05 — Backup & Recovery

M365 Data Backup

Microsoft does not back up your data the way you think. The native M365 retention policy only covers 30 days — after that, your emails, files and Teams messages are gone forever.

Beyond 30 days

Long-term retention protection

Ransomware

Backups isolated from encryption

Point-in-time

Restore to any date

What's Included

Complete Protection of Your M365 Data

We cover the entire Microsoft 365 ecosystem — emails, files, Teams, SharePoint and groups. Backups are stored outside the reach of any potential ransomware attack on your tenant.

Exchange Online Backup

Emails, calendars, contacts and tasks for all mailboxes including shared mailboxes and resource calendars.

SharePoint Online Backup

SharePoint sites, document libraries, lists, pages and the full content structure including file versions.

OneDrive Backup

Personal storage of all users including synchronised folders and shared files.

Microsoft Teams Backup

Channel and chat messages, uploaded files, meeting recordings and team settings.

Granular Recovery

Restore individual emails, files, folders or entire mailboxes without needing to restore the full environment.

Point-in-time Recovery

Return to any point in backup history — restore the state before an attack, error or deletion.

Ransomware Protection

Backups stored in isolated immutable storage — ransomware encrypting your tenant cannot reach them.

Employee Offboarding Protection

Deleted account data remains accessible in backup — no data loss when an employee leaves or a licence expires.

Encrypted Backup Isolation

Backups encrypted at rest and in transit, stored in a geographically separate environment outside your M365 tenant.

Access Audit Log

Complete log of who, when and what was restored — for compliance audit trails and security investigations.

Recovery Testing

Regular test restores to verify backup consistency and recovery process functionality.

Backup Reports

Automated reports on backup status, user coverage and success rate of backup jobs.

Who It's For

Who Needs M365 Backup

All organisations using Microsoft 365 — regardless of size
Firms with regulatory requirements for long-term data retention (NIS2, DORA, GDPR)
Organisations that have experienced a ransomware attack or fear one
Businesses with high employee turnover and risk of data loss upon departure
Organisations subject to legal or regulatory email archiving obligations
Companies that think Microsoft backs up their data — and are mistaken

Problems We Solve

What Happens Without M365 Backup

Permanent loss of emails and files after the 30-day M365 retention policy expires
Ransomware encrypts the entire tenant including all SharePoint and OneDrive data
Accidental deletion of an important email or project documentation with no recovery option
Employee departure — data becomes inaccessible after licence cancellation
Compliance audit reveals absence of demonstrable backups with tested recovery
Insider threat — deliberate data deletion by an employee before leaving

Regulatory Requirements

M365 Backup as a Regulatory Obligation

Multiple regulations explicitly require demonstrable backup and tested recovery. Microsoft's SLA covers infrastructure availability — not the backup of your data.

NIS2

Backup & System Recovery

Article 21 of NIS2 requires implementation of backup and recovery as part of technical cybersecurity measures for essential and important entities.

DORA

Digital Operational Resilience

DORA for the financial sector requires tested backup and recovery capabilities — including demonstrating the ability to recover after an outage or attack.

ISO 27001

Control A.12.3 — Backup

ISO/IEC 27001:2022 requires regular creation, retention and testing of backups of information, software and systems in line with an agreed backup policy.

M365 Data Backup

Complete Protection of Your M365 Data

Who Needs M365 Backup

What Happens Without M365 Backup

M365 Backup as a Regulatory Obligation

Don't Underestimate the Protection of Your M365 Data