How to back up Microsoft 365 properly

What needs to be included

Exchange Online mailboxes, including calendars, contacts and shared mailboxes such as accounts or reception. OneDrive for each user, because that is where many people quietly keep important work. SharePoint sites, which hold most shared documents in a modern setup. And Teams, which is really a mix: chats live in Exchange, files live in SharePoint, and channel conversations are stored separately.

Check that your backup product covers each of these explicitly, and that it picks up new users and new sites automatically. A backup set up three years ago that only protects the original twelve mailboxes is a common finding when a new IT provider takes over. Shared mailboxes and resource calendars are the items most often missed, because they do not have a person attached who would notice their absence. Ask for a coverage report that lists every protected object and compare it with your user list.

How Microsoft 365 backup tools work

Third-party backup services connect to your tenant through an app registration that you approve as a global administrator. They then pull data through Microsoft's interfaces on a schedule, usually several times a day for mail and at least once a day for files, and store it in their own cloud. Nothing is installed on staff computers.

Microsoft also now offers its own backup product within the 365 admin centre. It can be a reasonable option, but it lives in the same ecosystem as the data it protects. Whichever you choose, check current pricing and what it costs to store data long term, as these products are usually billed per user or per gigabyte. Also ask how quickly the vendor can restore a large volume of data, since a tool that copies data out of 365 efficiently can still be slow to put it back.

Retention: how far back you can go

Decide how long you want backup copies kept. Many small businesses choose a year of daily restore points and longer for mailboxes of people who have left. If you have legal reasons to keep records, align the backup retention with them, but remember the backup is for recovery, while your record-keeping obligations may be better met with proper retention policies inside 365.

Be careful with unlimited retention offers. They are convenient but can make it harder to delete personal information you no longer need, which matters under the Privacy Act 2020. The Act expects organisations not to keep personal information longer than they need it. A defined retention period, reviewed yearly, is easier to explain to a client or regulator than an open-ended store of everything ever written.

Settings to check in 365 itself

Backup works best alongside sensible tenant settings. Turn on multi-factor authentication for everyone, especially administrators, because an attacker with global admin rights can disable backup connections. Review the deleted items and recycle bin periods, set retention policies for important mailboxes, and make sure audit logging is switched on so you can see who deleted what.

Also look at how licences are removed when staff leave. Removing a licence too early starts a countdown on that person's OneDrive and mailbox. A good backup product keeps their data even after the account is deleted, but it is better not to rely on that by accident. Agree an order of steps for every leaver: convert or hand over the mailbox, move important OneDrive files, confirm the backup holds a final copy, then remove the licence.

Testing restores you will actually need

Run three test restores after setup and then every quarter: a single email from several months ago, a SharePoint folder restored to a different location, and a full OneDrive for a test user. Time each one. The point is to know the steps and the duration before a real problem forces you to learn them under pressure. Record the results in a simple log with the date, what was restored, how long it took and who did it, because insurers and auditors increasingly ask for that evidence.

Keep a short note of how to log in to the backup console, who holds access, and how to raise a support request with the backup vendor. Store it somewhere you could reach even if your 365 account was locked. A printed copy in the office safe and a copy with your IT provider are both sensible. The worst time to search for a password is the morning your email will not open.