Ask your managed service provider to name the account that runs backups. Then ask what that account can delete. If the same administrator can manage production, shorten backup retention and remove every recovery copy, a successful backup job can give the business false confidence. A compromised account can threaten both the live workload and the way back.
This is a different question from whether a restore works in a routine test. It asks whether a usable copy would still be there to restore after someone gains access to the systems or accounts you ordinarily trust. CISA's StopRansomware guide recommends keeping encrypted offline backups of critical data and testing their availability and integrity in a recovery scenario. For a Malaysian SME, the practical first step is to map who controls each copy.
Follow the permissions, not the location
Pick one service that would stop work if it went down. For a small distributor, that might be the order database and the documents the warehouse needs to release stock. Ask the MSP to show where its recovery points live, how long they are kept and which identities can delete them, stop protection with deletion, reduce retention or remove a safeguard. Include service accounts and any administrator who could grant themselves or someone else those permissions. Review the effective access at the vault, subscription and management group where applicable.
An offsite copy helps address a site outage, but location alone does not give it independent administration. An offline copy addresses a different risk: while disconnected, it is outside the reach of the production system. Locked immutability is another control. It restricts changes to covered recovery points according to the underlying platform and retention configuration. Ask your provider to show which copy has which protection and whether the service you picked is actually covered. An inventory labelled “cloud backup” does not answer those questions.
Make destructive changes need a separate approver
Azure Backup offers one concrete example. Microsoft's documentation distinguishes an immutable vault that is enabled from one that is enabled and locked. The enabled setting can still be turned off. The locked setting is irreversible, and coverage differs between modes and workloads; for instance, the vault immutability setting does not apply to certain operational backups. Before locking anything, validate the retention period, estimated storage costs and coverage with the people responsible for the data. Test on a representative non-production setup.
Azure Backup also provides multiuser authorization through Resource Guard for supported vault operations. The backup operator should not hold the Resource Guard permissions that let them approve their own protected action. Microsoft's guidance explains the role separation and recommends stronger isolation through a separate subscription or tenant where appropriate. Ask your provider which operations are protected for your vault type and who can approve them. A second person reading a ticket is useful, but it is different from the platform enforcing a separate permission.
Rehearse the loss of the normal admin account
Hypothetical example: a Penang distributor uses the same support team for its order system and backup service. It runs a drill in a test environment where the usual production administrator is assumed compromised and unavailable. The backup operator shows that a protected destructive request cannot proceed without the independent role. A recovery lead then uses an approved recovery identity to restore a selected point into an isolated environment. A warehouse supervisor checks that a test order and its supporting document can be opened. No production data or policy is changed during the exercise.
Document who can access encryption keys, establish an isolated restore destination and run the business check. Also record how the team would contact its approver if corporate email were unavailable. The aim is to enforce separation without leaving the business dependent on one person at the worst possible moment.
Ask for three items at your next review
Request a map of the recovery copies for one critical workload, an access record showing who can change or delete them, and the last drill result showing that someone could restore without the usual production admin account. Give every exception an owner and a date: for example, a workload with operational backup only, an account that can still approve its own changes, or a test that stopped before business validation. Start with one service and extend the review once the controls and recovery steps are clear. If you would like to discuss backup protection and recovery ownership, contact AXO Technologies.
Sources and dates
Published 14 November 2026. Sources accessed 14 November 2026.
- CISA: StopRansomware Guide — offline encrypted backups and recovery testing.
- Microsoft Learn: Immutable vault for Azure Backup — vault states, coverage and irreversible locking.
- Microsoft Learn: Configure multiuser authorization using Resource Guard — role separation and configuration.
- Microsoft Learn: Secure your Azure Backup deployment — independent authorization for critical operations.