We have developed a standardized testing methodology specifically for the Microsoft 365 ecosystem. This framework considers specific considerations and metrics for backing up Microsoft 365 accounts.
Our M365 audit is divided into nine categories. Each vendor is evaluated against these criteria in our testing lab, with a total of 100 possible points available. This total is then converted into a numerical rating out of 10, which is what you see when you look at a BackupVerdict product review.
1. Deployment (8% of Overall Rating)
We assess how quickly and clearly you can get from sign-up to a working backup.
How We Test
We begin setup from a clean Microsoft 365 tenant and record every step of the process. We observe the OAuth consent flow, note required admin roles and permissions, and count the number of setup steps required.
We record the total setup time from start to initiating the first backup, then measure the time until that first backup completes successfully. We also note whether external documentation is required, and capture any setup friction or confusing stages along the way.
A strong deployment experience means you can onboard a new tenant quickly, with clear prompts and minimal confusion.
2. Coverage (10% of Overall Rating)
We determine which Microsoft 365 workloads are protected and how completely.
How We Test
After initial setup, we review auto-discovered workloads and confirm which M365 services are enabled by default. We verify coverage for Exchange Online, SharePoint Online, OneDrive for Business, and Microsoft Teams (including 1:1 chats, channel chats, and private/shared channels).
We identify any workloads excluded by default, note unsupported objects such as Public Folders or Entra ID, and document any undocumented or unexpected exclusions. We also record whether coverage can be expanded via configuration or licensing.
Points are awarded for each supported workload, with additional weight given to overall coverage completeness and implementation quality.
3. Retention (11% of Overall Rating)
We evaluate how backup data is retained over time and through lifecycle events.
How We Test
We review default retention settings and attempt to configure retention by user group and workload. We identify maximum retention limits and check per-tenant vs per-workload behavior.
We also test the employee departure scenario: we identify a user marked as inactive or deleted, attempt to restore data from that user, and test restoring data to another active user. We observe licensing impact on retained data and record any restrictions or charges related to inactive users.
Where applicable, we identify express vs standard retention behavior to understand how different backup modes affect your data protection.
4. Recovery (18% of Overall Rating)
Recovery is the most heavily weighted category in our methodology. We measure precision, speed, and reliability of restores.
How We Test
Full Mailbox Restore (Timed): We locate an appropriate restore point, record the time taken to locate restore data, initiate a full mailbox restore, and record both the restore completion time and the time until data is visible in Microsoft 365.
Single-Item Restore: We attempt to restore a single email or file, use search to locate the item, apply filters (date, sender, location), and complete the restore without overwriting other data. We note any workarounds required.
A higher score reflects fast, reliable recovery with minimal clicks and clear feedback throughout the process.
5. Resilience (15% of Overall Rating)
Resilience measures how well a platform performs during large-scale incidents or security events.
How We Test
We identify available restore points around a simulated incident, select a known-good restore point, and assess the ease of bulk recovery initiation. We observe safeguards, previews, or warnings presented during recovery, and evaluate operator confidence during the process.
We also test malware and ransomware scanning capabilities where available. This category focuses on how the platform behaves during worst-case scenarios rather than day-to-day operation.
6. Backup Health (11% of Overall Rating)
Backup health evaluates how confidently you can trust that backups are actually running correctly.
How We Test
Backup Failure Detection: We induce or identify a backup failure, observe how the failure is surfaced in the UI, assess ease of identifying the root cause, and check whether alerts are triggered and how.
Ongoing Admin Monitoring: We review available alert types (real-time vs scheduled), review reporting dashboards, attempt to export reports, and assess usefulness for day-to-day monitoring.
A strong score means you can quickly spot problems, understand what went wrong, and take action before data loss occurs.
7. Governance & Security (9% of Overall Rating)
We validate administrative control, auditability, and security posture in a single combined category.
How We Test
Audit & Compliance Activity: We perform a privileged admin action, locate the corresponding audit log entry, and verify timestamp, user, and action detail. We check audit log retention behavior and test search and export of logs.
Security Posture During Operations: We observe permissions required for restore operations, identify use of MFA or privileged roles, and assess alignment with least-privilege principles.
We also verify certifications such as SOC 2 and ISO 27001 where applicable, assess encryption at rest and in transit, review GDPR support (including right-to-erasure processes), and evaluate data residency options.
8. Commercials (8% of Overall Rating)
We assess how easy a product is to buy, budget for, and support.
How We Test
Cost Modelling & Pricing Reality: We record the per-user pricing model, identify storage limits and pooling behavior, assess impact of versioning on storage consumption, and identify charges for inactive or deleted users.
Vendor Support Interaction: We raise a real support ticket, record time to first response, assess technical quality of the response, and observe follow-up and resolution behavior.
While this category carries less weight than technical capabilities, unclear pricing or poor support can still meaningfully impact overall value.
9. Editor's Score (10% of Overall Rating)
Our editorial judgement of a solution.
How We Test
We provide a fit-for-purpose judgment based on our overall testing experience. We identify strengths vs peers, clearly state who the product is for and who it is not for, and highlight trade-offs that don’t score neatly in other categories.
Final Scoring
Each product’s score is calculated as the sum of all weighted category points, resulting in a total out of 100. This score is then converted into a rating out of 10 for ease of comparison.
Every Microsoft 365 backup solution we review is measured against the same criteria, scenarios, and scoring model, ensuring consistency across our rankings.
The Questions We Ask
When evaluating Microsoft 365 backup solutions, we focus on the following questions:
- How quickly can you get from sign-up to a working backup?
- Does it fully cover core Microsoft 365 workloads?
- How is data retained over time, including for departed users?
- How fast and reliable is recovery in real-world scenarios?
- How resilient is the platform during incidents or ransomware events?
- How transparent and reliable is backup health reporting?
- Are governance and security controls strong and practical?
- Are pricing, licensing, and support clear and reasonable?
- Who is this product for, and who should look elsewhere?
These questions guide both our testing and our editorial judgment.
Summary
Our Microsoft 365 backup ratings are based on a standardized 100-point technical audit. We evaluate every vendor across nine functional categories to determine their ability to protect, manage, and recover M365 data.
Our scoring weights prioritize recovery reliability (18%) and incident readiness (15%), while still accounting for deployment experience, governance, and commercial reality. The framework is designed to reflect real-world buyer decision-making across MSP, SMB, and mid-market environments.
Our testing process involves connecting each tool to a custom test tenant to verify coverage for core apps like Exchange and SharePoint, as well as secondary services including Microsoft Teams and Entra ID. We run timed restore scenarios, test failure detection, and raise real support tickets to assess vendor responsiveness.
Final scores are calculated as a total out of 100 and converted to a rating out of 10. This ensures that every M365 backup solution we review is measured against the exact same technical yardstick.