Cohesity Alta SaaS Protection 2.x.x Administrator's Guide

• Size

• Last modified date

• Type

• It's advisable to first test the impact of your stubbing policy in a small or less frequently used environment before rolling it out widely. This will help administrators and end-users become familiar with how stubbed files behave. It's important to note that stubbed files do not directly replace the original file in terms of supporting the same functionality within SharePoint.

• Review the Considerations Before Enabling Stubbing section to understand the implications of configuring stubbing and can select Sites and Locations eligible for stubbing, with the appropriate stubbing policy.

• Determine whether you plan to use Cohesity Alta SaaS Protection only to stub certain SharePoint/OneDrive items based on policy, or to back up all data in SharePoint Sites/OneDrive while also stubbing certain items.

• If you plan for only stubbing, ensure that your Custom Backup Policy and Stubbing Policy align with each other.

  • To achieve savings sooner, target larger items first (for example, items > 5 MB, with last modified > 1 year, or whatever your date criteria may be).

  • Later, adjust the criteria for both the Custom Backup Policy and Stubbing Policy to what you plan to use on an ongoing basis (for example, items > 1 MB with last modified > 1 year).

• If stubbing items based on policy while also backing up all items, follow the guidelines in step 2. When setting the ongoing criteria, clear the settings in the Custom Backup Policy so that all items are included in the backup, but only items meeting the stubbing policy criteria are eligible for stubbing.

General considerations:

• Cohesity Alta SaaS Protection stubs an item after the data is moved to Cohesity Alta SaaS Protection storage, depending on the options configured in the connector and its backup policies. By default, Cohesity Alta SaaS Protection does not maintain any other copies of the item. Therefore, Cohesity Alta SaaS Protection stubs items only after creating a primary backup copy. Care should be taken to ensure that this primary copy is not deleted, for example, due to a misconfigured Cohesity Alta SaaS Protection deletion policy.

  Additional options, such as Extra Data Backup, need to be purchased if you want Cohesity Alta SaaS Protection to maintain a separate secondary copy.

• There may be automated processes within SharePoint Online or third-party software integrated with SharePoint Online that relies on the actual file being present for processing. Such locations should be excluded from stubbing.

• There may also be automated processes within SharePoint Online or by the third-party software that copy, move, or create lists and folders where potentially stubbed files can reside. These locations should also be excluded from stubbing.

• If stubbing is based on the 'last modified' date, note that the content, which is frequently accessed but not modified will still be stubbed. Careful consideration should be given to whether such content should be stubbed, as keeping it as stubs may not be desired and can lead to frequent requests to restore the original content.

• For the above reasons, it is crucial to thoroughly evaluate what should not be stubbed before initiating the stubbing process. This careful planning ensures that the stubbing policies are configured correctly, preventing any inadvertent issues.

  If sites or libraries are accidentally stubbed, administrators will have to resort to doing restores by the admin portal. Depending on the number of sites and lists, the need for mass un-stubbing restores may arise. This can take time and may result in a diminished end-user experience.

• Considerations for the restores when stub policy is based on 'Last modified time'. When doing restores, if the stub recall options have:

  • Restore: When content is recalled by clicking on the stub, Cohesity Alta SaaS Protection updates the modification time to prevent the item from being stubbed again immediately.

  • Download Only: End users can download the file, but restores can only be performed from the Administration Portal. By default, when restoring from the Administration Portal, the original last modified time is restored, meaning that the restored content can be stubbed again. To prevent this:

    • Exclude the content from stubbing after it has been restored.

    • When restoring from the Admin Portal, select the option Reset 'last modified time' of restored items to time of restore.

• Stubbing is not supported for Project Web Access sites. These sites must be manually excluded from the stubbing policy.

Stubbed item deletion, movement, and interaction with Cohesity Alta SaaS Protection deletion policies:

• This section describes the behavior of a stub and its corresponding item in Cohesity Alta SaaS Protection under specific scenarios as follows:

  • Stub deletion

    • If a stub is deleted, Cohesity Alta SaaS Protection marks the corresponding item as Removed from source in Cohesity Alta SaaS Protection storage during the next backup cycle.

    • When the stub is restored to its original location from the Recycle Bin, Cohesity Alta SaaS Protection keeps the item marked as Removed from source during the next backup cycle.

    Note:

    Removed from source indicates that Cohesity Alta SaaS Protection recognizes the item is no longer present in its original location. This is important as Cohesity Alta SaaS Protection deletion policies are often configured to delete items marked as Removed from source.

  • Stub movement

    • Cohesity Alta SaaS Protection does not track the copying or movement of stubs from one location to another.

    • When a stub is moved from its original location to a different site or subsite, Cohesity Alta SaaS Protection marks the corresponding item as Removed from source in its storage during the next backup cycle. If the stub is subsequently moved back to its original location, Cohesity Alta SaaS Protection keeps the corresponding item marked as Removed from source because Cohesity Alta SaaS Protection does not automatically recognize that the stub has returned to its original location.

    • If stubs are moved, special considerations may be required for end users to access or restore the data to its original files. For more details, refer to the knowledge base article: Issues when accessing or restoring files from copied or moved stubs (.stub.url) in SharePoint Online.

  • Modification in Version setting

    If the versioning setting of a Document Library in SharePoint is changed from 'Create Major/Minor Version' to 'No Versioning' or vice versa, during the next backup cycle, the corresponding item in Cohesity Alta SaaS Protection is marked as Removed from source.

  • Cohesity Alta SaaS Protection deletion policy and items marked as removed from source

    If an item in Cohesity Alta SaaS Protection storage qualifies for a Cohesity Alta SaaS Protection deletion policy for deletion, it will be deleted from storage without verifying whether it is stubbed at the source. This means that deletion policies can remove items marked as Removed from source, even if they are still present at the source but marked as Removed from source due to certain scenarios described above.

    Recommendation: It is strongly recommended not to use Cohesity Alta SaaS Protection deletion policies that target content where stubbing is or was enabled at the source.

Connector management:

• For a site being backed up by a connector with a stubbing policy, and that contains stubbed items which have been stubbed by same connector, the stubs should be restored before removing the site from the connector or deleting the connector.

• For a site being backed up by a connector with a stubbing policy, if the same site is added to a new connector, no data will be backed up for the data that was stubbed the previous connector by the new connector.

• Stubbing same site by multiple connector is not supported.

Item permissions:

• When an item is stubbed, its permissions are not changed. Any changes to the permissions after the item is stubbed are captured by Cohesity Alta SaaS Protection.

• When a stub is restored back to a file by Cohesity Alta SaaS Protection, the permissions the stub had prior to the restore are maintained by default.

• Cohesity Alta SaaS Protection only allows access to files for end-users with the specific SharePoint Permission Levels which contain the Open List Items permission. If a user or group only has SharePoint Permission Levels which contain View Items or View Application Pages permissions, Cohesity Alta SaaS Protection will not permit access to those files. Default SharePoint permission levels that use the View Items permission include Restricted View, View Only, and Download Only. When files are stubbed, users with these permission levels will not be able to access the files from the stub.

• For more details on how Cohesity Alta SaaS Protection syncs end-user permissions, refer to the section End-user SharePoint Data Access in Cohesity Alta SaaS Protection.

• If Cohesity Alta SaaS Protection backs up and stubs SharePoint sites in two different AD tenants with shared users (for example, a user in Tenant A is also an external user in Tenant B), issues can arise for the shared user if they try to access an item in Cohesity Alta SaaS Protection, via its SharePoint stub in a site present in a tenant where that user is a external. Such a configuration should be avoided.

Item properties:

• When an item is stubbed, its properties and permissions are preserved.

• Any changes to properties made after the item is stubbed are not captured by Cohesity Alta SaaS Protection.

• When a stub is restored back to a file by Cohesity Alta SaaS Protection, the list column properties are restored to the state they were in when Cohesity Alta SaaS Protection initially backed up the item.

Stubbing policy evaluation, configuration, and interaction:

• When configuring exclusions based on type, you must also configure either the last modified date or size criteria.

• The connector stubbing policy will consider an item for stubbing only if all its captured versions meet the criteria configured in the policy.

• The stubbing policy is applied starting from the second full backup, after all data has been successfully backed up during the first full backup.

• The connector stubbing policy applies only to full backups and does not apply to incremental backups occurring between two full backups.

• If both the connector deletion and connector stubbing policies target the same item, the delete policy takes precedence and permanently deletes the item from the source SharePoint environment.

Scope of application of stubbing in SharePoint:

• The stubbing policy applies exclusively to files within document libraries and not to any other library types.

• The stubbing policy specifically applies to items derived from the Document SharePoint content type.

Exclusions from the stubbing policy:

• ASPX files

• Links with a .url extension

• Document libraries in SharePoint that have the Require checkout setting enabled.

  Some site templates, like Publishing Site, create document libraries with this setting enabled. As a result, items in these libraries cannot be stubbed.

  Contact Cohesity Support to enable stubbing for these items.

• Files in libraries and lists with the Information Rights Management (IRM) setting enabled.

• Items that are checked out.

• Thicket file.

• Starting from the 2.26.1 release, the following items cannot be stubbed using the Stubbing policy:

  • All items in sites, which are on legal hold or have a retention policy.

    You need to contact Cohesity Support to enable stubbing for these items.

  • Only when Legal Holds done through Microsoft Purview by link Create eDiscovery holds in an eDiscovery case Microsoft Learn, Cohesity Alta SaaS Protection can detect, and skip stubbing for such items. Any other way is unsupported.

  Contact Cohesity support team to stub other items in such sites.

• Starting from the 2.28.1 release, the following items cannot be stubbed:

  • Items with a sensitivity label configured for encryption cannot be stubbed.

  • Items in read-only sites.

  • Items marked with a retention label and still within the retention period.

• Starting from the 2.31.1 release, the following items cannot be stubbed:

  • Items in lists and libraries with the following version settings enabled in SharePoint Online:

    • Require content approval for submitted items.

    • Create major and minor (draft) versions (for example, 1.0, 1.1, 1.2, 2.0)

    • Some site templates, like Publishing Site, create document libraries with these settings, preventing stubbing in such libraries for the site.

  • Cohesity Alta SaaS Protection does not support the stubbing of Loop components in emails and Teams chats.

    For more information on Loop components, refer to the Microsoft knowledge base article: Overview of Loop Components in Microsoft 365.

• Starting from the 2.35.1 release, the items/files with View only permission will not be stubbed.

• OneNote notebooks.

Sharing links:

• Sharing links (by Teams, OneDrive, or SharePoint) for items created before and after stubbing may not work.

Accessing stubs via the SharePoint App on Mobile devices:

• Accessing stubs through the Microsoft SharePoint App on iOS and Android is not supported. Users can open the SharePoint site in Safari or Chrome, navigate to the library containing the stub, and click on it to access the data in Cohesity Alta SaaS Protection.

Files synchronized with Laptops and PCs:

• When files synchronized with laptops or PCs using the OneDrive client are stubbed, Cohesity Alta SaaS Protection replaces the items with internet shortcuts, adding the .stub.url extension to the item name.

• When an end user tries to access the stubbed file from File Explorer, they are navigated to a browser. Based on the settings configured in Cohesity Alta SaaS Protection for managing end-user experiences with stubs, appropriate actions will be taken. Refer to the Managing End-User Experience with Stubbed Items section for more details.

• When stubbing a file the OneDrive Sync client may add or/and change the stub file. Cohesity does not support the scenario, if the change disrupts the functioning of the stub.

Inconsistent stubbed files:

• Errors can occur at any stage of the stubbing process. The stubbing process attempts to recover from errors by either keeping the original file intact as much as possible or fully stubbing the item.

• For more information on how to handle these errors, refer to the tech note: Cohesity Alta SaaS Protection: Microsoft SharePoint Online Item Stubbing Errors.

Browser support:

• The following browsers are supported for accessing data in Cohesity Alta SaaS Protection by a stub:

  Browser	Restore and Download stub	Download only
  Chrome	Supported	Supported
  Edge	Supported	Supported
  Safari	Not supported	Supported

Stub modifications:

• If there are any external modifications to the stub by any processes other than ASP, this may lead to unsupported scenarios - for example, external processes like a different backup vendor, SharePoint workflows.

• For more information on the end-user workflow when an end-user clicks on a stub, refer to the topic Restore OneDrive/SharePoint stubbed items in the Cohesity Alta SaaS Protection End User Guide.

• As an administrator, you can control the options available to the end-user. You can direct them to the End-User portal to restore the specific item or initiate the download when a stub is clicked. You can use the following permissions to manage the experience of the end user in restoring or downloading the stubbed items:

  • End-User SharePoint stubbing restore: With this permission, when an end-user clicks on the stubbed item, they are redirected to a webpage. On this webpage, an option is available to restore the item to its original location at the time of backup.

  • End-User retrieval and download: With this permission, when an end-user clicks on the stubbed item, they are redirected to a webpage. On this webpage, an option is available to download the last backed-up version of the SharePoint file to the local computer.

    If only this permission is assigned, the download starts when the user clicks the stub.

    Both of these permissions are inherently included in the Default role.

• You can monitor the restore progress on the Restore dashboard.

• A SharePoint user with the View permission can restore the file. The user retains the same permissions for the file after restoration as they had on the stub.

• If a stub is moved from its original location, the restore fails. An Administrator needs to restore it from the Administration portal.

• The last modified date is updated to the current time after restoration or download. This should prevent the item from being picked up by the configured Stub policy if configured based on the last modified time.

• Only the last backed-up version of the SharePoint item before the stubbing occurred is restored.

• You can monitor the restore progress on the Restore dashboard, but you cannot rerun the restore.

• If your tenant is Scope enabled, then clicking on a stub always download the last backed-up version of the SharePoint file to the local computer.