Microsoft 365 Backup: Microsoft's own backup explained

What is Microsoft 365 Backup?

Microsoft 365 Backup is a backup and restore tool that Microsoft sells for its own cloud. You switch it on in the Microsoft 365 admin centre, choose which OneDrive accounts, SharePoint sites and Exchange mailboxes to protect, and Microsoft keeps restore points that you can roll back to after accidental deletion, a malicious insider or a ransomware attack.

Microsoft 365 Backup Storage is the storage and restore platform the tool is built on. Microsoft also opens that platform to independent software vendors, who build their own backup applications on it. When you use one of those applications, Microsoft says the backup is "managed and paid for entirely through the partner's application", not through the admin centre. That is why the two names are often used interchangeably in search results: one is the product, the other is the engine.

It matters because it changes an old assumption. Microsoft's Backup FAQ asks whether its stance on shared responsibility for data protection has changed, and answers: "No, we still have the same point of view, but are now offering more tools to help organizations achieve those goals and responsibilities." Protecting and recovering your data is still your job under the Microsoft 365 shared responsibility model. Microsoft 365 Backup is one way to do it; an independent backup from another vendor is another.

Microsoft 365 Backup is billed by Microsoft to your own Azure subscription; it is not one of the backup platforms Forever Systems supplies. We explain it here because the obvious question is whether you still need a separate backup now that Microsoft offers one, and the honest answer depends on the details below.

What Microsoft 365 Backup covers, and what it does not

Two practical consequences follow. If your organisation leans on Microsoft 365 groups and Teams conversations, part of what you would want back after an incident is outside Microsoft 365 Backup's scope. And identity configuration, such as Conditional Access policies and group membership, needs its own plan; see our Entra ID backup guide. Our Microsoft 365 data backup hub goes through each workload in turn.

Recovery window, recovery points and restores

Microsoft publishes the following in its Microsoft 365 Backup overview:

The rollback behaviour is worth understanding before you need it. Restoring a whole SharePoint site in place takes it back to the chosen moment, which is exactly right after ransomware and less helpful when one person deleted one folder yesterday while everyone else carried on working. For that, Microsoft now offers granular restore of selected files and folders, and restoring a whole site to a new URL also avoids overwriting live work. Microsoft notes that granular restore points are roughly daily, so they are coarser than the 10-minute points used for full rollbacks.

When users leave, Microsoft's FAQ says that if a user is removed from the backup policy or deleted from Entra ID, the backup of their OneDrive or mailbox is kept for one year from the date it was created, and a SharePoint site removed from a policy is held for 52 weeks from each restore point. Compare that with the much shorter windows in the Microsoft 365 recycle bin.

Where the backups live and how they are protected

Microsoft's design keeps backups inside Microsoft 365 rather than copying them somewhere else:

• Within the data trust boundary: Microsoft says backup data stays inside the Microsoft 365 data trust boundary and honours your tenant's geographic data residency, with only limited metadata sent to Azure for billing
• Append-only storage: existing restore points cannot be modified, which protects them from malware or a malicious overwrite
• Deletion is possible, with a grace period: Microsoft says the backups are immutable unless expressly deleted by the Backup admin through offboarding, and there is a fixed 90-day grace period in which offboarded backups can be recovered
• Separate from retention: Purview retention and deletion policies do not change the backup recovery window (see Microsoft 365 backup vs retention)
• Alerts on risky actions: multi-admin email notifications can tell a preset group of administrators when a potentially harmful action is taken in the Backup tool

Microsoft is open that this is not immutability in the strict sense: its documentation says the service follows the definition of immutability "except for disallowing deletion", partly so customers keep control for data protection law reasons. Whether that is enough for you depends on how you weigh the risk of a compromised administrator account. The NCSC's principles for ransomware-resistant cloud backups are a useful yardstick, and we compare the approaches in immutable Microsoft 365 backup.

How Microsoft 365 Backup is billed and set up

Microsoft 365 Backup is pay-as-you-go. Rather than a per-user licence, you are charged for each GiB of protected data each month, billed to an Azure subscription, and Microsoft says restores are not charged. Costs can be split across several Azure subscriptions with Microsoft's departmental billing option. Microsoft publishes its consumption rate on Microsoft Learn; we do not repeat prices here, and the cost for your tenant depends on how much data you protect. Our Microsoft 365 backup pricing page compares this model with the per-user licensing most third-party products use.

To set it up, Microsoft's documentation asks for:

1. The right admin role: a SharePoint Administrator or Global Administrator sets the service up; Microsoft recommends using the role with the fewest permissions that does the job, keeping Global Administrator for emergencies
2. An Azure subscription that will receive the bills, a resource group and region, and an account holding Owner or Contributor rights on the subscription
3. Pay-as-you-go billing turned on for Microsoft 365 Backup in the Microsoft 365 admin centre (organisations starting after 1 April 2026 use the pay-as-you-go set-up under Billing)
4. Backup policies for each workload, choosing the sites, accounts and mailboxes to include and the recovery window
5. Email notifications sent to a list of administrators when potentially harmful actions happen, such as offboarding backups or pausing a policy

Microsoft also lists scale limits that apply to each workload separately: up to 1,000,000 items per workload, up to 100 backup policies per workload and up to 100,000 items per policy, with larger needs discussed directly with Microsoft.

Microsoft 365 Backup Storage and third-party backup apps

Because Microsoft 365 Backup Storage is a platform, you can use it without Microsoft's own interface. Two of the vendors we supply offer it as an option:

• Commvault announced general availability of Commvault Cloud with Premium Microsoft 365 Backup Storage on 31 July 2024. It is chosen per workload in the Commvault Cloud console and is aimed at high-speed, in-place restores, alongside Commvault's own backup copy held outside the tenant. See our Commvault page.
• Acronis lets you keep Microsoft 365 backups in Microsoft 365 Backup Storage instead of Acronis Cloud. Acronis lists that option with consumption-based pricing per GB and fixed one-year retention, covering Exchange user mailboxes, OneDrive accounts and SharePoint sites, with whole mailbox, account or site recovery to the original location rather than individual items. Its standard option is per-seat licensing with unlimited Acronis Cloud storage on eligible plans. See our Acronis page.

One point to plan for: Microsoft's FAQ says you can currently transfer control of the backup from Microsoft's own application to a third-party application built on the platform, but not straightforwardly back again. Decide which console you want to live with before you move.

The trade-offs between keeping everything inside Microsoft 365 and holding a separate copy elsewhere are set out in Microsoft 365 native backup vs third-party backup.

Is Microsoft 365 Backup enough on its own?

For some organisations, yes. If your risk is mainly mass encryption or mass deletion in OneDrive, SharePoint and user mailboxes, and you want fast, large-scale rollback without another vendor, Microsoft 365 Backup is a serious option and Microsoft publishes restore performance figures to back that up.

It is a weaker fit when you need any of these:

• A copy outside Microsoft 365, for example because a cyber insurer asks for backups held separately from production, or because you want backups that a compromised tenant administrator cannot offboard
• Wider coverage, such as group mailboxes, Teams channel conversations or Entra ID configuration
• Longer or more flexible retention than a two-year recovery window, for example for leavers
• Export, such as handing over a mailbox as a PST file for a legal request; Microsoft's Backup documentation describes restores, not exports
• Predictable per-user costs rather than consumption that grows with your data

Our Microsoft 365 backup comparison puts Microsoft 365 Backup side by side with the five platforms we supply.

How Forever Systems helps

Because Microsoft 365 Backup is billed by Microsoft rather than supplied by us, we can tell you plainly when it is the right answer. We can look at your tenant with you, what you protect today, which workloads matter most, how leavers are handled and what your insurer or auditors ask for, and recommend Microsoft's own backup, a third-party platform, or a combination. If a third-party platform fits, we can supply and set it up, and test a restore with you. Contact us to talk it through.