The short answer

Microsoft operates highly resilient cloud infrastructure, but businesses still need to decide how they would recover information after accidental deletion, malicious deletion, ransomware, compromised accounts or other incidents.

The important question is not:

"Does Microsoft back up its systems?"

It is:

"Can our business restore the information we need, from the point in time we need, within the time we can tolerate?"

Cloud storage and backup are not exactly the same thing

Microsoft 365 contains useful retention, recovery and versioning features.

These features can help with many everyday problems.

A dedicated backup strategy, however, is designed around independent recovery requirements.

The distinction becomes important when a business has specific retention, legal, compliance or recovery requirements.

What Microsoft 365 data matters?

Common business information includes:

• Exchange Online email
• OneDrive files
• SharePoint documents
• Teams-related information
• shared mailboxes

For many businesses, this information represents years of operational history.

What could go wrong?

Accidental deletion

An employee removes important files and the problem is discovered much later.

Malicious deletion

A compromised or disgruntled account deliberately deletes information.

Ransomware or file corruption

Synchronised files may become encrypted or damaged.

Incorrect permissions

Data may be altered or removed by people who should not have had access.

Retention misunderstanding

A business assumes information can be recovered indefinitely when its actual retention configuration says otherwise.

How frequently should data be backed up?

That depends on how much work the business could afford to lose.

If losing one day of data would create major problems, the recovery strategy should reflect that.

This is often described using a Recovery Point Objective, or RPO.

The business should also consider how quickly it needs systems restored, known as the Recovery Time Objective, or RTO.

You do not need to use the technical terms in day-to-day business discussions.

Simply ask:

How much data could we afford to lose, and how long could we operate without it?

A backup is only useful if it can be restored

Backup monitoring matters.

So does testing.

A green "backup successful" message does not automatically prove the organisation can recover everything required during a real incident.

Should backups be separate?

One reason organisations use dedicated backup platforms is to create an additional recovery layer that is not dependent on the normal production environment.

Exactly how this should be implemented depends on the organisation's risk and requirements.

What should you ask your IT provider?

Ask:

• What exactly is backed up?
• How often?
• How long is it retained?
• Where is the backup stored?
• Can an administrator delete the backups?
• How would one mailbox be restored?
• How would an entire SharePoint library be restored?
• Have restores been tested?

If those questions cannot be answered clearly, it is worth reviewing the backup strategy.

ITS Canberra can review Microsoft 365 retention and backup requirements and recommend an approach based on how the business actually uses its information.