Microsoft 365 Backup: Coverage and Recovery Guide

1. Distinguish the recovery options you already have

Version history provides access to earlier versions of a file, while the recycle bin can recover deleted content under certain conditions. In SharePoint Online, the recycle bin retention period is a total of 93 days from deletion at the original location. A separate 93-day period does not start for each recycle bin stage. Quotas and permanent deletion conditions can also affect recovery.

Retention policies and legal holds help preserve and discover content. However, recovering an entire department's workspace to a healthy point in time needs its own assessment. Microsoft also explains that content preserved through legal holds is not designed for bulk operational recovery. Create a list of scenarios showing what your existing tools can handle.

2. Inventory protected data by workload

Counting users is not enough. Include shared mailboxes, online archives, former employees' data, project sites and newly created teams in your assessment. Microsoft 365 Backup's documented core coverage includes Exchange mailboxes, OneDrive accounts and SharePoint sites. A product that protects Teams files does not necessarily restore chats and every application setting in the same way.

• Coverage for critical mailboxes, shared mailboxes and archives
• The process for OneDrive accounts and employees leaving the organisation
• Recovery behaviour for SharePoint sites, permissions and relevant file versions
• Explicit coverage statements for Teams chats, channel structure, Planner and other workloads
• A named owner for adding new users and sites to the policy

3. Set recovery targets around data loss scenarios

Recovering last week's version of a contract, reopening a deleted mailbox and restoring hundreds of accounts after one incident require different tests. Document acceptable data loss as the recovery point objective (RPO), and time to resume work as the recovery time objective (RTO). Compare these targets with the product's recovery point frequency, available history and unit of recovery.

Find out whether restoring to the original location can affect healthy changes made since the incident. Recovery to an alternative location may make it easier to reconcile recovered data with users' newer work, but can require additional effort and permission checks. The proposal should state who performs that work.

4. Verify subscriptions, retention and costs separately

When offered through the Microsoft admin centre, Microsoft 365 Backup uses consumption-based billing for protected data and requires billing to be configured through an Azure subscription. Do not assume that your existing Microsoft 365 user licence automatically includes every additional backup feature. Partner products may use different licensing and billing models.

Do not base the budget only on the current visible file size. Depending on the product, archives, deleted content, retained versions and the history of accounts removed from protection can affect the cost. Alongside the retention period, request written terms for data access and export when the contract ends.

• How are protected users or protected data volumes calculated?
• What do the retention, recovery and managed service charges include?
• Do workloads outside the standard scope require additional licences?
• How long are backups retained after a user is removed from the policy or deleted?

5. Separate backup administration from everyday access

Access to the backup console, authority to restore data and permission to change retention policies serve different purposes. Use MFA, assign the least privileged role needed for each task and monitor administrative changes. Include business owner approval and an activity record in the process for critical restores.

Ask each provider where data is stored, within which provider boundary the additional copy resides and how deletion protection works. Do not treat every cloud backup as an offline copy or as a copy independent of Microsoft's environment. Compare the architecture with your business continuity requirements.

6. Rehearse recovery before buying

Illustrative acceptance exercise: ask a finance team to open the correct version of an altered Excel file, recover an accidentally deleted customer email with its attachments, and review a project site restored to a separate location. These are example scenarios. In a real test, record the data owner, target time, outcome and gaps for each one.

The outcome report needs more than a product screenshot: what was recovered, what could not be recovered, how long it took and who will resolve the gaps. These results provide a practical basis for planning backup coverage alongside Microsoft 365 administration.

• Create a test file and sample email item without personal data.
• Restore from a recovery point before the simulated deletion or change.
• Check content, file access and usability in the application with the business owner.
• Record start, finish, waiting and user validation times.
• Rehearse responsibilities and support escalation for a bulk restore in a tabletop exercise.