Shared responsibility, in one table
| Microsoft is responsible for | You are responsible for |
|---|---|
| Data centres, hardware, network | Content in mailboxes, OneDrive, SharePoint and Teams |
| Availability and replication of the service | Accounts, permissions, sharing |
| Security of the platform | Configuration: Conditional Access, mail flow rules, policies |
| Restoring the service after incidents | Restoring data after mistakes, attacks and misuse |
Microsoft's own product makes the point: since 2024 it sells Microsoft 365 Backup, billed by usage, explicitly for ransomware and accidental or malicious deletion. If the built-in features were enough, it would not exist.
What the built-in recovery covers
| Object | Built-in recovery | Window |
|---|---|---|
| Deleted mail in Exchange Online | Recoverable Items folder | 14 days by default, 30 days maximum |
| Mailbox of a deleted user | Restore the user | 30 days |
| Files in SharePoint and OneDrive | First- and second-stage recycle bin | 93 days from deletion |
| A whole OneDrive or library | Restore to an earlier point in time | Up to 30 days back |
Every one of these can be undone by an administrator, or by an attacker with an administrator's account: recycle bins can be emptied before the window ends. Retention policies and litigation hold keep content from final deletion, but they are built for compliance and eDiscovery, not for putting a whole site back to last Tuesday. And they do not cover configuration at all.
Check what your tenant actually has, rather than assuming the defaults:
Connect-ExchangeOnline
Get-EXOMailbox -ResultSize Unlimited -Properties RetainDeletedItemsFor, LitigationHoldEnabled |
Group-Object RetainDeletedItemsFor, LitigationHoldEnabled | Select-Object Count, Name
Connect-SPOService -Url "https://example-admin.sharepoint.com"
Get-SPOTenant | Select-Object OrphanedPersonalSitesRetentionPeriodWhat a backup has to add
- Separation: a copy that a compromised Microsoft 365 administrator cannot delete with the same account.
- Time: restore points beyond the 14 to 93 day windows, for as long as your retention rules require.
- Granularity: one mail, one mailbox, one OneDrive, one site, back to a chosen point in time.
- Configuration: Conditional Access, mail flow rules, Intune policies and Teams settings, exported and versioned.
- Proof: monitored runs and restore tests that are written down.
The options fall into three groups: a cloud backup service from a third party, Microsoft 365 Backup inside the Microsoft trust boundary (restore points as frequent as every 10 minutes depending on service and age, retention selectable per policy between 3 months and 2 years, billed per GB), or a self-hosted product. Know the limits before you choose: Teams chats cannot be restored faithfully into Teams by most products, and are typically provided as a searchable copy or export. Private and shared channels have their own SharePoint sites and must be in scope.
Watch the EWS deadline. Exchange Web Services in Exchange Online is blocked by default from 1 October 2026 and switched off on 1 April 2027. Older backup versions that still use EWS will stop working. Check with your vendor which version uses Microsoft Graph.
Configuration backup you can do today
Configuration is the part most backups forget, and the part that hurts most after a mistaken bulk change. A versioned JSON export is a start:
$dir = New-Item -ItemType Directory -Force -Path ".\m365-config-$(Get-Date -Format yyyyMMdd)"
Connect-MgGraph -Scopes "Policy.Read.All"
Get-MgIdentityConditionalAccessPolicy -All | ConvertTo-Json -Depth 20 | Out-File "$dir\conditional-access.json" -Encoding utf8
Connect-ExchangeOnline
Get-TransportRule | ConvertTo-Json -Depth 10 | Out-File "$dir\transport-rules.json" -Encoding utf8
@(Get-InboundConnector) + @(Get-OutboundConnector) | ConvertTo-Json -Depth 10 | Out-File "$dir\connectors.json" -Encoding utf8
Get-AntiPhishPolicy | ConvertTo-Json -Depth 10 | Out-File "$dir\anti-phish.json" -Encoding utf8For Intune, an app-only backup that reads settings catalog, compliance, configuration and update profiles is worth having. In the M365 Control Plane I built one whose restore only ever creates new policies with a [Restored] prefix and no assignments, so a restore can never overwrite or delete what is there.
A restore test you can repeat
A backup that has never been restored is an assumption. Plan restore tests like any other operational task, at least quarterly, and write down the result.
| Test | How | Pass when |
|---|---|---|
| Single item | Delete a test mail older than 30 days from a test mailbox, restore it | Mail back in the original folder, readable |
| Mailbox | Restore a test mailbox to a point in time, to an alternate mailbox | Folder structure and item count match |
| OneDrive | Restore a test OneDrive to before a simulated mass change | Files at the earlier version |
| Site | Restore a test site or library to an alternate location | Content and permissions as expected |
| Configuration | Re-create one exported policy in a test tenant | Settings match the export |
Log date, scope, result, duration and anything that did not match. Duration matters: "the restore works" and "the restore of 2 TB takes four days" lead to different decisions.
Switching backup products
A new backup starts empty. The old backups stay in the old product. Plan the change in this order: inventory what is backed up today; set up the new backup and let the first full run finish before anything changes; run both in parallel and test restores in the new one; decide what happens with the old backups (keep them readable until their retention ends, or export what must be kept); only then stop the old backup and remove its app registration and permissions.
Checklist
- Actual retention settings read, not assumed
- Backup covers Exchange, OneDrive, SharePoint including private and shared channel sites, and Teams as far as possible
- Backup copy cannot be deleted with a Microsoft 365 admin account alone
- Configuration exported and versioned: Conditional Access, mail flow, connectors, Intune
- Backup product uses Microsoft Graph, not EWS
- Runs monitored; new accounts included automatically
- Quarterly restore tests with result and duration logged
- Product change planned with a parallel run and a decision on old backups