Object Lock

This chapter describes support for the Object Lock feature in Backup Agent:

• About Object Lock (Immutability)
• Object Lock Feature Types
• Default Object Lock (New)
• Object Lock for GFS Backups
• How Object Lock Feature Works
• Supported Storage Providers
• Which Object Lock Type Should I Use?

About Object Lock

This chapter describes support for the Object Lock feature in Backup Agent.

Object Lock Feature Types

The Object Lock feature supports the following feature types:

• Default Object Lock (New)
• Object Lock for GFS Backups

Default Object Lock (New)

Default Object Lock is an alternative immutability type in which all backup data written to the backup destination is automatically locked, regardless of GFS settings.

• Configured on the storage provider side
• Automatically applied to all backup plans using the destination
• Supported for both NBF and CBF backup formats

For details on how to manage Default Object Lock refer to the following article.

Object Lock for GFS Backups

Object Lock for GFS Backups applies only to full backup datasets selected by the GFS (Grandfather-Father-Son) retention policy.

• Configured in the Backup Agent
• Applied manually in backup plans
• Supported only for NBF backup format

For details on how to manage Object Lock for GFS Backups refer to the following article.

How Object Lock Feature Works

Object Lock enforces immutability for backup datasets during a defined retention period. The level of protection depends on the selected retention mode.

Feature type comparison:

Feature Type	Default Object Lock (New)	Object Lock for GFS Backups
Applies to	All backup data written to the backup destination	GFS-selected full backups
Configured in	Storage provider console	Backup Agent
Enabled in backup plans	Automatically for all plans using the backup destination	Manually
Backup formats	NBF and CBF	NBF only
Applicable for retention modes	Governance and Compliance	Governance (Compliance on request)

Retention Modes for Immutable Data

Object Lock supports the following retention modes:

• Governance Mode (default for GFS)
• Compliance Mode

Governance Mode

• Objects can be deleted or modified only by users with special permissions
• Intended for operational protection with administrative override

Compliance Mode

• No user, including root or administrator, can delete or modify locked objects
• Designed for strict regulatory requirements (SEC, FINRA, HIPAA, etc.)
• Once enabled, cannot be undone for affected backups.

If Compliance mode is required for GFS backups, contact MSP360 Support to verify availability and configuration options.

Supported Storage Providers

Object Lock feature is supported for the following storage providers:

• Amazon S3
• Wasabi
• Backblaze B2
• Microsoft Azure
• Google Cloud
• IDribe e2

For some providers (e.g., Microsoft Azure, Google Cloud), Object Lock settings cannot be retrieved automatically. In such cases, you must specify them manually. Refer to the following article for instructions on how to enable Default Object Lock and Object Lock for GFS Backups.

Which Object Lock Type Should I Use?

Choose the Object Lock feature type based on your security requirements, compliance needs, and operational flexibility.

Use Default Object Lock if:

• You require all backup data to be immutable by default
• You must comply with strict regulatory or legal requirements
• You want immutability enforced at the storage level, outside of Backup Agent
• You use both NBF and CBF backup plans

Typical use cases:

• SEC, FINRA, HIPAA, or similar compliance requirements
• Environments with a zero-trust or “write once, read many” policy
• High-risk ransomware scenarios

Use Object Lock for GFS Backups if:

• You want immutability applied only to long-term recovery points
• You use GFS retention to control storage growth
• You need a balance between cost efficiency and protection
• You manage immutability centrally through Backup Agent

Typical use cases:

• Protection against ransomware for critical restore points
• Long-term retention of weekly/monthly backups
• Environments where administrators may still need limited control

Use Both (Recommended for Maximum Protection)

Combining Default Object Lock with GFS-Based Object Lock provides layered protection:

• Default Object Lock protects all backup data
• Object Lock for GFS Backups extends immutability for selected long-term full backups

This approach delivers strong security while keeping long-term storage usage optimized.

Troubleshooting

Refer to the following KB article if you receive error code 1093.