Microsoft 365 Backup: What Your Business Must Protect

Microsoft 365 backup is a policy and restore process for the Exchange mailboxes, OneDrive accounts, and SharePoint sites your business needs to recover after deletion, corruption, or an attack. Your data does not become fully recoverable just because it lives in Microsoft 365. You need to know which accounts and sites are protected, when restore points begin, how far back they reach, and who can run a restore. That is the practical difference between having cloud storage and having a tested backup plan.

What does Microsoft 365 Backup protect?

Microsoft's Backup product can protect selected or all Exchange Online mailboxes, OneDrive accounts, and SharePoint sites. An administrator creates policies for the protection units you choose. Restore points begin after those policies are activated, so a newly created policy cannot recover a point from before protection began. Your first job is to list the mailboxes and sites your business cannot afford to lose, then confirm each appears in the policy and in a protection report.

Microsoft explains the protection units and policy setup in its Microsoft 365 Backup documentation.

Is Microsoft 365 retention the same as backup?

No. Microsoft 365 has service resiliency, recycle bins, version history, and retention controls, but each solves a different problem. A recycle bin may help with a recent deletion. Retention can preserve records for policy or legal reasons. A backup policy gives you defined restore points for protected content. Before you buy another tool, write down the incident you are planning for: one deleted file, an emptied mailbox, a damaged SharePoint site, or a broad ransomware event. Then test whether your current controls can restore that case within the time your business needs.

Which restore options should you test?

Test more than a file download. Restore one OneDrive file, one mailbox item, and a SharePoint site or selected content if those workloads matter to you. Check whether a restore replaces the original location or creates a new one, who approves that choice, and what happens to work added since the selected point. Microsoft's guidance warns that an in-place OneDrive or SharePoint rollback can overwrite later changes. Document a safe test process so a routine exercise does not erase current work.

Microsoft lists restore methods and the risks of in-place recovery for OneDrive, SharePoint, and Exchange.

How do you choose a backup plan for a small business?

Start with scope, not a product list. Count active and shared mailboxes, OneDrive accounts, and SharePoint sites; identify regulated data; set a recovery point and recovery time goal for each critical workload. Ask whether backup administration is limited to appropriate roles, whether restore activity is logged, what retention window applies, and how costs change as data grows. Include an offboarding test: if your provider changes, you should still understand who controls the policies and how you will retrieve your data.

What should your IT partner own?

Your partner should maintain a written coverage list, review it when staff and sites change, alert you when protection fails, and run a documented restore test. You should receive the result, not just a statement that backups are running. If your current plan cannot answer which mailbox or site was last tested, use that as the starting point for an assessment. The goal is a restore your team can depend on when the office is already under pressure.

What should a Microsoft 365 backup coverage worksheet include?

Make a one-page list of the work your team would need first after an outage. Record the owner of each shared mailbox, the OneDrive accounts that hold operational files, the SharePoint sites behind active projects, and any data that has a contractual or regulatory retention requirement. Beside each item, record whether it is protected by a backup policy, the policy owner, the retention window, and the last successful restore test. Do not treat a list of user licenses as proof of coverage: a mailbox or site can exist without being included in the policy you intended.

Include changes in the worksheet. When a new employee, shared mailbox, or project site is created, someone should confirm protection before the data becomes business critical. When an employee leaves, check how long their mailbox and OneDrive must remain recoverable and who can request a restore. This turns backup from a purchase decision into an operating process.

How do recovery time and data-loss goals change the choice?

A recovery point objective is the amount of recent work you could lose; a recovery time objective is how long the business can wait to use the system again. Set both for a real task, such as sending invoices or finding a client file, rather than for Microsoft 365 as one large category. Then compare the goals with the restore points and recovery window your selected policy actually offers. If the accounting team cannot work without yesterday's documents, a successful restore of an older site is not a successful business recovery. A drill gives you the elapsed time and data gap to compare with the goals.

Microsoft describes the policy recovery window, restore points, and workload differences in its Backup overview.

What is a safe Microsoft 365 restore drill?

Choose a representative mailbox item, OneDrive file, and SharePoint workload. Agree on a test point and destination before starting, especially if an in-place restore could replace later changes. Have an authorized administrator perform the restore while a business owner checks that the recovered content opens, has the expected version, and is accessible to the right people. Record the request time, approval, start and finish, result, and any permission problems. Use a test item or a separate destination where the product supports it. A screenshot saying the backup job succeeded does not answer whether employees can resume their work.

What should you ask about price and control?

Ask for the current pricing method and a monthly estimate based on your protected data, not only today's user count. Confirm which tenant owns the backup policy, which administrator roles can change or restore it, and how the provider will hand over access if the relationship ends. Clarify whether the quoted service includes policy reviews, alerts, restore drills, and help during an incident. Compare those operational responsibilities with any separate backup product you are considering. The cheapest storage line item can be expensive if nobody has been assigned to notice a failed policy or lead a restore.

What is outside the Microsoft 365 Backup policy?

A Microsoft 365 Backup policy is built around Exchange Online, OneDrive, and SharePoint protection units. Do not assume it also protects every application connected to your tenant, every Teams conversation, device files stored only on a laptop, or configuration changes in a third-party service. Files used in Teams may live in SharePoint or OneDrive, but their protection still depends on the relevant site or account being included. Make a separate list of data outside those three workloads and assign a recovery method to each. That list often reveals the gap between a product name and the full set of systems a business relies on.

When should you compare another backup option?

Compare options when your recovery needs include workloads outside the native policy, a separate copy or administrative boundary, a different retention requirement, or an export path your current plan does not meet. Ask each provider to demonstrate the same test: recover a named mailbox item, a project file, and a site at a chosen point, then show the time, permissions, and final state. Review where the backup is held, who can delete or alter it, and what happens if the tenant itself is inaccessible. A feature checklist is useful, but a matched restore exercise is a fairer comparison than two marketing claims.

See how our managed backup service handles recovery planning and testing.

Review our Microsoft 365 management service for tenant and user administration.