The operating principle
Protection coverage and successful restoration are two separate controls
Inventory what is covered, identify exclusions, then perform an authorised sample restore. Only the observed restore outcome demonstrates recoverability for that workload.
Inventory business-critical data across workloads
Start with the Exchange mailboxes, executive and shared mail, OneDrive owners, SharePoint sites and Teams-linked libraries that matter to day-to-day operations. Confirm the owner, business criticality, retention expectation, recovery point objective and recovery time expectation for each. Teams chat data and third-party SaaS content may need different treatment and should not silently be assumed covered by one Microsoft 365 Backup policy.
Check whether users leaving the organisation have orphaned OneDrive content or departed site owners. A recovery plan must state what happens to the business files that outlive their creator. Revisit protection after mergers, new sites or major permission changes.
| Protected asset | Recovery question | Operational evidence |
|---|---|---|
| Exchange mailbox | Which people and date ranges need recovery? | In-scope mailbox policy and sample restore |
| OneDrive account | Does the business own critical files? | Owner mapping and restored selected content |
| SharePoint site | Can an essential team library recover? | Protected site inventory and restoration record |
| Teams/other apps | Is this covered by this product? | Written exclusions and separate control plan |
Understand licensing and administrative responsibilities
Microsoft 365 Backup's setup includes pay-as-you-go billing and protected workload selection. Confirm the tenant has the right permissions, account billing controls, subscriptions and budget owner before enabling a policy. Microsoft recommends least privilege; use specialist administrator roles where they meet the task instead of persistent unrestricted global access.
Record who may add or remove protection units, change billing, begin a restore and receive alerts. Configure multi-administrator notifications where appropriate so harmful configuration changes do not go unnoticed. A provider's recurring admin fee should distinguish configuration and restoration labour from Microsoft charges.
Documented administration controls
- Budget owner approves subscription and billing model
- Current Microsoft 365 Backup scope verified
- Named administrator and recovery approver
- Protection and restore alerts configured appropriately
- Separate customer billing from provider service cost
Run a restore drill with evidence
Choose a low-risk representative document or mailbox item and record the current state, expected restoration point and the name of the authorised tester. After the restore completes, have the data owner open the content, verify integrity and confirm access permissions. Log elapsed time and any limitation, but do not extrapolate one small drill into a guaranteed enterprise recovery time.
Write a runbook for requesting a restore, preserving evidence, obtaining approvals and reviewing the final result. When a real incident occurs, data owners should not need to improvise the location of critical records or the person who can approve a recovery operation.
Make backup an ongoing governance obligation
Include monthly checks for new sites or users, protection policy changes, alert delivery, privileged administrator actions and a sample of confirmed restore results. Clarify whether every business-critical data store is covered or whether third-party backup is also required. Restore tests belong in the service scope, not merely a dashboard screenshot.
Retain a customer-controlled exit plan for the backup service and its billing. The client should understand what happens when provider access is removed and which protections or repositories may cease. Any deletion or retention change needs a customer instruction.
Documented administration controls
- Protected units reconciled with estate inventory
- Alerts reviewed by named owners
- Representative recoveries tested and signed off
- New users and sites added through change control
- Exit and contractual boundaries documented
Backup maturity means the organisation can show what it protects, who can restore it, and whether a real test worked. Feature names alone provide none of that assurance.
Primary technical references
Check current feature and licence requirements before changing a tenant. A service description is not evidence that a customer has purchased or activated an option.
Commercial next step
Request a Microsoft 365 recovery-readiness review
Describe the critical mailboxes, OneDrive and SharePoint content, retention needs and current backup arrangement. We can define the coverage and evidence needed for a scoped review.
Request an administration assessment