Microsoft 365 Backup is a first-party, pay-as-you-go service that protects Exchange Online, SharePoint Online and OneDrive for Business, with restore speeds fast enough to matter in a real outage. It doesn’t cover everything, though. Teams chat history and Power Platform data sit outside its scope, so the real decision for IT leaders isn’t whether to back up Microsoft 365 at all. It’s whether native coverage alone matches your retention, compliance and recovery targets, or whether you need a hybrid setup alongside it.
TL;DR:
- Native Microsoft 365 Backup supports Exchange Online, SharePoint Online, and OneDrive for Business, but does not cover Teams chat or Power Platform data.
- Backup restore speeds can reach up to 2TB per hour, so testing your environment’s performance against this benchmark is crucial for accurate recovery planning.
- Storage costs depend on retention length, snapshot frequency, and workload size, with about $0.15 per GB per month as the standard rate.
- Hybrid backup solutions are recommended when compliance, regulatory, or workload scope gaps exist beyond what native backup offers, especially for Teams and Power Platform.
- Proper testing, policy configuration, and incremental scope management are essential for effective backup and recovery, avoiding costly gaps during real incidents.
Table of Contents
- What is Microsoft 365 backup and what does it actually do?
- Which Microsoft 365 workloads does backup actually cover?
- How fast can you actually restore Microsoft 365 data?
- How much does Microsoft 365 backup cost to run?
- When is native backup enough, and when do you need more?
- How do you get started with Microsoft 365 backup?
- Why native backup alone rarely tells the whole story
- How CTA Systems handles Microsoft 365 backup for growing businesses
- Sources
What is Microsoft 365 backup and what does it actually do?
Native backup exists because Microsoft’s built-in resiliency (geo-redundant storage, versioning, recycle bins) was never designed as a recovery plan. It keeps services running; it doesn’t undo a bad PowerShell script that wiped 40,000 mailboxes or a ransomware payload that encrypted a SharePoint library overnight. Microsoft 365 Backup closes that gap with a dedicated service built on append-only storage, meaning once data lands in a backup snapshot, it can’t be silently overwritten or deleted by malware, admin error, or a disgruntled leaver with elevated permissions.
Access runs through scoped Backup Storage APIs and the Microsoft 365 admin centre, so restores aren’t a support ticket and a four-day wait. According to Microsoft’s own documentation, the service creates backups within the boundaries of the protected workloads themselves, which keeps data residency intact rather than shipping it to a separate storage account you now have to secure and audit independently.
Recovery options break down into three practical tiers:
- Full restores for an entire SharePoint site or OneDrive account after large-scale corruption or accidental deletion
- Granular restores for individual mailboxes or specific items, useful when one user’s data is affected rather than the whole tenant
- File version restores where earlier states of a document are needed without rolling back an entire library
The immutability guarantee is the part most vendors gloss over when pitching third-party alternatives. Because Microsoft controls the storage layer end to end, there’s no separate credential set for an attacker to compromise en route to your backup copy, which is precisely the attack path that has burned organisations relying on loosely configured export jobs to external drives.
Which Microsoft 365 workloads does backup actually cover?
Coverage is deliberately narrow rather than a blanket promise. Exchange Online, SharePoint Online and OneDrive for Business are fully supported for both mailbox email backup and document libraries, and that’s the trio doing most of the heavy lifting for a typical SME’s day-to-day operations.
What’s missing matters just as much:
- Teams chat history is not covered by native backup, only the files shared within Teams (which live in SharePoint/OneDrive and are covered)
- Power Platform assets, including Power Apps, Power Automate flows and Dataverse tables, sit entirely outside the service
- Planner, Stream and Whiteboard content also falls outside scope, which surprises teams who assumed “Microsoft 365 backup” meant everything under that licensing umbrella
Restore points typically generate frequently for recent activity, and Microsoft’s guidance lets administrators configure retention windows configurable by policy depending on needs. That cadence is worth checking against your own tenant configuration rather than assuming a default, because retention settings directly shape both your recovery point objective and your storage bill.
Separately, native SharePoint and Teams recycle bins carry their own retention rules, distinct from the backup service itself. [Microsoft Support’s documentation](https://support.microsoft.com/en-us/sharepoint/admin/restore-items-in-the-recycle-bin-that were-deleted-from-sharepoint-or-teams) on recycle bin behaviour is worth a read if you’re relying on it as an informal safety net between deletion and permanent loss.
How fast can you actually restore Microsoft 365 data?
Speed is where native backup earns its keep. Product engineering notes accompanying general availability point to restore throughput reaching up to 2TB per hour, a figure that turns a multi-day recovery scenario into an afternoon one for organisations with large SharePoint estates.
Restore throughput at scale: Microsoft’s own product announcements cite bulk restore performance of up to 2TB/hour, a number that matters far more than backup frequency once you’re actually in an incident.
That number only means something once you’ve tested it against your own environment. Run a full-site restore on a representative SharePoint library, a mass mailbox restore across a department, and time both from trigger to usable data. Compare that measured figure against whatever recovery time objective sits in your business continuity plan, not the vendor’s headline number.
Pro Tip: Don’t test restore speed with a small pilot site and extrapolate. Throughput on a 5GB test site tells you nothing reliable about a 500GB production library; run the test at a scale close to your actual exposure.
Third-party and ISV applications built directly on Microsoft 365 Backup Storage inherit that same underlying architecture, so a partner tool doesn’t automatically mean slower restores. It means you’re paying for additional workload coverage or features layered on top of infrastructure Microsoft already built.
How much does Microsoft 365 backup cost to run?
Billing runs on a pay-as-you-go, consumption-based model rather than a flat per-user licence fee. Microsoft’s published pricing cites $0.15 per GB per month as the illustrative rate for storage consumed, which means your monthly cost tracks the volume of data actually protected, not your headcount.
A few variables move that number more than most admins expect:
- Retention length directly multiplies storage volume; keeping two years of snapshots costs meaningfully more than three months
- Snapshot frequency and how much changes between restore points affects the incremental data retained
- Workload size, particularly SharePoint document libraries with large media files, tends to dominate the bill more than mailbox data does
The sensible approach is to pilot the service on a representative subset, a handful of SharePoint sites and a sample of mailboxes, and measure actual consumption before rolling out tenant-wide. Scope your retention policy deliberately rather than defaulting to the longest window available; you’ll rarely need two years of granular snapshots for a marketing SharePoint site, even if you do for finance records under a regulatory retention rule.
When is native backup enough, and when do you need more?
Coverage gaps and compliance obligations, not personal preference, should drive this call. Here’s a practical way to work through it:
- Map your actual workloads against native scope. If your organisation runs heavily on Teams chat for decision-making, or leans on Power Automate flows for operational processes, native backup alone leaves real exposure.
- Check your compliance and insurance requirements. Some regulatory frameworks and cyber insurance policies require an independent, immutable copy stored off-tenant. Microsoft’s own best-practices whitepaper acknowledges this directly and points customers toward Azure storage or a recognised ISV solution when that’s a genuine requirement, not just a nice-to-have.
- Match your recovery SLA to what you’ve tested. If leadership expects a four-hour full recovery and your tested restore takes six, that’s a tooling or process gap to close now, not during an actual incident.
- Decide on scope, not wholesale replacement. The common pattern among architects in 2026 is hybrid: native backup handles Exchange, SharePoint and OneDrive, while a narrow third-party tool plugs the Teams chat and Power Platform gap or provides the off-tenant immutable copy compliance demands.
Pro Tip: Resist the urge to buy a full third-party suite “just in case.” The economics of hybrid backup work because the third-party scope stays narrow, covering the two or three specific gaps native backup leaves, rather than duplicating everything Microsoft already does well.
How do you get started with Microsoft 365 backup?
Enable backup policies for your priority workloads first, typically Exchange and SharePoint, then validate that initial backup snapshots are actually completing rather than assuming success from a green tick in the admin centre. Run a test restore before you need one for real; that’s the single most skipped step in backup deployments.
Bring in a partner app or managed service once you need automation, documented runbooks, or 24/7 monitoring beyond what an internal team can sustain alongside its day job.
- Assign clear roles for who triggers restores and who approves them
- Set a recurring test cadence, quarterly at minimum, for restore drills
- Build an incident playbook that names the tool, the person, and the expected timeline before an actual ransomware event forces you to improvise one
Why native backup alone rarely tells the whole story
The industry conversation around Microsoft 365 backup spent years stuck on a false binary: either you trust Microsoft’s built-in resiliency completely, or you buy a full third-party suite and duplicate everything. Neither extreme holds up under scrutiny. Native backup, at the performance and coverage Microsoft now documents, is genuinely competent for the workloads carrying most of an SME’s operational risk. But treating it as a complete answer ignores the Teams chat, Power Platform and off-tenant compliance gaps that show up the moment an auditor or insurer asks pointed questions.
Some organisations discover backup gaps at the worst possible moment, mid-incident, rather than during a calm Tuesday afternoon review. The businesses that benefit most from a hybrid approach tend to be SMEs juggling predictable IT budgets against genuinely unpredictable risk. They don’t need the biggest backup suite on the market; they need someone who’s mapped their specific workload exposure against what native coverage actually protects, and closed the gap methodically rather than expensively.
— Will
How CTA Systems handles Microsoft 365 backup for growing businesses
Some IT support providers assess what an organisation actually runs on Microsoft 365, then build a recovery plan around real exposure, not a vendor’s default template.
That means configuring native Microsoft 365 Backup properly where it covers your workloads, testing restores before you ever need one under pressure, and layering in targeted disaster recovery planning for the Teams and Power Platform gaps that catch most SMEs off guard. Managed IT support can include ongoing monitoring and policy scoping so retention settings and storage costs don’t drift unnoticed month over month.
Getting started can include a discovery call to map a Microsoft 365 estate, a tailored backup and recovery plan built around actual retention and compliance needs, and a pilot to validate restore performance before full rollout. If your current backup posture has never actually been tested with a real restore, that’s the place to start. Get in touch with CTA Systems to arrange a review of your Microsoft 365 backup setup.
