How to Set Up a Business Backup Strategy for Microsoft 365

Overview

Microsoft operates Microsoft 365 infrastructure with high availability and geo-redundancy. However, Microsoft's responsibility ends at platform availability — they do not protect against data loss caused by accidental deletion, malicious insiders, ransomware, or retention policy gaps.

The Microsoft Services Agreement states: "We recommend that you regularly backup Your Content and Data that you store on the Services."

This guide explains what Microsoft protects (and what it does not), and how to build a backup strategy that covers the gaps.

What Microsoft Protects vs. What You Need to Protect

Microsoft 365 Built-In Retention

Before setting up third-party backup, understand what Microsoft retains natively:

What this means

• If a user deletes an email and empties their Deleted Items, you have 30 days to recover it from the recoverable items folder
• If a user deletes a OneDrive file, you have 93 days to restore from the recycle bin
• After retention expires, the data is permanently gone unless you have a backup

The 3-2-1 Backup Rule

The gold standard for backup strategy:

• 3 copies of your data
• 2 different storage media or locations
• 1 copy offsite or offline (air-gapped)

For Microsoft 365, this translates to:

1. Original data in Microsoft 365 (copy 1)
2. Third-party backup in a separate cloud (copy 2)
3. Offline or immutable copy that ransomware cannot reach (copy 3)

Recommended Third-Party Backup Solutions

What to look for in a backup solution

• Point-in-time recovery — restore data to a specific date and time
• Granular restore — recover individual emails, files, or folders (not just full mailboxes)
• Immutable storage — backups that cannot be modified or deleted, even by an admin
• Automated scheduling — backup runs 1-3 times daily without manual intervention
• Cross-tenant restore — restore to a different M365 tenant (important for disaster recovery)
• Compliance retention — configurable retention periods for legal and regulatory requirements

Setting Up Microsoft 365 Retention Policies

While third-party backup is the primary recommendation, you should also configure M365's built-in retention as a first layer of protection.

Create a retention policy for email

1. Go to compliance.microsoft.com (Microsoft Purview)
2. Navigate to Data lifecycle management > Retention policies
3. Click New retention policy
4. Name: "Email Retention — 1 Year"
5. Choose locations: Exchange mailboxes (all users)
6. Retention period: Retain for 1 year, then do nothing (or delete, depending on your policy)

Create a retention policy for OneDrive and SharePoint

1. Same portal > New retention policy
2. Name: "File Retention — 1 Year"
3. Choose locations: OneDrive accounts + SharePoint sites (all)
4. Retention period: Retain for 1 year

Litigation hold (for legal preservation)

If you need to preserve all data for legal reasons:

# Place a user on litigation hold
Connect-ExchangeOnline
Set-Mailbox -Identity "[email protected]" -LitigationHoldEnabled $true -LitigationHoldDuration 365

Backup Schedule Recommendations

Export Conditional Access policies (no backup tool needed)

Connect-MgGraph -Scopes "Policy.Read.All"

$policies = Get-MgIdentityConditionalAccessPolicy -All
$policies | ConvertTo-Json -Depth 10 | Out-File "CA-Policies-Backup-$(Get-Date -Format 'yyyy-MM-dd').json"

Testing Your Backups

A backup that has never been tested is not a backup. Schedule quarterly restore tests:

Test 1: Recover a single email

1. Delete a test email from a user's mailbox
2. Empty the Deleted Items and wait for the recoverable items window to expire
3. Restore the email from your third-party backup
4. Verify the email is intact (subject, body, attachments)

Test 2: Recover a OneDrive folder

1. Delete a test folder from OneDrive
2. Empty the recycle bin
3. Restore the folder from backup
4. Verify all files are present and not corrupted

Test 3: Full mailbox recovery

1. Create a test user
2. Simulate a mailbox loss (remove the licence)
3. Restore the full mailbox from backup to a new user
4. Verify all emails, folders, and calendar items are recovered

Disaster Recovery Scenarios

Next Steps

• Evaluate and deploy a third-party M365 backup solution
• Configure retention policies in Microsoft Purview as a first layer
• Schedule quarterly backup restore tests
• Document your backup and recovery procedures in a runbook
• Review your cyber insurance policy — many require documented backup procedures