Microsoft 365 backup: questions to ask before you buy

Microsoft 365 is built for service resilience, and it includes native recovery, versioning, recycle-bin, and retention capabilities. Those features are valuable. They still do not answer every organization’s recovery question by themselves.

The right question is not “Does Microsoft back up Microsoft 365?” It is: Which business events must we recover from, how far back, at what granularity, under whose control, and how quickly? Accidental deletion, a malicious administrator, ransomware-encrypted synced files, a departed employee, and a legal retention requirement are different problems.

Microsoft now offers Microsoft 365 Backup alongside integrated partner products. As of August 2026, Microsoft’s service protects Exchange Online mailboxes, SharePoint sites, and OneDrive accounts with configurable recovery windows and defined restore behaviors. The current Microsoft 365 Backup overview is the source to check because coverage, restore granularity, and pricing can change.

Use these questions whether the proposal comes from Microsoft, an MSP, or an independent backup vendor.

1. Which workloads and objects are actually protected?

Get a written coverage matrix. “Microsoft 365 backup” is not a workload list.

• Exchange user, shared, resource, and archive mailboxes
• OneDrive accounts, including former employees
• SharePoint team, communication, and private-channel sites
• Teams channel files, chat files, messages, recordings, and other artifacts
• Microsoft 365 Groups, Planner, Forms, Loop, Power Platform, and Entra objects if the business relies on them

Teams is especially easy to oversimplify. Microsoft documents that Teams files use SharePoint and chat files use OneDrive, while other data may live in Exchange or service-specific storage. Microsoft’s service-assurance documentation illustrates why a Teams logo on a sales sheet does not prove every Teams object has the same recovery path.

Ask the vendor to mark each object as protected, natively recoverable, excluded, or requiring another product.

2. How does protection scope stay current?

A product may protect all current users, a selected group, or only objects chosen on day one. Ask:

• Are new users, sites, shared mailboxes, and Teams added automatically?
• How quickly does a new object receive its first usable restore point?
• What happens when a license is removed or a user is deleted?
• Can exclusions drift as groups or organizational units change?
• Who reviews failed or unprotected objects, and how are alerts escalated?

A job-success email without scope reconciliation can stay green while new data sits outside the policy.

3. What retention and recovery-point schedule do we get?

Do not substitute a familiar number like “seven years” for a recovery design. Confirm:

• The oldest available recovery point
• How frequently recovery points are created
• Whether older points become less granular
• Whether retention is fixed, configurable, or tied to licensing
• What happens to backup data after cancellation or tenant migration
• Whether the service supports a legal or contractual deletion requirement

Retention policy and backup solve related but different problems. Retention can preserve or dispose of content for governance; backup provides a recovery copy and restore workflow. If the organization uses Purview, align the backup decision with the existing retention design instead of letting two policies contradict each other.

4. What does a restore change?

Ask the vendor to demonstrate each recovery path you care about:

• One message, contact, calendar item, or mailbox folder
• One file, folder, library, site, or entire OneDrive account
• Restore to the original location versus a new location
• Conflict handling when an object with the same name already exists
• Preservation of versions, timestamps, permissions, sharing links, labels, and metadata
• Search and export when the original user or site no longer exists

Some point-in-time restores roll a site or account back and can replace newer content; others restore selected objects into the current state. Microsoft documents these differences in its product overview.

5. How fast can it recover at our scale?

Separate a convenient single-item restore from incident-scale recovery. Ask for expected and contractual performance, where offered, for:

• One executive mailbox
• One heavily used SharePoint site
• A department’s OneDrive accounts
• Hundreds of mailboxes or sites after a tenant-wide event

Recovery time can depend on object count, restore-point type, destination, service throttling, and queueing. Run a timed restore test with your own tenant and record authentication, approval, and validation time as well as vendor processing time.

6. Can an attacker or mistaken admin damage the backups?

Map the control plane, not just the storage claim:

• Which roles can change protection policies, start restores, delete recovery data, or offboard the product?
• Is MFA enforced, and can access use separate privileged accounts?
• Are administrative actions logged and exported to monitoring the attacker cannot alter?
• Does the backup depend on the same tenant identities that may be compromised?
• Is backup data append-only, immutable for a defined period, or deletable by a backup administrator?
• What support verification is required for destructive account changes?

Microsoft says its Microsoft 365 Backup copies use append-only storage, while also documenting specific administrative offboarding behavior. Other vendors use different architectures. Ask for the exact threat model rather than accepting “immutable” as a complete sentence. Our air-gap versus immutable backup guide provides a useful comparison.

7. Where does the data live, and what can compliance tools see?

Confirm data residency, encryption, subprocessors, access logging, contractual deletion, and how the service handles legal hold or discovery. Microsoft’s privacy and compliance documentation notes that content existing only in Microsoft 365 Backup is not necessarily discoverable through the tenant’s normal eDiscovery workflow and that some deletion actions must be considered again after a restore.

That does not make the product unsuitable. It means legal, privacy, and IT need to agree on the workflow before the first request arrives.

8. Who owns recovery when the pressure is real?

Write down who monitors protection, who opens a restore request, who approves sensitive data recovery, who performs it after hours, and who validates the result. If an MSP runs the service, confirm what is included, response targets, emergency contact paths, and what happens when the MSP relationship ends.

Require a restore test before purchase acceptance and on a recurring, risk-based schedule afterward. Alternate Exchange, OneDrive, and SharePoint so the team does not keep proving one happy path.

Bottom line

Buy Microsoft 365 backup against documented recovery scenarios, not a fear-based slogan. Demand a precise scope matrix, understand retention and restore side effects, separate backup administration from daily accounts, test recovery at your scale, and align the result with compliance obligations. The best product is the one your team can operate and prove when a real mailbox, site, or tenant needs to come back.