How To Choose An M365 Backup Solution

You'll regret not having an effective backup solution when disaster strikes. To find the right one, start by defining your requirements: regulatory obligations, number of users, retention needs, and recovery expectations. Then shortlist solutions that meet those criteria and test them before committing—switching backup providers later is difficult since you typically can't export legacy backups.

Microsoft 365 handles critical business data—emails, documents, presentations, and collaboration content. With nearly 70% of businesses reporting major data loss events, ensuring you can restore this data isn't optional.

But there's a common misconception: saving files to OneDrive or SharePoint doesn't mean they're protected. Microsoft operates a shared responsibility model—they maintain the infrastructure, but you're responsible for protecting your data. Native retention is limited (typically 30–93 days depending on the workload), there's no built-in ransomware protection, and recovering maliciously deleted content can be difficult or impossible.

A dedicated backup solution addresses scenarios that native M365 tools can't:

Ransomware: Restore a clean backup to regain access without paying the ransom. Native tools replicate corruption—if ransomware encrypts your files, the encrypted versions sync everywhere.

Accidental deletion: Recover lost data quickly, even after retention windows expire. Once an item passes Microsoft's retention period and gets purged, it's gone unless you have an independent backup.

Malicious deletion: Insider threats and compromised accounts can deliberately destroy data. A disgruntled employee or an attacker with stolen credentials can empty mailboxes and wipe SharePoint sites faster than retention policies can protect them.

Compliance: Meet regulatory requirements for data retention and recoverability. Many frameworks (HIPAA, FINRA, SOX) require retention periods far exceeding Microsoft's native capabilities.

Business continuity: Restore from an independent location if your primary environment is compromised. Microsoft outages happen—having your data accessible elsewhere keeps your business running.

We've built our review methodology around eight categories that matter most when evaluating M365 backup solutions. Our scoring weights prioritize recovery reliability and incident readiness, while still accounting for deployment experience, governance, and commercial reality.

Use this framework to evaluate solutions against your own requirements:

What we test: Ease and speed of initial setup, OAuth/consent flow clarity, required admin permissions, time to first successful backup, setup friction points.

Why it matters: A solution that takes hours to deploy with unclear permission requirements creates risk from day one. You want backup running quickly, not stuck in configuration limbo.

What to look for: Setup should complete in under 30 minutes for a standard tenant. The OAuth flow should clearly explain what permissions are needed and why. Backups should start automatically after setup—not require additional manual configuration. Progress should be visible in the UI so you know backups are actually running.

Red flags: Requiring Global Admin permanently (rather than just for initial consent), needing external documentation to complete basic setup, silent failures during onboarding, unclear status indicators.

What we test: Which M365 workloads are protected (Exchange, SharePoint, OneDrive, Teams, Public Folders, Groups, Entra ID), auto-discovery behavior, exclusions or gaps.

Why it matters: A backup solution that misses critical workloads gives you false confidence. If you assume Teams is backed up but discover during an incident that 1:1 chats aren't included, you've lost data you thought was protected.

What to look for: Coverage for all the M365 workloads you use. At minimum: Exchange Online (mailboxes, calendars, contacts), SharePoint Online (sites, libraries, permissions), OneDrive for Business, and Teams (channel conversations, files, and ideally 1:1 chats). If you use Public Folders, Groups, or Planner, verify those are included. Some solutions also cover Entra ID (users, groups, roles) which is valuable for disaster recovery.

Red flags: Workloads excluded by default without clear documentation, no coverage for Teams private chats, SharePoint sites silently skipped due to permission issues, no way to verify what's actually being backed up.

What we test: Default and configurable retention policies, backup frequency options, handling of departed users (leaver scenarios), cross-user restore capability.

Why it matters: Retention requirements vary dramatically by industry and use case. A financial services firm may need seven years of email retention; a startup might only need 90 days. Your backup solution should accommodate your actual requirements, not force you into a one-size-fits-all policy.

What to look for: Configurable retention periods—ideally unlimited or at least matching your compliance requirements. Multiple backups per day (critical for minimizing data loss in an incident). Ability to set different retention policies for different workloads or user groups. Clear handling of departed users—can you still access their backed-up data after their M365 license is removed? Can you restore a former employee's data to a current user?

Red flags: Retention caps that don't meet your compliance needs, extra charges to retain data from departed users, inability to restore data to a different user than the original owner, only one backup per day (24 hours of potential data loss).

What we test: Full mailbox restore speed, single-item restore precision, search and filter capabilities, restore destination options, time to locate and complete restores.

Why it matters: Backup is worthless if you can't restore effectively. The most common recovery scenario isn't a full disaster—it's a user who deleted an important email or a single corrupted file. If finding and restoring that one item takes an hour of admin time, your backup solution is failing at its primary job.

What to look for: Granular search across backed-up data (by sender, date, subject, keywords). Point-in-time selection so you can restore from before an incident. Multiple restore destinations—restore to original location, to a different folder, to a different user, or export to PST/local file. Preview before restore so you can verify you're recovering the right items. Fast restore completion—single items should restore in seconds, full mailboxes in minutes.

Red flags: No cross-user restore capability, search limited to browsing folder structures rather than searching content, restore times measured in hours rather than minutes, inability to restore to a specific point in time.

What we test: Bulk recovery under stress, restore point selection, malware/ransomware scanning, safeguards and warnings during large-scale recovery.

Why it matters: Single-item restore is the common case; bulk recovery is the critical case. When ransomware hits or an admin accidentally deletes a SharePoint site collection, you need to restore hundreds of mailboxes or thousands of files quickly and confidently.

What to look for: Ability to initiate bulk restores without restoring one item at a time. Clear restore point selection—especially the ability to identify the last known-good backup before an incident. Malware scanning that flags potentially infected backups before you restore them. Safeguards that prevent accidental overwrites during large restores. Progress visibility during long-running restore operations.

Red flags: No malware scanning (you could restore the ransomware along with your data), bulk restore requires support ticket or manual intervention, system locks up during large restores preventing other operations, no way to identify when an incident started.

What we test: Failure detection and visibility, alerting options, reporting dashboards, export capabilities, day-to-day monitoring usefulness.

Why it matters: A backup that's been silently failing for three months is worse than no backup at all—at least without backup you know you're exposed. You need confidence that backups are running correctly, and immediate visibility when they're not.

What to look for: Clear status indicators showing backup success/failure at a glance. Proactive alerting via email, webhook, or integration with your monitoring tools. Detailed logs that help diagnose why a backup failed. Reporting that can be exported for compliance audits. Historical trends showing backup health over time.

Red flags: Failed backups don't trigger alerts, unclear status indicators (what does 'completed with warnings' actually mean?), no way to drill into failure details, reports can't be exported.

What we test: Audit log detail and retention, RBAC and least-privilege alignment, MFA enforcement, permissions required for restore operations.

Why it matters: Backups contain your most sensitive data concentrated in one place—an attractive target for attackers. Strong access controls and detailed audit logs are essential, both for security and compliance.

What to look for: Role-based access control so you can limit who can restore what. MFA enforcement for backup admin access. Comprehensive audit logs showing who accessed or restored data, with timestamps. Audit log retention that meets your compliance requirements (many frameworks require years, not months). Encryption at rest and in transit. Data residency options if you have geographic compliance requirements.

Red flags: No RBAC (all admins can restore all data), audit logs only retained for 30-90 days, no MFA option, unclear data residency or inability to choose backup storage location.

What we test: Pricing model clarity, storage limits and pooling, charges for inactive users, real support ticket experience (response time, technical quality).

Why it matters: Backup costs can spiral unexpectedly. A solution that seems affordable at first can become expensive when you factor in storage overages, charges for departed users, or add-ons required for essential features.

What to look for: Transparent per-user pricing with clear inclusions. Unlimited or generous storage—solutions that charge by storage consumed can get expensive as your data grows. Free or low-cost retention of departed users. Responsive support with reasonable response times for your tier. Clear documentation and self-service resources for common issues.

Red flags: Pricing not published (requiring sales contact for basic information), storage caps that trigger expensive overages, per-GB pricing that penalizes data growth, long support response times, essential features locked behind expensive tiers.

Once you've mapped your requirements to these categories, separate them into "must-haves" and "nice-to-haves." GDPR compliance might be mandatory—without it, you can't use the solution. BYOK encryption might be desirable but not a dealbreaker.

There's rarely one solution that's clearly the best fit. More likely, three or four options will meet your requirements, each with different strengths. When shortlisting, pay particular attention to:

Industry fit: Does the solution meet your compliance requirements? Some frameworks are non-negotiable.

Scale: Is the platform designed for SMBs, enterprises, or MSPs? A solution built for one may not suit another.

Data residency: Where will your data be stored? Regulatory requirements may dictate specific regions.

Total cost: Understand the pricing model fully—per-user, per-GB, storage caps, and any hidden costs. Model your actual usage, not just the headline price.

Once you've shortlisted candidates, test them. The success of your business could depend on how well your backup solution performs when something goes wrong. See it in action before committing.

This matters more for backup than other tools. Unlike most software, switching backup providers is difficult—you generally can't export legacy backups. When you move to a new provider, you only have coverage from that point forward, with no access to historical backups. Choose wrong and you're either stuck with a subpar solution or you lose your backup history.

During your evaluation:

Test real scenarios. Don't just set up backup and call it done. Delete a test email and restore it. Try restoring to a different user. Search for a specific item across mailboxes. Time how long these operations take.

Evaluate the interface. Is the workflow intuitive? Could a junior admin handle a restore at 2am during an incident? Complexity under pressure leads to mistakes.

Test support. Raise a real support ticket during your trial. How long until you get a response? Is it a canned reply or actual technical help? Support quality varies dramatically between vendors.

Verify compliance claims. If the vendor claims SOC 2 or HIPAA compliance, ask for documentation. Certifications should be verifiable, not just marketing claims.

If a vendor is confident in their product, they'll welcome a thorough evaluation. Resistance to testing or pressure to sign quickly should give you pause.

Selecting a backup solution shouldn't be rushed, but it shouldn't be postponed either. It's the foundation that ensures your organization can continue operating after data loss, ransomware, or accidental deletion.

Define your requirements across the eight categories. Build a shortlist based on your must-haves. Test thoroughly before committing—including real restore scenarios, not just backup configuration. The time invested upfront will pay off when you need to recover critical data.