Microsoft 365 backup: why a green dashboard is not enough

“We have backups” sounds reassuring. It becomes a less complete answer when you ask which files are covered, who can restore them and when that process was last tested.

For a small business running on Microsoft 365, those details matter. Customer correspondence, quotations and working documents can sit across mailboxes, OneDrive and SharePoint, with other information still saved only on laptops.

Our position is straightforward: backup assurance needs evidence of recovery. A green dashboard is useful operational information, but we would not use it alone to conclude that a business is ready for a serious data-loss incident.

Start with the work the business cannot lose

A backup review should begin with the information that keeps the business operating. Identify current customer work, financial records and essential correspondence, then trace where each is stored.

For example, a proposal could be saved in an employee's OneDrive while its supporting correspondence sits in a shared mailbox. Recovering the document without the messages would leave an incomplete picture.

This is an illustrative scenario, but it shows why checking a list of licensed users is insufficient. The scope of protection needs to follow the business's data, including shared resources and new storage locations.

Microsoft 365 includes recovery features, but identify the actual service

Microsoft 365 provides features such as version history and recycle bins. Microsoft also offers a dedicated Microsoft 365 Backup product for supported Exchange, OneDrive and SharePoint data, alongside backup services from other suppliers.

These have different purposes and recovery arrangements. The practical requirement is a written record of what your business uses, which data is protected and what the recovery limits are.

Avoid the blanket statement that Microsoft 365 has “no backup”. It obscures the real task: deciding whether the protection you have meets your business requirements.

Synchronisation is not an independent recovery copy

OneDrive synchronisation makes a file available across devices. It also carries changes between them. Seeing the same file on a desktop and laptop does not establish that either copy will survive an unwanted deletion or overwrite.

Review the available recovery features and any configured backup against a specific incident: an important folder is damaged, and the problem is discovered weeks later. Establish which recovery points remain available and what can be restored from them.

That is a more useful test than asking whether a cloud icon appears beside the folder.

Our second priority is the power to delete the backups

Backup administration is part of the security design. Identify who can change retention, remove protection and delete recovery data, then review how those privileges are protected.

The important question is what happens if an attacker gains control of a powerful account. A backup product's name does not answer it. Its access model, deletion protections and recovery procedures do.

We would treat unrestricted backup administration through an everyday working account as a weakness to address. Keep powerful access separate from routine email and browsing, protect it appropriately and document how authorised staff regain access during an incident. Our guide to the Microsoft 365 security settings most businesses have switched off covers separating and protecting administrator accounts.

Run a restore test that resembles real work

Select a representative document and mailbox item. Restore them into a controlled location, confirm the versions are right and check that the recovered content is usable.

Record:

• What you restored and the recovery point used.
• Who performed the work and which access they needed.
• How long the process took.
• Any missing information or manual steps.

A small restore test does not establish the duration of a full recovery. It does establish whether your team can carry out the basic process and exposes assumptions before they become urgent.

Agree the business recovery priorities

Technical recovery needs an order. Current customer work could take priority over an old project archive. Finance might need access to payment information before every laptop is ready.

Set two business limits: the amount of recent work you can afford to recreate, and the time you can operate without the affected system. Use these to select and test the recovery arrangement.

Review coverage when you add users, change applications or reorganise storage. A backup plan that matched the business last year needs checking against the business you run today. If you are also changing IT support provider, confirm backup continuity before the old service ends.

Further reading: Microsoft 365 Backup overview.