Overview
Many financial and legal services organizations use Microsoft 365 with Multi-Geo to provision and store data at rest in the Microsoft 365 supported geo-locations to meet their data residency requirements. This feature is to enable such organizations to protect Exchange Online and OneDrive data of Microsoft 365 Multi-Geo enabled tenants, inSync now lets you assign storage to users based on their geo-location.
Enable Multi-Geo capabilities for Microsoft 365 tenant
Microsoft allows you to enable Multi-Geo capabilities for your Microsoft 365 tenant. By enabling Multi-Geo capabilities on the tenant, you can have a single Microsoft 365 tenant that spans across multiple data center geographies, and have full control over where the data is stored. Currently, Multi-Geo is supported for Exchange Online, OneDrive, and SharePoint.
In a Multi-Geo tenant, information about geo locations, groups, and locations is mastered in the Azure active directory (AD). Administrators can use service admin centers to manage geo locations. For more information, see Microsoft documentation.
You may have to reach out to a Microsoft account representative to enable this feature for your Microsoft 365 tenant.
Enable data locations
In a Multi-Geo tenant, users are assigned to a Preferred Data Location (PDL) where data is stored. For new users, their Exchange mailbox and OneDrive will be set up in that location. For existing users, Exchange Online data will be moved to the new location, but an additional step is needed for OneDrive to migrate to the new location. Microsoft provides the ability to change user data location and will move data from one location to another when a user changes locations via multiple PowerShell Commands. Here are a few examples of these sample commands:
Set-MsolUser -UserPrincipalNamejohn.doe@contoso.com-PreferredDataLocation JPN
Start-SPOUserAndContentMove -UserPrincipalNamejohn.doe@contoso.com-DestinationDataLocation JPN
Get-SPOUserAndContentMoveState -UserPrincipalNamejohn.doe@contoso.com
Notifications and user PDL updates
With Microsoft 365 Multi-Geo capability, the backup data of an Exchange Online or OneDrive user resides in the user’s Preferred Data Location (PDL). When PDL changes, mapping it to a different storage location helps you meet your data residency requirements. Your backups will reside in a data location, which is compliant with your updated user PDL.
You can now leverage the timely notifications from the inSync Management Console to identify user PDL updates and update the storage accordingly.
The following illustration describes the workflow when a user PDL is updated for an Exchange Online or OneDrive user.
You can view the Microsoft 365 Preferred Data Location (PDL) details for your Exchange Online and OneDrive users on the inSync Management Console.
If a user's PDL changes, the User Details page displays a notification and an alert to notify about the user PDL update and to update the storage.
For more information about configuring alerts, see Configure Alert Settings.
The following steps enable you to update the storage. It also provides information about the backup and restore activity scenarios after updating the storage.
Step 1: Ensure that you update the storage for the user. For more information about changing storage for a user, see Change storage assigned to a user.
Step 2: Understand the backup and restore scenarios.
Backup and Restore Scenarios
The following points are applicable for backup and restore activities after updating the storage:
The first backup will be a full scan backup.
The subsequent backups will be as per the new PDL and storage settings only.
You can restore from an older backup snapshot, which is associated with the previous PDL. The restore location will be as per the new PDL.
User PDL updates in inSync
The following points are applicable for user PDL updates to reflect in inSync:
In case of newly added or imported users using user deployment options, the PDL details are fetched on-demand from Microsoft and will reflect on the User Details page immediately.
If a user PDL is updated to another location, inSync synchronizes the data using a refresh interval of 24 hours. For example, if a user PDL is updated from location KOR (KOREA) to EUR (Europe/Middle East/Africa), inSync will synchronize the data in a time interval of 24 hours.
📝 Note
As a prerequisite for inSync to synchronize the data, ensure that you have configured the Enterprise Key Management or enabled the Cloud Key Management System (KMS) for your account.
Once inSync identifies a user PDL update, an alert notification is raised immediately. Any subsequent reminder email notifications for user PDL update will be as per the schedule defined in the User Preferred Data Location changed alert.
For more information about configuring alerts, see Configure Alert Settings.
Things to consider for Microsoft Multi-Geo
Administrators can ensure continuous data protection of a user’s Exchange Online and OneDrive data whenever your organization enables Multi-Geo in its Microsoft 365 tenant.
As an administrator, you might have to take the necessary actions as listed below:
Ensure that AWS storage regions exist for all data sources for your Microsoft 365 enabled geo-locations. To enable the desired AWS storage regions, contact Support.
Determine the user’s region attribute to be used within your preferred user provisioning method to map and manage users. Here are a few scenarios:
Import users using Azure AD Integration: You can import users from Microsoft 365 Multi-Geo tenant based on their geo location, group them in a profile and assign storage as per their geo location. Create Azure AD mapping with the attribute name as preferredDataLocation. For example, if your preferred geo location is Canada, create Azure AD mapping as follows: Azure AD Attribute
{preferredDataLocation} = {CAN}For more information, see Create Azure AD mapping.Change in user’s Preferred Data Location (PDL)
If the user’s PDL changes, you can change and assign AWS storage region as per the new geo-location or country. For more information, see Change storage assigned to a user.
❗ Important
The older snapshot will continue to remain in the previous region prior to the PDL changes.