Microsoft 365 Backup Strategies: Guide to Protecting Cloud Data

Microsoft 365 Does Not Back Up Your Data

A common misconception: organizations that purchase a Microsoft 365 subscription assume that their data is backed up by Microsoft. This is not the case. According to Microsoft's Shared Responsibility Model:

• Microsoft's responsibility: Infrastructure availability, service operation
• Customer's responsibility: Data content, data recovery, long-term retention

Microsoft's built-in tools (Deleted Items, Retention Policies) are limited and insufficient for structural recovery.

Built-In Recovery Limitations of Microsoft 365

Backup Solutions

Veeam Backup for Microsoft 365

The most widely used platform for enterprise Microsoft 365 backup:

• Covers Exchange Online, SharePoint Online, OneDrive, and Teams
• Granular recovery: single email, file, site, or full mailbox
• On-premises, cloud, or hybrid storage targets
• Encrypted backup and WORM (immutable) storage support

Licensing: Per user/year (contact Veeam/NRC Sistem for enterprise pricing)

Arcserve SaaS Backup

• Backup of Microsoft 365 + Salesforce + Google Workspace from a single console
• Automatic discovery and coverage
• Unlimited storage (subscription-based)

Acronis Cyber Protect Cloud

• Integrated backup and cyber protection
• Suitable for MSPs and managed service providers

Basic Configuration with Veeam

Installation Requirements

• Windows Server 2016/2019/2022
• SQL Server Express (small environments) or SQL Server Standard
• Minimum 8 GB RAM, 4 CPU cores
• Storage: Average 1–2 GB/year per user (email + SharePoint)

Adding an Organization

Veeam Backup for M365 > Organizations > Add Organization
Kimlik doğrulama: Modern Authentication (OAuth 2.0) önerilir
Uygulama kaydı: Azure AD'de otomatik veya elle oluşturulur

Creating a Backup Policy

Backup Job > New Job
Ad: Daily_M365_Full
Kapsam: Tüm kullanıcılar (veya belirli gruplar)
Zamanlama: Her gece 02:00
Saklama süresi: 1 yıl
Depolama: Yerel NAS veya Azure Blob Storage
Şifreleme: AES-256 (önerilir)

Long-Term Retention and Legal Compliance

In certain sectors (finance, healthcare, public sector), retaining emails and documents for 5–10 years is a legal requirement:

• Microsoft Purview — Retention Policies: Rule-based retention within Microsoft 365; however, this is not a backup function — it only prevents deletion.
• Independent archiving solutions: Mimecast, Barracuda, or standalone archiving platforms provide a more reliable archive for legal compliance.
• Veeam long-term retention: Retention of 7+ years can be configured with annual archive points.

Exchange Online Recovery Scenarios

Granular Email Recovery (Veeam)

Explore > Exchange > Posta kutusu seç
Öğe ara (konu, gönderici, tarih aralığı)
Sağ tık > Restore to Original Location
veya: Export to PST

Bulk Deletion Recovery

In the event of a phishing attack or an accidental bulk deletion:

1. Select the affected user in Veeam
2. Locate the recovery point prior to the deletion date
3. Use Compare to see what was lost
4. Restore selected items or the entire mailbox

SharePoint and OneDrive Recovery

• With Veeam, recovery is possible at the SharePoint site collection, list, library, or individual file level.
• Site collection recovery: 3–5 minutes
• Granular file recovery: Within seconds
• Options to copy to the original location, an alternate site, or a local disk are available.

Backup Testing Schedule

Conclusion

Protecting Microsoft 365 data is an integral part of any enterprise data security strategy. The misconception that "data in the cloud is safe" can set the stage for serious data loss. An independent backup solution such as Veeam complements Microsoft 365's built-in tools with respect to granular recovery, long-term retention, and ransomware protection. As NRC Sistem, we provide end-to-end services for the licensing, installation, and management of Microsoft 365 backup solutions.