Moving email, files, and collaboration into Microsoft 365 can make it easy to assume that data protection is already taken care of. After all, Microsoft hosts the environment. But keeping cloud services available and being able to recover the exact information your business needs after deletion, corruption, or another incident are different requirements.
Microsoft provides resiliency and recovery capabilities across Microsoft 365 and offers Microsoft 365 Backup for Exchange, OneDrive, and SharePoint. The service is specifically designed to support recovery following malicious or accidental data deletion.
That leaves businesses with an important question: What Microsoft 365 data needs to be recoverable, how quickly do you need it back, and does your current data protection strategy meet those requirements?
Microsoft provides built-in resiliency, retention, and recovery capabilities, while Microsoft 365 Backup is available as a separate pay-as-you-go service. Microsoft says the service can protect all or selected SharePoint sites, OneDrive accounts, and Exchange mailboxes.
Rather than asking only whether Microsoft 365 is backed up, businesses should determine whether their current protection matches their actual recovery needs.
Consider:
Microsoft 365 Backup provides configurable recovery windows of three months, six months, one year, or two years for supported workloads. Businesses should compare those options against their own operational, security, and compliance requirements.
In this episode of the Demystifying Microsoft Podcast, Sourcepass host Nathan Taylor is joined by Steve Brining, Cybersecurity Evangelist at Acronis, to discuss Microsoft 365 backup, recovery, retention, archiving, Teams data, identity protection, and the role third-party backup can play in a broader Microsoft 365 data protection strategy.
Backup and retention can both preserve information, but they serve different purposes.
Microsoft Purview retention policies help organizations retain content, delete content, or retain it for a defined period before deletion. Depending on the configuration, policies can apply across supported Microsoft 365 locations and specific content.
Retention is primarily about managing the information lifecycle and supporting governance requirements.
Backup focuses on recoverability. The simpler question is: "If something happens to this data, can we recover the version we need?"
Microsoft 365 Backup provides restoration capabilities for supported Exchange, SharePoint, and OneDrive data. An organization may therefore have strong retention policies and still need a separate backup strategy if its operational recovery requirements go beyond what those policies are designed to address.
Backup and archiving address another important distinction in data protection.
Backup focuses on recovery. It provides a way to restore data following deletion, corruption, unwanted changes, or other incidents. Archiving focuses on long-term preservation. Organizations may preserve information to meet legal, regulatory, governance, or historical requirements.
A straightforward way to distinguish them is:
Backup: How do we recover the data we need?
Archive: How do we preserve information for as long as required?
Organizations may need both, but their requirements and intended outcomes should be defined separately.
Microsoft's native capabilities are one option for protecting Microsoft 365 data. Organizations can also evaluate independent third-party backup platforms based on their specific requirements.
A third-party solution may be worth considering when the organization requires:
For example, Acronis Backup for Microsoft 365 provides protection across Exchange Online, OneDrive for Business, SharePoint, supported Microsoft Teams content, and Microsoft Entra ID.
The goal should not be choosing native or third-party backup by default. Instead, compare workload coverage, restoration capabilities, storage, security, administration, and cost against the organization's recovery requirements.
Microsoft Teams deserves specific consideration because businesses increasingly use it for collaboration and information sharing. Microsoft's native Microsoft 365 Backup documentation currently identifies Exchange Online, OneDrive, and SharePoint as protected workloads.
Acronis documents protection for Teams content including teams, channels, channel files, team mailboxes, meetings, and sites. However, its current documentation also identifies limitations, including the exclusion of private one-to-one and group chats and limitations around restoring channel conversations directly into Teams.
Not every data-loss incident requires restoring an entire workload. An employee may delete an important email. A specific folder may need to be recovered. Information belonging to a former employee may be required later. Granular recovery helps administrators restore the affected information without treating every incident as a complete workload recovery.
Microsoft 365 Backup supports full restoration for SharePoint sites and OneDrive accounts, along with Exchange mailbox item restoration capabilities. Acronis also offers recovery of individual emails, files, and supported collaboration data.
This is why organizations should evaluate more than whether a platform successfully creates backups. Recovery should be tested to confirm that the specific information the business relies on can be located and restored.
Microsoft 365 data protection increasingly extends beyond files and communications to identity.
Microsoft Entra ID contains users, groups, policies, configurations, and other identity information that supports access to business resources. Organizations should consider what would need to be recovered if important identity information were accidentally deleted, misconfigured, or otherwise affected.
Acronis offers Microsoft Entra ID backup capabilities covering identity information such as users, groups, policies, and configurations.
As cloud identities become more central to business operations, identity recovery should be considered alongside email, files, and collaboration data when defining a Microsoft 365 recovery strategy.
Start with your organization's recovery requirements rather than the product. Use these six questions to guide the evaluation:
Identify the workloads and information employees rely on, including Exchange, OneDrive, SharePoint, Teams, and relevant identity data.
Set recovery requirements based on operational, legal, regulatory, and business needs rather than relying solely on platform defaults.
Determine how long critical workloads and information can realistically be unavailable following an incident.
Identify whether the business needs to restore complete workloads or individual files, emails, folders, mailboxes, sites, and other specific items.
Review where backups are stored, who can administer them, how access is controlled, and whether the architecture provides appropriate separation from the primary environment.
A successful backup job does not automatically prove that important information can be recovered when needed. Test restoration periodically to verify that the recovery process meets business requirements.
Cost should be evaluated alongside workload coverage and recovery requirements.
Microsoft currently lists Microsoft 365 Backup at $0.15 per GB per month of protected content using a consumption-based pricing model. Its pricing calculation can include live protected content as well as certain deleted and versioned content held for recovery.
For example, 5 TB would equal approximately $768 per month if calculating 5,120 GB at $0.15 per GB, before considering how Microsoft determines the actual amount of billable protected content.
Third-party products may use different licensing structures, including per-user models. A meaningful cost comparison should account for more than the initial price and consider workload coverage, storage, retention, recovery capabilities, administration, security, and expected data growth.
Microsoft 365 already provides substantial resiliency and recovery functionality, but that does not eliminate the need to define your organization's own recovery requirements. The right strategy depends on what data matters, how long it needs to remain recoverable, how quickly it needs to come back, and which Microsoft 365 workloads your business relies on.
If you are unsure whether your current Microsoft 365 backup, retention, and recovery strategy provides the protection your organization needs, contact the Sourcepass team. We can help evaluate your Microsoft 365 environment and identify where additional data protection or recovery capabilities may make sense.
For more conversations about Microsoft 365, cybersecurity, cloud management, and the technology decisions facing businesses today, subscribe to the Demystifying Microsoft podcast.