Microsoft 365 Backup for Small Businesses: Check All 3 Workloads
See what Microsoft 365 Backup protects across SharePoint, OneDrive and Exchange, what it misses, and the setup and restore checks small businesses need.
For SharePoint, OneDrive and Exchange, Microsoft 365 Backup is the native pay-as-you-go route to recovering lost or corrupted data, and it’s a solid starting point for most small businesses. If you don’t have dedicated IT support, we’d recommend getting hands-on help with setup, billing and restore testing so the backup actually works when you need it, not just when you check the dashboard. Pricing is based on consumption per GB, and restores can use an express, point-in-time recovery option.
TL;DR:
- Coverage includes SharePoint, OneDrive, and Exchange Online, but Power Platform data is excluded; verify Teams dependencies through those workloads and check hybrid exceptions.
- Charges depend on protected data, including retained deleted and versioned content; estimate workload sizes and growth before enabling billing.
- Windows are 3 months, 6 months, 1 year, or 2 years; shortening one deletes earlier recovery points after a grace period of 30 days.
- Only tenant administrators can restore data, so assign the dedicated Microsoft 365 Backup Administrator role, enforce MFA, and test a restore in a new location.
- Microsoft’s backups remain within its service boundaries, so choose separately managed storage if your recovery plan requires an independent copy.
Table of Contents
- What Microsoft 365 Backup covers and when you’d use it
- What it protects, and what needs separate attention
- How restores actually work in practice
- Pricing and how to estimate your likely spend
- Policy design, recovery windows and scale limits to know
- Administration, access control and proving it works
- Choosing between native only, managed support, or both
- A practical checklist for a first backup engagement
- Setting up Microsoft 365 Backup with hands-on support
- FAQ
- Sources
What Microsoft 365 Backup covers and when you’d use it
Microsoft 365 Backup is Microsoft’s own pay-as-you-go backup service for SharePoint, OneDrive and Exchange Online. It creates recovery points that sit inside Microsoft’s own service boundaries, aimed at getting you back to a known-good state after accidental deletion, malicious overwrite, or a ransomware event, according to Microsoft’s overview.
It’s worth separating two ideas that often get blurred together: Microsoft’s service resiliency keeps Microsoft 365 running day to day, while backup is what lets you roll specific content back to an earlier point after something goes wrong. One doesn’t substitute for the other.
Before relying on it as your main safety net, check a few things:
- Confirm which of your workloads (SharePoint, OneDrive, Exchange) actually need protecting and at what scale.
- Check whether your current retention or compliance settings already cover some of your recovery needs.
- Decide whether you need data kept outside Microsoft’s own environment, since this service keeps everything within it.
It’s a strong fit for straightforward recovery scenarios. It’s not designed as a universal archive or a replacement for device-level backup.
What it protects, and what needs separate attention
Microsoft explicitly supports three workloads: SharePoint sites, OneDrive accounts and Exchange Online mailboxes, as confirmed in the overview documentation. Teams content isn’t a separate protected category: it lives across SharePoint, OneDrive and Exchange, so you need to check coverage through those underlying workloads rather than assume Teams itself is backed up.
Several items sit outside native coverage or need special handling:
- Power Platform data (Power Apps, Power Automate flows) isn’t covered.
- Hybrid Exchange deployments are not supported. Check Microsoft’s current workload and site limitations before designing protection.
- User and shared mailboxes are supported; group and room mailboxes are not supported by Microsoft 365 Backup.
Pro Tip: Build a simple inventory, listing every mailbox, archive, SharePoint site and Teams dependency, before you assume anything is protected.
How restores actually work in practice
An authorised administrator chooses the workload, restore point and recovery destination. SharePoint and OneDrive offer recommended express restore points; Exchange uses a different restore workflow. Review Microsoft’s workload-specific restore guidance before proceeding. The process is point-in-time recovery, so identifying the last known clean moment before an incident matters more than the restore button itself.
A few practical choices shape the outcome:
- Same-URL restore overwrites existing content at its original location.
- New-URL restore creates a separate copy, avoiding overwrite but requiring you to reconcile two versions afterwards.
- Restore point selection should reflect when the problem actually started, not just the most recent snapshot.
Only tenant-level administrators can perform restores; individual users cannot restore their own mailbox or files. Recovery granularity and item limits for larger restores (such as Exchange searches) are documented in Microsoft’s release notes, so check current limits if you’re planning a large-scale recovery.
Pricing and how to estimate your likely spend
Microsoft 365 Backup charges on a consumption basis. Check Microsoft’s current billing guidance and agree the software and service costs before activation. That billable figure isn’t just your live mailbox or site size: deleted and versioned items retained inside backups count too, including second-stage recycle bin content and online archives.
To get a realistic estimate before committing:
- Pull current mailbox, OneDrive and SharePoint site sizes from the admin centre reports or via PowerShell.
- Use Microsoft’s pricing calculator with those figures rather than guessing.
- Factor in growth, since deleted items sitting in backup still count toward your monthly total.
Billing runs through an Azure subscription, with departmental billing options available for larger organisations, as covered in the setup documentation. For a small business, that usually means one Azure subscription tied to a card or invoice, not a complicated billing structure.
Policy design, recovery windows and scale limits to know
Every backup policy has a recovery window, which determines how far back you can restore from. You can choose a recovery window of 3 months, 6 months, 1 year or 2 years, per Microsoft’s release notes.
Shortening a recovery window is a destructive change: older recovery points outside the new window get deleted, though Microsoft applies a 30-day grace period before that happens, giving you a short buffer to reconsider.
Scale limits worth knowing before you design policies:
- Up to 1,000,000 items per workload are supported, according to Microsoft’s documentation.
- Up to 100 policies per workload and 100,000 items per policy apply, per the same release notes.
- Organisations needing higher scale should contact Microsoft directly, since these limits can change.
Full Workload Backup, with exclusions, is available in preview and lets you back up an entire workload while excluding specific items.
Pro Tip: Use separate policies where retention needs genuinely differ, rather than one blanket policy stretched to cover everything.
Administration, access control and proving it works
Only tenant-level administrators can manage Microsoft 365 Backup and perform restores. Microsoft documents a dedicated Microsoft 365 Backup Administrator role specifically so you’re not forced to hand out Global Administrator rights just to manage backups, as noted in the setup guidance.
A sound operational routine includes:
- Enforcing multi-factor authentication on every administrator account with backup or restore access.
- Limiting who holds Global Administrator rights, and reviewing that list periodically.
- Keeping a written record of exactly who is permitted to initiate a restore.
A backup that’s never been tested is a guess, not a safety net. Ireland’s Data Protection Commission advises storing backups securely in a separate location, testing them periodically, documenting arrangements, and keeping backup data under security controls equivalent to live data.
Use a small, agreed test containing known modified or deleted content. For Exchange, test restoration into a new folder within the mailbox; for SharePoint or OneDrive, choose the supported recovery option for the scenario. Confirm the recovered content and record the outcome and time taken.
Choosing between native only, managed support, or both
The right choice depends on a handful of practical factors: how much data you’re protecting, how long you need to retain it, whether you need storage independent of Microsoft’s own environment, and whether anyone in-house has the time and confidence to run a restore under pressure.
Separate the storage choice from the support arrangement. Having an IT provider manage Microsoft 365 Backup does not move its data outside Microsoft’s service boundary. An independent copy requires a backup solution and storage arrangement that actually provides one.
For many sole traders and small businesses without dedicated IT staff, the practical answer is both: native Microsoft 365 Backup for the recovery mechanism, paired with a managed engagement that handles:
- Inventorying mailboxes, sites and accounts before policies are created.
- Setting up policies with sensible recovery windows and linking billing correctly.
- Hardening admin access and running a scheduled restore test with a written playbook.
A practical checklist for a first backup engagement
A practical setup plan starts with an inventory, agreed recovery needs, appropriate policies, authorised billing and a documented restore test. Agree the deliverables and responsibilities before work begins; this checklist is guidance, not a claim about a completed customer deployment.
Based in Tuam, County Galway, hostme.ie can help review backup requirements and scope setup or recovery-testing work. Confirm remote or onsite delivery, software charges and the agreed work before starting.
— hostme.ie
Setting up Microsoft 365 Backup with hands-on support
If you’d rather not be the one piecing together policies, billing and restore tests before a deadline, that’s exactly the kind of work we handle under Backup & recovery. We also cover the surrounding pieces, Microsoft 365 support, general IT support, and restore testing, so the backup isn’t just switched on but actually proven to work.
Relevant services for this:
- Backup policy design, billing setup and inventory for SharePoint, OneDrive and Exchange.
- Admin account hardening and least-privilege access review.
- Scheduled restore tests with a written recovery playbook.
The simplest next step is a message on WhatsApp describing what you’re trying to protect; phone and email work too as alternatives. Managed support runs on an initial 12-month term, and we always agree scope and cost with you before any work begins.
FAQ
Does Microsoft 365 have built-in backup?
Microsoft 365 includes native pay-as-you-go backup for SharePoint, OneDrive and Exchange Online, separate from the retention and recycle bin features built into everyday use. It’s not switched on automatically and needs policies configured before it protects anything.
How do I backup Microsoft 365?
You enable Microsoft 365 Backup through the admin centre, assign a dedicated Backup Administrator role, then create policies that set a recovery window for each workload you want covered. Billing links to an Azure subscription, and charges apply per GB of protected content once policies are active.
Is Microsoft 365 backup free?
No. Microsoft 365 Backup is a separately billed consumption service. Confirm current charges and the amount of protected data, including retained deleted and versioned content, before activation. Basic retention and recycle bin settings included with Microsoft 365 licensing are separate and don’t offer the same restore flexibility.
What is the best backup for Microsoft 365?
The right choice depends on supported workloads, recovery needs, retention, administration and storage location. Microsoft 365 Backup can cover supported Microsoft workloads. Managed assistance does not itself create an independent copy; confirm that separately when evaluating another backup solution.
