In short
An immutable Microsoft 365 backup is a copy of your Exchange, OneDrive, SharePoint and Teams data that cannot be altered or deleted for a set period, even by an administrator. With credentials separate from your tenant, it answers the first of the NCSC's five principles for ransomware-resistant cloud backups (November 2024): backups should be resilient to destructive actions.
Get a quote for Immutable Microsoft 365 backup
Tell us roughly how many users or sites you have and we will reply by email with options and a quote.
Immutable, append-only and air-gapped
These terms are often used loosely. In plain English:
- Immutable: once written, a backup cannot be modified or deleted until its retention period ends, by anyone
- Append-only: new restore points can be added, but existing ones cannot be changed; whether they can be deleted is a separate question
- Air-gapped (logically): the backup is held in a separate system with separate credentials, so access to your production environment does not give access to the backups
- Delayed deletion: deletion requests are accepted but not carried out straight away, giving time to spot and stop a malicious request
Microsoft's own service is a useful example of why the distinction matters. Microsoft says Microsoft 365 Backup stores backups in append-only storage inside the Microsoft 365 data trust boundary, so existing restore points cannot be modified. But a Backup administrator can delete backups by offboarding the service, after a fixed 90-day grace period during which they can still be recovered, and Microsoft supports email notifications to multiple admins. That is strong protection against tampering, with a deliberate route to deletion. Our Microsoft 365 Backup Storage page covers the service in full.
Why separate credentials matter
The attack most backups are not designed for is an attacker who already holds a Global Administrator account. From there they can delete users, empty recycle bins, change retention and, in some setups, reach the backup too. Three questions decide whether your backup survives that:
- Is the backup console signed in to with an account that is not a Microsoft 365 admin account, protected by its own MFA?
- Can anyone with access to the backup console delete backups or shorten retention immediately, or is there a delay, a second approval or an alert?
- Is the backup data stored outside your Microsoft 365 tenant, where tenant-level admin rights do not reach?
The answers depend on how the product is set up as much as on the product itself, which is why we treat setup as part of the job. The Microsoft 365 backup best practices checklist covers least-privilege restore roles and alerts.
The NCSC's principles for ransomware-resistant cloud backups
On 22 November 2024 the NCSC published its Principles for ransomware-resistant cloud backups. They describe what a cloud backup service should do, which makes them a clear list of what to ask for when you buy one:
| Principle | What it means | What to ask a vendor |
|---|---|---|
| 1. Backups should be resilient to destructive actions | The service should protect backup data from malicious editing, overwriting or deletion, for example through immutability or delayed deletion | Can a compromised admin delete backups or shorten retention, and how quickly? |
| 2. It should not be possible to deny all customer access | An attacker should not be able to lock you out of your own backups by removing every account, or the customer account itself | How do we recover access if our backup admin account is compromised? |
| 3. Restore from a backup version, even if later versions become corrupted | Backups are kept for a retention period that matches your risk appetite, so you can go back to an earlier version if newer ones are damaged | How long is history kept, and can we restore an older version if later ones are corrupted? |
| 4. Robust key management for data at rest | If an attacker can delete or change the encryption keys, they can make a backup unreadable without deleting it, so the keys must be protected | Who holds the keys and how are they protected? |
| 5. Alerts on significant changes or privileged actions | Significant or suspicious changes raise alerts, whether or not they succeed, through channels that still work if your own systems are compromised | Which events alert us, how, and who receives them? |
The principles are guidance rather than a certification, and the NCSC applies them to cloud backup generally. They are a good basis for comparing Microsoft 365 backup products, and we use them when we recommend one.
Not sure which option fits? Ask us
Tell us what you need and we will recommend the right option for your organisation, with a quote.
How the platforms we supply approach immutability
Each vendor describes its protections differently. This is what each says, from its own material; we check the detail for your setup before you buy:
| Platform | Where the copy lives | What the vendor says about protection |
|---|---|---|
| Acronis | Acronis Cloud, or Microsoft 365 Backup Storage as an alternative licensing option | Optional immutable storage; AI-assisted anomaly detection on Microsoft 365 backups |
| Axcient x360Cloud | Axcient Cloud | AirGap separates deletion requests from the deletion itself, with a delay; immutable audit logs; encryption in transit and at rest; MFA on the console |
| NinjaOne SaaS Backup | NinjaOne's cloud, outside your tenant | AES-256 encryption in storage and transit per the vendor's security material, audit log; the + Archiver bundle adds journaling into immutable storage |
| Redstor | Redstor's cloud, in the region you choose | Immutable, encrypted backups held off-site and isolated from the live system; every backup scanned for malware |
| Commvault | Outside Microsoft 365, in a separate security domain | Air-gapped copies protected by zero trust access controls; Commvault also offers Air Gap storage as isolated, immutable cloud storage |
| Microsoft 365 Backup | Inside the Microsoft 365 data trust boundary | Append-only; deletable by the Backup admin through offboarding, with a 90-day grace period |
Immutability settings are often optional or depend on the storage chosen, so ask what is switched on by default and what you have to configure. The Microsoft 365 backup comparison covers the rest of each product.
Balancing immutability with retention and erasure
Immutability works by stopping deletion, which can sit awkwardly with your other obligations. A few points to settle when you set it up:
- Retention period: an immutable copy is kept for as long as its retention says, so choose a period long enough to reach back past an attack but no longer than you can justify under UK GDPR's storage limitation principle
- Leavers: decide how long leavers' backups are kept, and whether that differs from current staff
- Erasure requests: data in an immutable backup cannot be removed early, so agree with your DPO how such requests are recorded and handled until the backup expires
- Changing your mind: shortening retention on immutable storage is deliberately hard; agree the setting before go-live rather than after
- Cost: retention and storage choices affect what you pay with some licensing models; the Microsoft 365 backup pricing page explains how each option is charged
Our Microsoft 365 backup compliance page covers the UK GDPR side in more detail.
Is Immutable Microsoft 365 backup the right fit for you?
We will check it against your systems and requirements and recommend the right option.
Immutability is not the whole answer
An immutable copy only helps if it is recent enough, kept long enough and can actually be restored. Pair it with:
- Retention long enough to reach back past an attacker who went unnoticed for weeks
- Coverage of everything that matters, including shared mailboxes, Teams and Entra ID backup
- Regular test restores, so you know the copy is usable
- A written recovery order, as set out in Microsoft 365 ransomware recovery
If you also need to keep email unchanged for legal or regulatory reasons, that is a job for an archive rather than a backup; our sister site explains email archiving vs backup.
How we help
We can assess your current Microsoft 365 backup against the NCSC's five principles, recommend a platform and storage option that fits, and set it up with separate credentials, MFA, sensible retention and alerts on backup deletion. We then test a restore with you before handover. Pricing depends on users, storage and retention, so ask us for a quote.
Contact us about ransomware-resistant backups for Microsoft 365.
How Forever Systems helps with Microsoft 365 backup
We are an independent UK IT and cyber security provider. We supply more than one Microsoft 365 backup product, so we can recommend what fits your tenant, your retention needs and your budget rather than one vendor's answer to everything.
- Review what you have: we look at your Microsoft 365 licences, retention policies and any existing backup before suggesting anything new
- Help you choose: we compare the backup products we supply against the workloads you need covered, such as Exchange Online, OneDrive, SharePoint, Teams and Entra ID
- Set-up and onboarding: we can help connect the backup service to your tenant and agree what is protected and how long copies are kept
- Restore testing: we can help you plan and run test restores so you know how recovery works before you need it
- Licensing in one place: backup licences alongside your Microsoft 365 subscriptions, with terms confirmed at quote
We work with businesses, schools, charities and public sector organisations. Contact us to talk it through.
Frequently asked questions
Is Microsoft 365 Backup immutable?
Microsoft describes its storage as append-only, so existing restore points cannot be modified. A Backup administrator can still delete backups by offboarding the service, after a fixed 90-day grace period in which they can be recovered. Whether that meets your definition of immutable is worth deciding before you rely on it.
What are the NCSC principles for ransomware-resistant cloud backups?
Published by the NCSC on 22 November 2024, they are: backups should be resilient to destructive actions; it should not be possible to deny all customer access; you can restore from a backup version even if later versions become corrupted; robust key management protects data at rest; and alerts are triggered by significant changes or attempted privileged actions.
What is the difference between immutable and air-gapped backup?
Immutable means a backup cannot be changed or deleted for a set period. Air-gapped means it is kept separate from your production systems and credentials. For Microsoft 365, a logical air gap usually means the copy is stored outside your tenant and accessed with separate accounts. The two work best together.
Can ransomware delete Microsoft 365 backups?
It can if the attacker reaches the backup with admin rights and the product allows immediate deletion. Storing backups outside your tenant, using separate credentials with MFA, and choosing immutable storage or delayed deletion make that much harder.
Do I need immutable backup for cyber insurance?
Insurers set their own questions, so check your proposal form. If it asks how backups are protected from an attacker, an immutable copy held outside your production environment, with separate credentials, is a clear answer to give.
Still have a question about Immutable Microsoft 365 backup?
Ask us and a member of our team will reply by email.
More Microsoft 365 backup guides
Microsoft 365 BackupMicrosoft's own backup for OneDrive, SharePoint and Exchange, explained.Compare backupThe five platforms we supply and Microsoft 365 Backup, side by side.Backup and complianceUK GDPR, data location, NCSC guidance and insurance questions for Microsoft 365 backups.