Ransomware preparedness in Microsoft environments: Why backups alone are not enough

When we ask companies about their ransomware preparedness, the most common answer is: “We have backups.” That is a good start. For management, however, a different question is decisive: how long will operations be down, and what happens to data that was exfiltrated before encryption? This article shows which measures in a Microsoft environment work before, during and after an attack.

Why are backups alone not enough?

Backups restore data, but they prevent neither exfiltration nor downtime. Three reasons:

• Double extortion: Many attackers copy data before they encrypt it and threaten to publish it. A restore changes nothing about that; data protection obligations and reputational questions remain.
• Backups are a target: Attackers deliberately try to neutralise backup applications and shadow copies. Backups that can be reached with the same administrator accounts as production then offer no protection.
• Untested recovery: If you have never performed a full restore, you do not know your actual downtime. The recovery objective remains an estimate.

The principle is therefore: slow the attacker down early, protect administrator rights, and store backups so that even a compromised administrator account cannot delete them.

How do you harden endpoints with Defender for Endpoint and Intune?

For management, the decision is to switch on protection features that are already licensed. For IT, it comes down to three settings in Microsoft Intune under Endpoint security:

• Attack surface reduction (ASR) rules: They block typical malware behaviour, such as scripts that download files or access to the Windows credential store. The standard protection rules can usually run in block mode straight away. Test all other rules in audit mode first, define exclusions for business applications, and then switch to block mode ring by ring.
• Tamper protection: It prevents Defender’s protection features from being switched off on the device, including by local administrators. Enable it in Intune through an Antivirus policy with the “Windows Security Experience” profile. The setting is being renamed to “Controlled configuration” in the management experiences; look for it under that name if necessary.
• Controlled folder access: Only trusted applications may change files in protected folders. Here too, start in audit mode, because older business applications would otherwise be blocked.

What does automatic attack disruption do?

When Microsoft Defender XDR detects a human-operated attack in progress with high confidence, it disables compromised user accounts and contains affected devices without waiting for an analyst. This buys time but does not replace the investigation. It requires Defender for Endpoint Plan 2 (included in Microsoft 365 E5). Fully automatic isolation of a device from the network is a preview feature (as of October 2026). Define who releases contained accounts and devices after review.

How do you protect administrator accounts?

Large-scale encryption almost always requires far-reaching rights. Every permanently privileged account is therefore a risk that management should be aware of.

• Privileged Identity Management (PIM): Administrator roles in Entra ID are activated only when needed, for a limited time and with a justification. PIM requires Microsoft Entra ID P2.
• Separation by tier: Separate administrator accounts without a mailbox, no administration from the normal workstation, and a dedicated administration workstation for critical roles. Whoever manages domain controllers does not sign in to user workstations.
• Conditional Access for administrators: A policy with the “Phishing-resistant MFA” authentication strength (FIDO2 key, Windows Hello for Business or certificate) for all administrator roles. Emergency access accounts remain excluded and are monitored.

How do you make backups tamper-resistant?

A backup only protects you if it cannot be deleted or altered prematurely.

• Azure Backup: An immutable vault prevents recovery points from being deleted before their retention expires. In the “Locked” state this cannot be reversed, so review policies and retention periods beforehand. In addition, keep soft delete enabled and set up multi-user authorisation with a Resource Guard in a separate subscription or tenant, so that no single administrator can switch protection off.
• Microsoft 365 Backup: Backs up Exchange Online, OneDrive and SharePoint within the Microsoft 365 boundary in storage that does not overwrite existing backups. Billing is consumption-based through an Azure subscription. The backup administrator role belongs in PIM.

When did you last test recovery?

A test gives you a measured figure instead of an assumption. Regularly restore a server, a SharePoint site and a mailbox, document how long it takes and compare it with your recovery objectives. In addition, play through a ransomware scenario as a tabletop exercise with management and IT. What the procedure in the tenant looks like is described in the article Incident response in the Microsoft 365 tenant.

The next step

With Endpoint Security & MDM, we implement ASR rules, tamper protection and controlled folder access through Intune in your environment, with documented exclusions. With Managed Security & SOC, we monitor Defender incidents continuously and respond according to agreed runbooks.

Book an introductory call

Frequently Asked Questions

Should we pay the ransom in an emergency?

Payment guarantees neither decryption nor that stolen data will not be published, and it can lead to follow-up attacks. Plan so that you do not have to make this decision: with tested recovery from immutable backups. Agree the approach with your insurer and legal counsel in advance.

What does double extortion mean?

Attackers first copy data, then encrypt it and threaten to publish the copies. Even a complete restore then does not remove data protection obligations and the consequences for customers and partners.

Do we need Microsoft 365 Backup if Microsoft stores the data redundantly anyway?

Redundancy protects against a datacentre failure, but it keeps the current state, not earlier points in time. If data has been encrypted or deleted on a large scale, you need restore points from before the attack, and that is exactly what Microsoft 365 Backup is for.

Which ASR rules should we enable first?

The standard protection rules, which can run in block mode straight away, including blocking access to the Windows credential store and abuse of exploited vulnerable signed drivers. Test all other rules in audit mode first and enable them ring by ring after evaluation.