Microsoft 365 Backup: Retention Is Not Backup
Exchange, OneDrive, SharePoint and Teams hold most of your business data. We check whether you could restore it after a mistake, an insider or ransomware.
Can you roll a whole SharePoint site back to last Tuesday?
Recycle bins and retention policies help with single items. Large-scale recovery needs a real backup.
Microsoft 365 Backup or a third-party tool: both need checking
We review whichever you use against the same recovery checks.
What Microsoft protects, and what you must
Microsoft keeps Microsoft 365 available and offers recycle bins, version history and retention policies. Those features are designed for keeping and finding content, not for restoring large amounts of data to a point in time after ransomware, mass deletion or a compromised admin. Microsoft also sells a separate service, Microsoft 365 Backup, and many third-party products protect Microsoft 365 too.
The audit checks which workloads are protected, how far back you can restore, who can delete backups, and whether a restore has been tested.
For tenant security settings, see the Microsoft 365 Security Audit ($3,500 fixed).
Retention vs backup in Microsoft 365
| Question | Retention policies and recycle bins | A backup service or product |
|---|---|---|
| Main purpose | Keep and find content for records and legal needs | Restore data after loss or attack |
| Restore a whole site or mailbox to a point in time | Limited and slow | Designed for it |
| Protection from a compromised global admin | Admins can change policies | Depends on separation and immutability |
| Evidence for auditors | Policy settings | Backup reports and restore test records |
Capabilities vary by license and product. The audit records what your tenant and tools actually do.
What we look for and why
Workload coverage
Mailboxes, OneDrive, SharePoint and Teams each need to be in scope, including new sites and new users added after the backup was set up.
Admin separation
Backup administration should not depend only on the same global admin accounts an attacker would target.
Restore testing
A tested restore of a mailbox and a SharePoint site is the evidence auditors and insurers ask for.
A finding from the sample report
- Area
- Inventory and coverage
- Finding
- Only Exchange mailboxes are backed up; SharePoint and Teams are not
- Severity
- High
- Evidence
- The third-party backup covers 112 mailboxes. SharePoint sites (including the client files site) and Teams are not in scope. OneDrive is covered for 61 of 112 users because new users are not added automatically.
- Fix
- Add SharePoint, Teams and OneDrive to scope, enable automatic inclusion of new users and sites, and run and document one restore test per workload.
Every finding in the real report has this shape. See the full sample report
A read-only audit in five steps
Scoping call
We confirm your systems, backup products, cloud services, compliance needs and who on your side should take part.
Documents and interviews
We request your backup reports, DR plan, restore test records and BIA, and interview your IT lead and the business owners of critical systems.
Read-only review
We review backup consoles and cloud vaults through a read-only role or a screen-share. Nothing is installed or changed.
Analysis
96 checks in 8 domains, each rated Pass, Partial, Fail or Not applicable, with the evidence behind it.
Report and roadmap
Executive summary, technical report, risk register, remediation roadmap and Excel workbook, walked through on a call.
Where to go next
Microsoft 365 Security Audit
Tenant identity, email and sharing settings.
Want a quick self-check first? Backup and disaster recovery self-assessment · Ransomware recovery cost estimator
Page 7 of 16: Microsoft 365 backup
- 1. Backup & Disaster Recovery Audit (hub)
- 2. Backup strategy: 3-2-1 and 3-2-1-1-0
- 3. Immutable & air-gapped backups
- 4. RPO, RTO, uptime & availability
- 5. Backup security hardening
- 6. Cloud backup for business
- 7. Microsoft 365 backup (this page)
- 8. Server, VM & database backup
- 9. Restore testing & evidence
- 10. Disaster recovery plan & DRaaS
- 11. Backup vendor selection guide
- 12. Backup compliance requirements
- 13. Sample report
- 14. Backup & DR checklist
- 15. Pricing
- 16. How to audit backups
Guided by Ali Hassani, CISO
Certified CISO (C|CISO) and CISSP with 25+ years in IT, cybersecurity, compliance and infrastructure, and dozens of Microsoft and Cisco certifications, including MCSE, MCITP, MCSA Security, CCNP and CCNA. Every backup and disaster recovery audit is read-only, vendor-neutral and written so an owner and an administrator can both act on it.
Questions IT leaders ask
Does Microsoft back up my Microsoft 365 data?
Microsoft provides availability, recycle bins, version history and retention features, and sells Microsoft 365 Backup as a separate service. Whether your data can be restored at scale depends on what you have configured. The audit records what is in place.
Is a third-party Microsoft 365 backup better than Microsoft 365 Backup?
It depends on your needs: restore speed, retention, immutability, where copies are stored and cost. The vendor selection guide lists the questions to ask; the audit reviews whichever you run.
Do you change anything in our backup system?
No. The audit is read-only. We review settings, job history and documents through a read-only role or a screen-share with your administrator. We never change, delete or run backup jobs.
Do you sell backup products?
No. OC Security Audit does not resell any backup product and earns no referral fees. If you want help installing or reconfiguring the product you choose, IT Perfection can do that work separately.
Implementation partner
OC Security Audit stays independent and read-only, and does not resell any backup product. If you want hands-on help installing or reconfiguring the product you choose, adding immutable storage or running restore tests, IT Perfection can do that work and support ongoing operations.
Know whether you could restore Microsoft 365 at scale
Schedule a consultation. We scope the backup and disaster recovery audit in 30 minutes and quote one fixed price: $3,500, any organization size.
Read-only audit. No changes to your systems. Irvine, Orange County and Southern California on-site; remote nationwide.