Microsoft 365 backup best practices

The checklist

Use this as a review of the backup you have, or as a specification for the one you are choosing:

1. Cover every workload: Exchange Online including shared mailboxes, OneDrive, SharePoint, Teams and Entra ID, not just user mailboxes
2. Keep a copy outside the tenant: or, if you use Microsoft's own service, understand that the copy sits inside Microsoft 365's own data boundary
3. Make it immutable: backups that cannot be altered or deleted, at least for a set period, even by an administrator
4. Separate the credentials: backup console accounts distinct from Microsoft 365 admin accounts, with phishing-resistant MFA
5. Use least privilege: give restore rights only to the people who need them, and separate who can restore from who can delete
6. Set retention by policy: decide how long each type of data is kept, including leavers' mailboxes and OneDrive accounts
7. Alert on dangerous actions: deletion of backups, changes to retention and new admin accounts should notify more than one person
8. Test restores regularly: single items, whole mailboxes and whole sites, and record how long they took
9. Document the recovery plan: who decides, who restores, in what order, and how you will contact people if Microsoft 365 is unavailable
10. Check where data is stored: storage region, encryption and the supplier's sub-processors, for UK GDPR and your customers' requirements

The sections below explain each group of steps and how the platforms we supply handle them.

Cover every workload, not just mailboxes

A common gap is a backup that protects user mailboxes and OneDrive, and nothing else. Check that yours includes:

• Shared mailboxes: often the most important mail in the organisation; Microsoft 365 Backup covers user and shared mailboxes, but not group or room mailboxes
• Group mailboxes and archive mailboxes: coverage varies by platform
• SharePoint sites: including the sites behind Teams, which hold channel files
• Teams: channel messages and team structure are covered differently by each vendor, and private chats are excluded by some
• Entra ID: users, groups and Conditional Access policies; native recovery covers a short history only
• New starters: choose auto-protection of new users, groups and sites so nobody is missed

Our Microsoft 365 data backup guide covers each workload, and Entra ID backup covers identity in detail.

Keep the copy separate and lock it down

The NCSC's Principles for ransomware-resistant cloud backups, published in November 2024, describe what a backup service should do so that backups survive destructive ransomware, and are a useful yardstick when you choose one. They set out five principles:

1. Backups should be resilient to destructive actions
2. A backup system should be configured so that it isn't possible to deny all customer access
3. The service allows a customer to restore from a backup version, even if later versions become corrupted
4. Robust key management for data-at-rest protection is in use
5. Alerts are triggered if significant changes are made, or privileged actions are attempted

In practice that means a copy an attacker who has compromised your tenant cannot delete or alter, protected by accounts that are not your everyday Microsoft 365 admin accounts, and enough history to go back to before the problem started. Microsoft's own service uses append-only storage, but backups can still be deleted by the Backup administrator through offboarding, with a 90-day grace period; third-party platforms add their own protections, such as Axcient's AirGap and Acronis's optional immutable storage. Immutable Microsoft 365 backup compares the approaches, and Microsoft 365 ransomware recovery covers what to do when an attack happens.

Protect the backup console itself with multifactor authentication, ideally phishing-resistant, and keep the number of people with delete or retention rights small.

Set retention by policy, including leavers

Retention in your backup should be a decision, not a default. Agree with the people who own the data how far back you need to be able to restore, and remember that some problems, such as slow data corruption or a dormant attacker, are found weeks or months later.

Leavers need their own rule. When a user's licence is removed, Microsoft deletes their mailbox after a 30-day grace period. Their OneDrive is not deleted until the account itself is deleted, then follows the OneDrive retention period (30 days by default) and 93 days in the recycle bin; Microsoft also archives unlicensed OneDrive accounts on their 93rd unlicensed day. Decide how long you keep a leaver's backed-up data, and check how your platform counts departed users for licensing. The way your backup retention fits with Microsoft Purview retention is explained in Microsoft 365 backup vs retention.

Test restores and write the plan down

A backup nobody has restored from is an assumption. Build restore tests into normal operations:

• Restore individual emails and files regularly, ideally as part of real requests
• Restore a whole mailbox and a whole SharePoint site to an alternate location at least once a year, and after major changes
• Record how long each restore took, so your recovery plan uses real numbers rather than hopes
• Check permissions and metadata on restored sites, not just the files

Then write the recovery plan down: who can declare an incident, who restores what and in which order, where the plan is kept if Microsoft 365 is unavailable, and how you will tell staff. Our Microsoft 365 backup and restore guide walks through the common scenarios.

Check where your data is stored

Backups of Microsoft 365 contain personal data, so UK GDPR applies to them as it does to the live data. Check where each platform stores your backups, how they are encrypted, who the supplier's sub-processors are, and how you would handle an erasure request that touches backups. Storage options differ: Commvault's documentation lists a UK region for Microsoft 365 workloads, Redstor offers a choice of region, and Microsoft 365 Backup keeps data in your tenant's existing geography. For the others, we confirm the storage location at quote.

Microsoft 365 backup compliance covers the UK compliance questions in more detail. It is not legal advice; check the specifics with your data protection officer.

How we help

We can review your current Microsoft 365 backup against this checklist with you, or design a new one from it. That means looking at workload coverage, retention, how the backup console is secured, who can restore and delete, and whether a restore test has been done. Where a different platform would close a gap, we explain why, from the five we supply: Microsoft 365 backup providers introduces them.

We can set things up with you, agree the alerting and access model, and run a test restore together so you know it works. Ongoing management is agreed at quote, and Forever Group's cyber security services can help with the wider picture.

Contact us to check your Microsoft 365 backup against these best practices.