Salesforce Backup and Restore [Tips for MSPs]

MSPs must determine how much data loss is acceptable for their clients, balancing backup frequency with storage costs. Large enterprises with significant changes to data will need larger amounts of storage for backups. (This also depends on how the backups are being done. Incremental backups can reduce the overall amount of data that needs to be stored, and its cost.)

Another option available is the Salesforce weekly update. This is an option that Salesforce makes available through its admin console. This is a manual process and involves exporting .csv files for every table in the database. It’s a potentially laborious process (even more laborious to recover data with this if needed) and will likely include data loss (up to a week). If the client data changes frequently, then this may not meet their RPO. This export also doesn’t capture metadata. There is a workaround to capturing metadata, but it involves creating change sets, and setting up sandboxes to capture user configurations. A recovery process might involve first restoring a client's configuration from a sandbox, followed by re-importing the weekly export data.

Generally, the best approach is to use a third-party backup solution to backup and recover Salesforce data. As of June 2024, there are over 60 options available to do so. Salesforce recommends solutions that support automatic backups, including metadata.

For MSPs, finding solutions that fit specific service desk needs is key. Look for features like easy management of multiple clients' backups and recoveries from a multi-tenant console, integrated billing support, and client-level reporting. If the solution can handle multiple Salesforce accounts, extra emphasis on security and controls to prevent misuse or errors is crucial.

Finally, keeping an eye on the future is essential. Salesforce isn't the only SaaS service businesses rely on; many use multiple SaaS services for critical operations, often integrated with Salesforce. An excellent third-party tool would offer a unified interface to manage a broader SaaS footprint across multiple clients.

Within the SaaSAssure platform, an MSP can choose a SaaS platform to protect (including Salesforce) and see their cost per user. By clicking on a connector, they can add the SaaS platform to backup, and work with the customer to get the necessary credentials to start the process. Once backups are running, billing tracking happens automatically with easy to view usage reports by clients that your financial team can use to generate invoices. A separate user account for a billing contact can be created that has no ability to manage backups, but can pull reports, ensuring greater role-based security.

The SaaSAssure interface is modern, fresh, and easy to use, offering a unified experience across a wide range of SaaS services, not just Salesforce. This allows MSPs to extend their data protection coverage to other applications, increasing their value to their clients.

SaaSAssure includes unlimited storage to the SaaSAssure Cloud, but MSPs with specific compliance needs can opt to use their own storage repositories. Any S3-compatible storage can be utilized as a backup target, ensuring flexibility, seamless integration and compliance.

SaaSAssure was also designed to be highly secure, with 256-AES encryption and multifactor authentication (MFA), as well as role-based access controls. Additionally, SaaSAssure includes MultiPerson Approval (MPA) - which sets a new standard in security, and is a feature that other applications are likely to adopt in the future.

Multiperson Approval (MPA) is a powerful way to protect sensitive information. Backup data is critical, as it serves as the last line of defense when something goes wrong with your Salesforce instance. If a malicious actor gains access to a backup admin console, they can cause significant damage. Despite the protection that MFA offers, it can be bypassed, and admin workstations can be compromised. Human error is also a concern; an admin might accidentally delete a backup job or recover the wrong data set, overwriting good data with old data. A malicious actor could exploit these vulnerabilities intentionally. MPA helps mitigate these risks by requiring multiple approvals for sensitive actions.

MPA requires up to 3 admins to mutually agree on data-destructive tasks. When one admin requests an action, the other (up to 2) admins will receive a notification of what the action is, and a choice to approve or deny. This step alone can alert admins to an attack in progress if that's what’s occurring. It can also be a secondary step to prevent common data recovery errors from happening.