Moving to Microsoft 365 greatly reduces the need to deal with physical server failures. But a resilient cloud service does not mean the organization is prepared for every data loss scenario.
Platform resilience is not the same as data recovery
Service continuity, data retention, backup and operational recovery address different needs. Microsoft provides data replication, versioning, recycle bins and infrastructure resilience across Exchange Online, SharePoint and OneDrive. Even so, the organization must set its own recovery objectives for risks such as accidental deletion, malicious insiders, faulty automation, ransomware or data loss that is discovered long after it happened.
For example, a SharePoint site can be technically available while a misbehaving sync or an authorized user's action has overwritten thousands of files. There is no service outage, yet there is serious data loss. Microsoft's current technical documentation describes the resilience mechanisms for SharePoint and OneDrive and Exchange Online separately.
Set RPO and RTO separately for each workload
A Microsoft 365 backup project should not start with choosing a product but with two questions: how much data loss can the organization accept at most, and how quickly must critical services be usable again?
The answer to the first question defines the RPO; the answer to the second defines the RTO. Exchange Online, management files, finance documents, HR data and collaboration spaces do not all need the same target. As with high availability server infrastructure design, this classification ties technical investment to real business impact.
Exchange Online
Critical executive and shared mailboxes should be classified by operational priority.
SharePoint
Finance, legal and management sites need a data owner and an approved recovery time.
OneDrive
Corporate data in personal workspaces should be tied into the employee offboarding process.
Teams data
The inventory should reflect that files depend on SharePoint and OneDrive, and some messages on Exchange.
Identify workloads and data owners first
The starting point of a successful recovery plan is not a technical tool but a data inventory. Every SharePoint site, Teams group, shared mailbox and critical OneDrive account should have a business owner.
- Workload or system name, business unit and data owner
- Criticality of the data and its acceptable RPO and RTO
- Retention period and whether it holds personal or sensitive data
- The person who approves a recovery
- Recovery test frequency and validation method
Protecting all data the same way looks simple, but it raises costs and hides real priorities. For most organizations it does not make sense for critical management documents and temporary project files to share the same recovery policy.
A retention policy is not a backup
Microsoft Purview retention policies are designed to keep content for a set period, manage it as a record or delete it when the period ends. Copies of SharePoint and OneDrive content can be kept in the Preservation Hold library, and Exchange content in the Recoverable Items folder. This is valuable for compliance, audit and data lifecycle purposes. Details are explained in the Microsoft Purview retention documentation.
However, having a retention policy does not fully cover operational recovery needs. Backup requires a defined recovery point, a measurable restore time, an authorized restore process and regular testing.
- Which data must be retained for legal or corporate reasons?
- Which data must be restored quickly after an operational incident?
- Which data should be kept in an independent protection layer outside the service or tenant?
What does Microsoft 365 Backup offer?
Microsoft 365 Backup is a built-in service that can protect Exchange Online mailboxes, OneDrive accounts and SharePoint sites. The recovery window defaults to one year; since an August 2026 update it can be configured per policy to 3, 6, 12 or 24 months. If the window is shortened, backups that fall outside the new window are permanently deleted after a grace period.
For OneDrive and SharePoint, restore points are available every 10 minutes for the last 14 days and weekly for older periods. For Exchange Online, 10-minute restore points are kept throughout the year. Recovery granularity and available options differ by workload, so licensing, cost and restore scope should be validated in a pilot. The current feature table is available in the Microsoft 365 Backup overview.
When choosing between the built-in service and third-party solutions, price should not be the only comparison. The oldest recoverable date, file- or mail-level granularity, storage outside the tenant, immutable copies, role-based access, audit logs, data residency and the total cost of restores should all be evaluated together.
Separate the backup account from daily admin accounts
Accessing the backup system with the global administrator account used every day is a significant risk. If those credentials are compromised, an attacker can reach both production data and the recovery layer.
- Assign backup administration to a dedicated role.
- Enforce multi-factor authentication on administrator accounts.
- Use separate accounts for daily work and administration.
- Require a second person's approval for critical restores.
- Monitor for deletion of backup policies or reductions in their scope.
The goal is not just to copy data, but to prevent an attacker from taking away your ability to recover.
A backup that has never been restored is not finished
A backup job that looks successful does not prove that the data can actually be brought back in usable form. NIST's approach to contingency planning likewise recommends treating recovery plans together with procedures, responsibilities, testing and validation. The NIST contingency planning guidance provides a useful framework.
A quarterly test can include restoring a deleted email, a OneDrive account's data from a specific date and an accidentally deleted SharePoint site. Ransomware-style mass file changes and loss of access to an administrator account should also be added to the exercise scenarios.
During testing, start and end times should be recorded, the achieved RPO/RTO measured, and the data owner should confirm the restored content. The technical team saying "the restore is complete" is not enough on its own.
A practical 90-day roadmap
First 30 days
Build the Exchange, OneDrive, SharePoint and Teams data inventory. Identify critical business units, data owners and retention requirements.
Days 31–60
Approve RPO/RTO targets. Start a limited pilot with a suitable solution, separate admin roles and set up security alerts.
Days 61–90
Run a recovery exercise based on a realistic data loss scenario. Measure the times and record any failed steps.
Continuous improvement
Bring new users, sites and workloads into scope, and report results to management through quarterly reviews.
Questions for a Microsoft 365 data protection review
- Do critical mailboxes, OneDrive accounts and SharePoint sites have named owners?
- Are RPO, RTO and retention periods written down for each workload?
- Are retention policies and operational backup kept distinct?
- Is the backup administrator independent of daily admin accounts?
- Are restore times measured through regular tests and confirmed by data owners?
The resilience of Microsoft 365 is a major advantage, but enterprise business continuity cannot be left to the service provider's infrastructure alone. The right approach brings data inventory, retention policy, backup, identity security, monitoring and regular recovery testing together under a single management model.