Microsoft 365 backup should give your business a way to recover important information after accidental deletion, unwanted changes or a cyber incident. The practical questions are which information is protected, how far back recovery goes and how quickly staff could use the recovered data.
Microsoft provides several recovery features and a dedicated Microsoft 365 Backup service. Other providers also offer backup products for Microsoft 365. Before choosing or reviewing an arrangement, ask for a clear explanation of its coverage, security, costs and tested recovery process.
What Microsoft 365 backup means for Australian businesses
A business may use “Microsoft 365 backup” to describe different arrangements. It could mean Microsoft’s dedicated backup service, a partner product or an IT provider’s managed service.
Microsoft’s dedicated service supports protection of selected SharePoint sites, OneDrive accounts and Exchange Online mailboxes. It requires setup and protection policies, with consumption-based billing.
Start by separating the functions of the tools already available.
| Feature or arrangement | What it helps with | What to check |
|---|---|---|
| Service resilience and replication | Maintaining service availability when infrastructure fails. | Whether historical recovery is available for the incident you need to address. |
| Recycle bins and version history | Recovering deleted content or earlier file versions. | Recovery windows, version limits and administrative settings. |
| Retention policies and legal holds | Preserving information for records management or compliance purposes. | How retained information can be retrieved and whether large-scale restoration is practical. |
| A dedicated backup service | Recovering protected information from earlier points in time. | Included data, retention, recovery options, access controls and testing. |
Existing recovery tools can be useful. For example, Microsoft’s Restore your OneDrive feature allows eligible Microsoft 365 subscribers to undo file and folder actions within the previous 30 days. That particular window should not be treated as a recovery promise for every Microsoft 365 service.
Ask your provider to explain which tools would be used for a deleted document, a damaged shared site and a widespread malicious change.
Key security, cost and operational risks
Gaps in what is protected
A general statement such as “Microsoft 365 is backed up” leaves important questions unanswered.
Confirm the actual mailboxes, accounts and sites included. Check shared mailboxes, former employees’ information and newly created accounts or sites.
Teams also needs careful explanation. Files uploaded to channels are stored in SharePoint, while files uploaded to chats are stored in OneDrive for Business. Ask separately about protection for those files, chat messages, meeting content and other Teams information.
Backup administration and deletion rights
Backups need protection against unauthorised access, alteration and deletion.
Ask who can change policies, remove protected accounts or delete backup data. Review multi-factor authentication, administrator permissions, audit records and alerts for significant changes.
If a product is described as “immutable”, ask what that means in practice. Establish whether deletion is possible, who can authorise it and whether a recovery grace period applies.
Microsoft’s native service keeps backup data within the Microsoft 365 data boundary. When comparing products, understand the storage architecture and the access or service dependencies involved.
Costs that grow beyond the initial quote
Microsoft’s dedicated backup service charges according to protected data consumption. Its calculation can include retained deleted content and mailbox archives, so the amount billed may differ from the live files staff currently see.
Request a quote that explains:
- Whether charges are based on users, data volume or another measure.
- Which deleted content, archives and retained versions affect billing.
- Expected costs as the business grows.
- Whether monitoring, support and recovery assistance are included.
- Any separate charges for testing, exporting data or changing providers.
- The billing currency and treatment of GST.
A useful comparison considers the full service cost and recovery capability.
Recovery that takes longer than the business can tolerate
Two terms help turn a technical discussion into a business decision:
- Recovery point objective, or RPO: how much recent work the business can afford to lose, expressed as a period of time.
- Recovery time objective, or RTO: how long the business can tolerate waiting for recovery.
A recent recovery point is valuable, but staff also need access to usable information. A successful test should check that recovered documents open, relevant records are present and access permissions work as intended.
Data location and privacy obligations
Ask where backup content is stored, who can access it and which other organisations help deliver the service.
For businesses covered by the Privacy Act, cloud arrangements need to be considered alongside the applicable Australian Privacy Principles. Review storage location, security controls, overseas access and contractual requirements together.
A practical implementation or review checklist
Use the following checks to establish what your business can recover and who is responsible.
1. List the information the business depends on
Identify the mailboxes, shared documents, customer records and working files needed to keep operating.
Give particular attention to information that would interrupt invoicing, customer service or scheduled work if it became unavailable.
2. Obtain a written coverage list
Ask for a report showing the accounts, mailboxes and sites protected by the backup policies.
Confirm how new starters, new sites and shared mailboxes are added. Record any excluded data and the arrangements for protecting it.
3. Match recovery settings to business needs
Document your acceptable data loss and downtime for critical activities.
Check the available retention period and recovery points for each service. Ask whether older backups have less frequent recovery points than recent backups, and whether that affects your requirements.
Discuss long-term records retention separately where necessary.
4. Review access and emergency arrangements
Identify who can administer backups and approve restores.
Confirm how authorised staff would contact support if normal email or administrator access became unavailable. Keep recovery instructions and contact details somewhere accessible during an incident.
5. Assign responsibility for monitoring
Ask who checks backup health, investigates failures and follows up on missing coverage.
A report needs an owner. Agree how unresolved issues are escalated and what information the business receives during routine reviews.
6. Test representative restores
Arrange a controlled test with your IT provider. Include an individual item and a larger recovery scenario relevant to the business.
Where supported, use a safe recovery destination. Record the recovery point, elapsed time, missing information, access issues and any steps staff needed to complete before work could resume.
Australian cyber security guidance recommends testing restoration as part of disaster recovery exercises.
7. Review account departures and provider changes
Before deleting accounts, changing licences or replacing an IT provider, confirm what happens to protected information.
Document how long it remains recoverable, who retains access, what ongoing charges apply and how data can be recovered during the transition.
When to involve your IT service provider
Involve your IT service provider when backup coverage is unclear, a restore has not been demonstrated or the existing arrangement no longer matches how the business works.
A review is also useful after significant changes, such as moving shared files into Teams, creating new SharePoint sites, introducing another business application or changing administrator access.
Ask the provider to produce four practical outcomes:
- A written list of protected information and exclusions.
- Agreed recovery targets for critical business activities.
- Evidence from a recent restore test.
- Clear monitoring, support and escalation responsibilities.
Have them compare Microsoft’s dedicated service and other suitable options against those requirements. Ask for an explanation of any differences in coverage, storage architecture, restoration options and ongoing costs.
If a cyber incident has already occurred, contact the provider promptly. Recovery should be coordinated with containment and investigation so restored information can be used safely.
Conclusion
A useful Microsoft 365 backup arrangement gives business owners clear answers about protected information, recovery history, security and support. Those answers should be supported by policy records and a demonstrated restore.
Start with the information your business needs to operate. Agree how much work you can afford to lose and how long recovery can take, then review the service against those requirements. Keep the arrangement under review as staff, systems and data change.
FAQs
Is Microsoft 365 Backup included automatically with my subscription?
Microsoft’s dedicated Microsoft 365 Backup service uses pay-as-you-go billing and requires setup and protection policies. Your IT provider may include backup in a managed service package, so ask which product is being supplied and what is actually protected.
Does a successful backup report mean recovery will work?
A successful report is useful evidence, but a restore test provides stronger confirmation of practical recovery. Testing can reveal missing coverage, permission problems or delays that a routine status report does not show.
Does Microsoft 365 backup also protect my computers and other applications?
Check these separately. Protection for selected Microsoft 365 services does not establish coverage for files stored only on a laptop, installed applications or data held in another business system. Include those items in the broader recovery plan.
Sources
- Microsoft Learn: Overview of Microsoft 365 Backup — Explains supported services, backup architecture, recovery features and performance considerations.
- Microsoft Learn: Frequently asked questions about Microsoft 365 Backup — Covers recovery tools, supported mailbox types, recovery points and deleted-user scenarios.
- Microsoft Learn: Pricing model for Microsoft 365 Backup — Explains consumption-based billing and the content included in protected storage calculations.
- Microsoft Learn: Set up Microsoft 365 Backup — Describes service setup, billing and backup protection policies.
- Microsoft Support: Restore your OneDrive — Explains the OneDrive recovery feature and its 30-day window.
- Microsoft Support: File storage in Microsoft Teams — Explains where channel files and chat uploads are stored.
- Cyber.gov.au: Essential Eight maturity model — Includes guidance on backup protection, retention and restoration testing.
- OAIC: Sending personal information overseas — Explains privacy considerations for overseas handling and cloud storage.
