. State which property you are relying on.
Related questions
Stop answering this from memory
Connect Microsoft 365, Entra ID, and Azure read-only. Insurance Posture reads the live configuration behind each application answer and shows you which ones you can prove before you sign.
Assess your posture