Practical cyber security guidance
Microsoft 365 backup FAQ for small businesses
Microsoft 365 resilience is not just about whether a copy of data exists. A business needs to know what is protected, how quickly it can be restored, who can alter the backup and whether recovery has actually been tested.
Frequently asked questions
6 practical answers.
### Does Microsoft 365 automatically back up everything forever?
Microsoft 365 provides retention and recovery features, but those features have defined behaviour and limits. Businesses should design recovery around their own retention, restore and continuity requirements rather than assume every item can always be recovered.
### What Microsoft 365 data should be backed up?
The answer depends on the business, but commonly includes Exchange Online mailboxes, SharePoint sites, OneDrive data and other critical cloud content that would affect operations if lost.
### How does backup help with ransomware?
A protected backup can provide a clean recovery point after destructive or encrypted data is identified. The backup system itself should be resilient to deletion or compromise and restores should only be made into known-clean systems.
### Who should be able to delete backups?
Backup administration should be tightly restricted. Privileged actions should use strong authentication and, where possible, the design should prevent one compromised account from immediately destroying every recovery copy.
### How often should restores be tested?
Test restores often enough to prove that important data can be recovered within the time the business expects. Testing should include representative files, mailboxes or wider recovery scenarios rather than relying only on a successful backup status.
### Is retention the same as backup?
No. Retention can be valuable for preserving or recovering content, but a business backup strategy also considers independence, monitoring, privileged access, recovery points and tested restoration.
Related guidance