Microsoft 365 Backup Review: What to Check

A Microsoft 365 backup review is not about adding another licence because it sounds prudent. It is about answering a harder business question: if a director deletes a mailbox, a member of staff overwrites a critical file, or ransomware reaches a synced folder, can you recover the right data quickly and prove what happened?

For many small and mid-sized organisations, Microsoft 365 holds the operational record of the business. Email approvals, customer documents, Teams conversations, SharePoint sites and OneDrive files are all there. When access to that information is disrupted, the impact can reach far beyond an inconvenient IT ticket.

Why Microsoft 365’s built-in protection may not be enough

Microsoft 365 includes valuable safeguards. Deleted items can be recovered for a period, SharePoint and OneDrive provide recycle bins, and version history can help reverse unwanted changes. Retention policies and legal holds can also support specific compliance requirements when they have been designed and managed correctly.

These controls are useful, but they are not automatically a complete backup strategy. They are primarily designed to support the Microsoft 365 service and its retention features, rather than provide an independent, business-controlled copy of every item you may need to restore.

The difference matters when a problem is discovered late, when retention settings were never applied to a new user or site, or when data has been changed repeatedly before anyone notices. A recycle bin may help with a recently deleted document. It may not be the quickest or most practical answer when you need to restore a whole mailbox, a folder structure or a departed employee’s data.

A good review considers what your business can recover, how far back it can recover it, who has authority to request a restore, and how long that restore will take. Those four answers are more useful than a simple tick against the word ‘backup’.

What a Microsoft 365 backup review should cover

The right scope depends on how your people work and the information you hold. A professional services firm with sensitive client correspondence has different priorities from a distributor using Teams and SharePoint to manage stock information. However, most reviews should examine the same core areas.

Exchange Online mailboxes

Email remains evidence, customer communication and an approval trail for many businesses. Check that current staff, shared mailboxes and former employees’ mailboxes are covered where required. Also establish whether recovery can be performed at message, folder and full-mailbox level.

Be specific about departed users. If a licence is removed, the mailbox may follow a retention process that is not aligned with your commercial or legal needs. A backup policy should state who reviews leavers, how long their data is retained and whether it can be restored to a manager, replacement user or separate location.

OneDrive, SharePoint and Teams data

Files are rarely stored in one place. OneDrive often contains individual working documents, while SharePoint holds team content and Teams channels create files in associated SharePoint locations. Teams messages, channel conversations, tabs and meeting content may also have different protection requirements.

A review should map where important information actually lives, rather than assuming staff use systems in the intended way. Ask department heads about finance records, HR documents, project folders and customer-facing material. This frequently reveals unmanaged personal OneDrive folders, duplicate sites or old Teams spaces that still contain business-critical information.

Restore options and recovery speed

Having a backup is only half the job. The recovery process must suit the incident. Restoring a single accidental deletion should be quick and targeted. Recovering a large SharePoint library after widespread corruption may take longer and require careful planning to avoid overwriting valid changes.

Confirm whether your backup solution allows granular restores, point-in-time recovery and restoration to an alternative location. Alternative-location restores are particularly valuable during an investigation, because they allow staff to check recovered data before replacing live content.

Set realistic recovery objectives. A business may accept that archive data takes a day to retrieve, but an active director’s mailbox or a live project site may need action within hours. This is where backup decisions become an operational conversation, not just a technical one.

Security, access and data location

Backup copies are valuable targets. Review who can access the backup platform, whether multi-factor authentication is enforced and whether administrative accounts are separate from everyday user accounts. Privileged access should be limited to the people who genuinely need it and reviewed regularly.

For UK organisations, data residency, encryption and supplier assurances may also matter. This is especially relevant for firms handling personal information, financial records, health information or contractually sensitive client data. Your review should document where backup data is held, how it is encrypted and what happens when a contract ends.

The questions that expose gaps quickly

Rather than asking whether you have Microsoft 365 backup, ask your provider or internal IT team to demonstrate it. Practical questions tend to reveal the difference between a policy on paper and a recoverable service.

Can they restore an individual email from six months ago? Can they recover a deleted employee’s OneDrive folder without reactivating the account? Can they restore a specific version of a document after it has been edited several times? Can they retrieve Teams-related content in a usable format? And can they show when the last successful backup completed?

Also ask what is excluded. Some services cover Exchange, OneDrive and SharePoint but offer limited Teams coverage. Others protect user data but not configuration, permissions or site structure in the way you expect. There is no universal answer, which is why assumptions are risky.

Retention is a business decision, not a default setting

Longer retention is not always better. Keeping every version of every file forever can increase cost, complicate data management and create unnecessary exposure during a legal disclosure request. Equally, short retention periods can leave a business unable to investigate a historical issue or respond to an audit.

Start with the categories of information your organisation holds and the obligations attached to them. Consider employment records, financial documentation, customer contracts, regulated correspondence and intellectual property. Then agree retention periods with the people responsible for finance, operations, HR and compliance.

This should be documented in plain language. Staff need to understand that deleting a document does not necessarily mean it has disappeared immediately, while managers need to know the limits of historical recovery. Clear expectations prevent difficult conversations when someone requests data that no longer exists.

Testing turns backup into resilience

The most reassuring backup report in the world does not prove that your business can recover. Testing does. Schedule restore tests at sensible intervals and record the outcome: what was restored, how long it took, whether permissions were retained and whether the recovered data was usable.

Tests should reflect likely incidents. Recover an email that was deleted by mistake. Restore a folder from a project site. Retrieve a previous version of a file. Where appropriate, simulate the loss of a user account or a compromised device. The goal is not to create disruption; it is to make recovery familiar before a real incident creates pressure.

A managed IT partner can coordinate these tests, interpret the results and adjust policies as your business changes. Nubis 365 approaches backup as part of a wider continuity plan, alongside identity security, user support and practical recovery procedures.

When should you review your backup arrangement?

Review it after a Microsoft 365 migration, an office move, a merger, major growth, a cyber incident or a change in compliance obligations. It is also sensible to revisit the arrangement annually, particularly where new Teams sites, departments or applications have been introduced.

Do not wait for a failed restore to discover that ownership was unclear, a licence had lapsed or a key workload was outside the policy. A short, evidence-led review can identify gaps before they become downtime, lost confidence or a costly scramble for information.

The most useful next step is simple: choose one recent email, one important file and one Teams-related record, then ask how each would be restored today. The answers will tell you whether your Microsoft 365 data is merely stored, or genuinely protected.