How to Back Up Microsoft 365 Data: What MSPs Need to Know

The Microsoft 365 Backup Misconception

Many businesses assume that because their data is in Microsoft's cloud, it is automatically backed up. This is one of the most consequential misunderstandings in modern IT.

Microsoft does protect against infrastructure failures on their side. If a data centre has a problem, Microsoft has redundancy in place to keep services running. What Microsoft does not protect against is data loss caused by the customer — and that is where the real risk lies.

Accidental deletion, malicious deletion (by a compromised account or a disgruntled employee), ransomware that encrypts cloud-synced files, misconfigured retention policies, and application errors that overwrite data — none of these are covered by Microsoft's built-in protection in a way that provides reliable, point-in-time recovery.

What Microsoft Actually Provides

Recycle Bin and Version History

Microsoft 365 includes a recycle bin for deleted items and version history for files in SharePoint and OneDrive. These are useful for recovering recently deleted or accidentally overwritten files, but they have limitations:

• Recycle bin retention is typically 93 days, after which items are permanently deleted
• Version history depth depends on configuration and storage limits
• Items can be permanently deleted from the recycle bin by users with sufficient permissions
• These tools require manual intervention — there is no automated, scheduled recovery process

Microsoft 365 Backup (Microsoft's Own Product)

Microsoft launched a native backup product in 2023, which provides point-in-time restore for Exchange, SharePoint, and OneDrive. This is a genuine improvement over the recycle bin approach, but it comes with costs, limitations on retention periods, and does not cover all Microsoft 365 workloads. It is worth evaluating, but it does not replace the need for a third-party backup solution in all scenarios.

Litigation Hold and eDiscovery

Microsoft 365 includes litigation hold capabilities through compliance features. These are designed for legal and compliance purposes — preserving data so it cannot be modified or deleted. They are not backup tools and do not provide the restore workflow that backup delivers.

What a Proper Microsoft 365 Backup Covers

A third-party Microsoft 365 backup solution should cover:

Exchange Online: Individual emails, calendar items, contacts, and tasks. Point-in-time restore to a specific date, with the ability to restore individual items or entire mailboxes.

SharePoint Online: Site collections, document libraries, lists, and pages. Restore at the item level or site level.

OneDrive for Business: All files in each user's OneDrive. Item-level restore without affecting other files.

Microsoft Teams: Teams data — channel messages, files, and settings — backed up via the underlying SharePoint and Exchange data.

How to Set Up Microsoft 365 Backup

Step 1: Choose a Backup Solution

Select a backup solution that connects to Microsoft 365 via the Microsoft Graph API and supports all the workloads you need to protect. Verify that the solution stores backup data in a location outside of Microsoft's infrastructure — ideally in your own or your provider's storage, not Microsoft's own cloud.

Step 2: Connect to Microsoft 365

Most solutions require you to register an application in Azure Active Directory (now Microsoft Entra ID) and grant the backup application the necessary permissions to read data from Exchange, SharePoint, and OneDrive. This is typically a Global Administrator task.

Step 3: Configure What to Back Up

Decide which users, mailboxes, sites, and OneDrive accounts to include. For most organisations, the answer is all of them — but there may be specific shared mailboxes, archive mailboxes, or SharePoint sites that need particular attention.

Step 4: Set Retention Policies

Configure how long backup data is retained. Typical retention for Microsoft 365 backup ranges from 30 days to several years depending on compliance requirements. Consider your data retention policy when setting this.

Step 5: Schedule Backups

Most Microsoft 365 backup solutions run multiple times per day. Configure the backup frequency to match your RPO requirements. For most business environments, backups every few hours is appropriate.

Step 6: Test Restore

Before you need it, test the restore process. Restore a sample of emails, a SharePoint document, and a OneDrive file. Verify that the restore workflow is understood and that it produces the expected results.

For MSPs: Microsoft 365 Backup as a Service

Microsoft 365 backup is one of the clearest upsell opportunities for MSPs. Every client using Microsoft 365 needs it, and most are not aware of the gap in Microsoft's built-in protection.

BOBcloud's platform includes Microsoft 365 backup with support for Exchange, SharePoint, OneDrive, and Teams, with unlimited storage and a white-label interface for MSPs. Find out more about offering Microsoft 365 backup to your clients.