How do you back up Microsoft 365, and how often should you test a restore?

You back up Microsoft 365 with a separate backup service that copies your Exchange email, OneDrive, SharePoint and Teams data at least daily to storage outside your Microsoft 365 tenant, keeps earlier versions, and protects those copies from being deleted or encrypted by an attacker. Microsoft keeps the service running, but your data and its protection remain your responsibility [1]. Test a restore at least every quarter, and run a fuller recovery test once a year, because the NCSC's advice is to check that you know how to restore and regularly test that it works [4].

The short version

• Recycle bins, version history and retention policies help with small mistakes. They are not a backup.
• A real backup is a separate copy, outside your tenant, that an attacker with your admin password can't delete.
• Decide how much data you could afford to lose (RPO) and how long you could be without it (RTO), then pick a backup that meets both.
• Test restores on a schedule and write down the result. A backup you've never restored from is an assumption.

Doesn't Microsoft already back up Microsoft 365?

Microsoft keeps the service running: its datacentres, hardware and the Microsoft 365 software. It does not take responsibility for your data. Microsoft's shared responsibility model says that for every type of cloud service, including software-as-a-service such as Microsoft 365, "you own your data and identities", and you remain responsible for data protection, accounts and access [1]. Microsoft's Services Agreement, which covers its consumer services and Microsoft accounts, puts it plainly: "We recommend that you regularly backup Your Content and Data that you store on the Services" [2].

In practice, Microsoft 365 will keep your data available through a datacentre failure. It will also faithfully keep a deletion, an overwrite or a ransomware-encrypted file if someone in your organisation, or an attacker using their account, makes that change.

Why aren't the recycle bin and retention policies a backup?

The built-in features all live inside your Microsoft 365 tenant. If an attacker gets a global admin account, or a sync tool spreads ransomware into OneDrive, the same tenant that holds your data holds its "backups" too.

What does the NCSC say about backups and ransomware?

The NCSC's ransomware guidance tells organisations to keep offline backups, separate and in a different location (ideally offsite), to make multiple copies using different backup solutions and storage locations, and to "regularly test that it is working as expected" [4]. Its principles for ransomware-resistant cloud backups go further [6]:

• Backups should be resilient to destructive actions, so an attacker can't delete or change them.
• It shouldn't be possible to lock you out of every route back to your own backups.
• You should be able to restore from an earlier version even if later versions are corrupted, with retention set by time period, not by a number of copies.
• Encryption keys need robust management.
• Alerts should fire when significant changes are made or privileged actions are attempted.

The same guidance says system owners should test that they can restore from the current backup state "as part of a regular monitoring process" [6].

What are RPO and RTO, in plain English?

• RPO (recovery point objective): how much work you could afford to lose. A daily backup means you could lose up to a day's email and files.
• RTO (recovery time objective): how long you could cope without the data. Restoring one mailbox might take an hour; a whole SharePoint site much longer.

Agree both with the partners or directors, in hours and in pounds, before choosing a backup. Then test against them. A restore that takes three days doesn't meet a four-hour RTO, however good the backup is.

How often should you test a restore, and how?

A sensible cadence for a small or medium business:

Each time, check this list:

1. 1.Confirm every mailbox, OneDrive, SharePoint site and Team is in the backup, including new starters and shared mailboxes.
2. 2.Check the last successful backup time against your RPO.
3. 3.Restore the test item to a separate location, not over the original.
4. 4.Open the restored data and confirm it's complete and readable.
5. 5.Time the restore and compare it with your RTO.
6. 6.Confirm the backup can't be deleted with an ordinary Microsoft 365 admin account, and that admin accounts use MFA.
7. 7.Record the date, what was restored, how long it took and who did it. Your insurer may ask for this.

How much does Microsoft 365 backup cost?

A third-party Microsoft 365 backup service typically costs about £2 to £5 per user per month in the UK, depending on the product, how long copies are kept and how many users you have [8]. One UK provider, for example, lists £3.50 per user per month with UK storage and seven-year retention [9]. Microsoft's own Microsoft 365 Backup is billed by the amount of data protected rather than per user, at a list price of US$0.15 per GB per month [10], so a business with a lot of stored files can pay more than for a per-user product. For a 20-person business, that is roughly £40 to £100 a month for a per-user service.

The price matters less than what you get for it. Ask any backup provider:

• How often does it back up? At least daily, and more often for busy mailboxes and shared files if your RPO needs it.
• How long are copies kept? At least one year is a sensible minimum, and longer where records rules apply: UK limited companies must keep company and accounting records for six years from the end of the financial year they relate to [11].
• Where is the data stored? In the UK, and outside your own Microsoft 365 tenant.
• Can the backups be deleted or changed? Look for immutable copies that a compromised admin account can't remove [6].
• What does it cover? Mailboxes, shared mailboxes, OneDrive, SharePoint, Teams chats and channel messages.
• How often are restores tested, and who does it? Ask to see the record of the last test.
• How quickly can a whole mailbox or site be restored, and what happens to your backups if you leave?

How common is this problem for UK businesses?

The government's 2025/26 Cyber Security Breaches Survey found 43% of UK businesses identified a breach or attack in the previous 12 months, with phishing by far the most common [7]. Most businesses (74%) back up data securely to a cloud service, but only 44% have a business continuity plan that covers cyber security, and only 25% have a formal incident response plan [7]. Having a backup is common. Knowing it will restore, and what you'll do on the day, is much less so.

How does BTNI back up Microsoft 365?

Microsoft 365 backup is part of our Backup & Disaster Recovery service, with recovery tested regularly and a disaster recovery plan built into your platform. If you're comparing providers, ask when they last tested a restore for a client like you. It's one of the questions in the Business Technology Buyer's Guide.