Why real SaaS resilience means breaking free of the hyperscaler

Organizations have standardized on Microsoft 365 and a handful of SaaS platforms because it simplifies operations. But that consolidation comes at a cost most businesses have not fully reckoned with: the more workloads, identities, and protection capabilities are concentrated inside a single hyperscaler ecosystem, the less control an organization actually has over its own data.

For managed service providers (MSPs), that loss of control is becoming the central question in customer conversations.

Customers are becoming more aware of the operational risks that arise when productivity, collaboration, identity management, storage, and data protection all reside within the same hyperscaler environment. The concern is not that cloud platforms are inherently unreliable. It is that when production and protection both depend on the same provider, the same infrastructure, and the same sub-processors, businesses have effectively handed over control of the one thing they cannot afford to lose: the ability to recover their data on their own terms.

As a result, many enterprises are re-evaluating how they approach SaaS data protection and recovery. In place of an all-in-one approach, a growing number are insisting on independence: backup, recovery, and long-term data control that sit outside the primary SaaS platform and outside its underlying hyperscaler. That independence is the foundation of data sovereignty, and it is becoming a requirement rather than a preference.

When consolidation creates new risks

The move to SaaS has delivered clear benefits. IT teams can reduce infrastructure complexity, users gain access to powerful collaboration tools, and businesses can scale more easily than ever before.

Yet consolidation has a trade-off.

When critical business functions are concentrated within a single ecosystem, resilience becomes entirely dependent on that ecosystem's continued availability, policies, and goodwill. For many companies, this has prompted a sharper conversation about dependency, control, and recoverability, one that goes beyond uptime and asks who ultimately holds the keys to their data.

Questions that rarely surfaced a few years ago are becoming more common. What happens if access to a platform is disrupted? How quickly can data be recovered? Does recovery depend on the same environment that is being protected?

These are not necessarily concerns driven by major outages or worst-case scenarios. More often, they reflect a growing understanding that resilience depends on having options when something unexpected happens.

The emergence of the layered protection model

In response, businesses are increasingly looking to separate production environments from protection environments.

Rather than relying on a single provider for productivity, backup, and recovery, businesses are introducing independent layers of protection that sit outside their primary SaaS platform and outside the hyperscaler infrastructure underneath it. Redundancy within the same provider is not independence. If a backup runs on the same cloud as the SaaS application it protects, there is no real separation between production and protection.

Most customers are not looking to move away from Microsoft 365. What they're looking for is greater separation between the platforms they use every day and the systems they rely on for recovery. That's why there is increased interest in layered protection approaches that reduce operational dependency on a single ecosystem.

This approach reflects a broader shift in mindset. Customers are shifting from viewing backup as a standalone requirement and toward viewing protection as part of an overall resilience strategy.

For MSPs, the layered model provides a practical framework for discussing business continuity, recovery, and operational risk without requiring customers to rethink their existing SaaS investments.

Recovery is becoming part of the buying decision

One of the most noticeable changes in customer conversations is the growing focus on recovery itself.

Historically, data protection discussions often centered on storage capacity, retention periods, and feature sets. Today, customers are asking more detailed questions about recoverability.

Can data be restored independently? How long will recovery take? Has the process been tested? What dependencies exist if access to the primary environment is unavailable?

These questions reflect a broader shift in purchasing behavior, and the emphasis on recoverability is not theoretical. Recent industry research shows that enterprises are placing greater importance on recovery outcomes, testing, and operational resilience than they did just a few years ago, reflecting a broader shift from protection-focused to recovery-focused decision-making.

For channel partners, this creates opportunities to deliver services that extend beyond implementation and management. Recovery testing, resilience assessments, continuity planning, and governance support are becoming more prominent as customers seek greater visibility into their recovery posture.

The conversation is gradually moving from "Is my data backed up?" to "Can I get it back when I need it?"

Why sovereignty is following the same path

Most companies do not begin these conversations by talking about sovereignty.

More often, sovereignty enters the discussion after customers start examining recovery, resilience, and dependency risks.

As businesses evaluate where their data resides and how it can be recovered, questions naturally emerge around control, access, jurisdiction, and ownership. What begins as a resilience discussion quickly becomes a sovereignty discussion, and most companies are working with a far narrower definition of sovereignty than the one that actually applies to them.

This is one reason sovereignty is becoming a more visible consideration in purchasing decisions, not a box to check after the fact. It is increasingly being viewed through the lens of operational resilience and vendor independence rather than as a standalone compliance requirement, because compliance alone does not tell a business who can actually reach its data when it matters most.

For MSPs, that creates an opportunity to help customers see past the marketing language and understand how recovery, resilience, compliance, and data control intersect, and where the gaps are when all of it sits inside one hyperscaler's walls.

The businesses pursuing this kind of protection are rarely pursuing a single objective. They want confidence that critical information remains accessible, recoverable, and genuinely under their control, not control as defined by the hyperscaler's terms of service, but control they can verify and exercise themselves, regardless of the circumstances.

The most significant shift is not the technology itself, but the questions customers are asking.

As companies become more dependent on SaaS platforms, they are taking a harder look at the assumptions behind their protection strategies. Increasingly, they are unwilling to accept recovery capabilities that depend on the same hyperscaler, the same infrastructure, or the same sub-processors as the environment being protected, and they want clarity around exactly where that dependency still exists.

That is ultimately what this shift represents: not a rejection of hyperscaler platforms, but a refusal to let them define the limits of recovery. Resilience, and the sovereignty that underpins it, is strongest when the systems a business depends on to get its data back do not answer to the same provider, the same infrastructure, or the same jurisdiction as the systems being protected.