Office 365 numbers growing but report identifies some bad user habits in SharePoint and OneDrive

As someone who frequently writes about Office 365, I receive many communications from PR representatives of various companies who would like to advance the name of their company and increase awareness of their activities. Many of those communications relate to Office 365 and what the company is doing to help manage/control/assist/facilitate the transition to the cloud. It’s part of the publicity game and sometimes interesting information is provided.

The biggest problem I have with any data presented about Office 365 is the lack of verifiable proof. Microsoft doesn’t help because it cloaks the progress it is undoubtly making with Office 365 for competitive reasons. The hardest data we have comes from Microsoft’s financial statements, the latest of which tells us that Microsoft achieved an annual run rate of “over $8 billion” for commercial cloud services in the last reporting period (FY15 Q4). That’s an 96% increase from $4.4 billion this time last year.

I’ve become accustomed to seeing growth in these numbers, but this figure was startling because CEO Satya Nadella spoke of a $6.3 billion run rate when Microsoft released their FY15 Q3 results. Clearly Microsoft’s sales force was incredibly good at closing cloud deals in the three months before the end of their fiscal year.

Of course, that $8 billion covers all commercial cloud services, so Azure and Dynamics CRM are included in the mix. We have to extrapolate how much Office 365 contributes (the business service, not Office 365 Home). My gut feeling is that the figure for Office 365 lies in the $5.2 to $5.5 billion range, which is certainly a chunk of change but possibly not yet enough to fund the massive expansion in datacenter capacity needed to handle the growth in Office 365. Still, Microsoft has very deep pockets and can afford to pay the datacenter bills. After all, this is their platform for the future.

Some other indications to guide us slip through Microsoft’s mask of silence. At Ignite, a Microsoft speaker claimed that 35% of the Exchange installed base now uses Exchange Online. Now, that 35% might be valid providing you know the size of the installed base. Independent observers who have been following the market for years consider that figure to be around 350 million, so 35% is 120 million or thereabouts. Put that in context with the assertion made in April that some 50 million Office 365 subscribers actively use the service monthly. I can’t imagine that 70 million subscribers are inactive nor that the size of the Exchange installed base is around 200 million, so now you see the difficulty in understanding just how many Office 365 users there are.

Another way of looking at Office 365 is to try and estimate what impact it has had on companies. A July 2015 report from Skyhigh Networks entitled “Office 365 Adoption and Risk Q2 2015”, looks at Office 365 from the perspective of SharePoint Online activity (including OneDrive for Business). Skyhigh is a cloud security and enablement company and the report is based on the cloud usage of their 21 million users, whose data was aggregated and anonymized (BTW: note to Skyhigh writers: the term is always “on-premises” and never “on-premise”. Please update your text and web site).

My standard health warning for reading a report produced by any company applies: always understand what the authors are selling. In this case, Skyhigh would very much like Office 365 tenants to consider their Data Loss Prevention (DLP) capabilities, so naturally the report highlights some facts to support their case.

In any case, Skyhigh reports that 87.3% of the companies they know about have “at least 100 active Office 365 users”. The report found that most companies are moving workload to the cloud relatively slowly. Taking an “average organization” (which I assume is in the medium-to-large space), the report says that just 6.8% of all users have moved to Office 365, meaning that Microsoft has a huge amount of headroom into which to grow its Office 365 market. This is not only of interest to Microsoft, but also to the ISVs who constitute the ecosystem that surround and support applications like Exchange and SharePoint. Without these ISVs, Microsoft could not have the success that these applications have experienced, yet many of these companies face the disappearance of their on-premises market and have to figure out how to create a replacement business around Office 365. The opportunity exists. It’s just a matter of figuring out where.

The report states that the average company uploads 1.7 TB of data monthly to Yammer, SharePoint Online, and OneDrive for Business and points out that much of this data is sensitive. Skyhigh says that 17.4% of all documents contain sensitive data. They break this down into categories, so we learn that 4.2% contain personal data, 2.2% protected health information, 1.8% contains bank account or credit card data, and 9.2% contain sensitive business data.

I wonder how many of these companies use DLP policies to monitor and control their SharePoint and OneDrive sites? DLP has been available for Exchange Online for two years or thereabouts but only recently became available for SharePoint and OneDrive, so perhaps this data might serve as a wake-up call for those managing SharePoint Online. Another snippet of data reveals that the average company stores 143 files in OneDrive that contain the word “password” in the filename. What a wonderfully silly practice to follow!

Microsoft’s financial results tell us that companies are moving to the cloud at an accelerating pace. You can quibble about the exact numbers of subscribers, users, seats, or whatever, but reports filed with the SEC don’t lie. Well, almost never. And if more data is going to be stored on cloud servers, it seems like a good idea to ensure that the data is protected. The evidence cited by Skyhigh indicates that this might not be the case for some SharePoint Online and OneDrive for Business customers, possibly because they are unaware of the Office 365 features (DLP, Rights Management, preservation and deletion policies) that can be used to protect and secure documents. Be sure to check whether your Office 365 plan allows you to access these features as they are not covered in all plans.

As to the folks who insist on using the word password in document names? Perhaps electric shock therapy would help… or maybe not.

Follow Tony @12Knocksinna