Yes, most Canadian businesses should have a Microsoft 365 backup plan. Microsoft keeps the service running and replicates your data across its infrastructure, but that is availability, not recovery. When a user deletes the wrong folder, an attacker encrypts a SharePoint library or an employee wipes a mailbox on the way out, the question is not whether Microsoft’s data centres are up. The question is whether you can return to a known-good state within hours, with permissions and metadata intact. That depends on what you have set up on your side of the shared responsibility line.
This guide explains what Microsoft does and does not protect, which workloads are at risk, what native and independent options cost, and how to decide in a Toronto or wider Canadian small business.
TL;DR
- Microsoft 365 is built to keep the service available. Recycle bins, version history and retention are conveniences, not a tested, point-in-time recovery plan for ransomware or malicious deletion.
- Microsoft’s own guidance points to customer-side incidents such as ransomware, accidental deletion and malicious deletion as the reason to add a backup solution.
- Microsoft’s native backup covers SharePoint, OneDrive and Exchange Online mailboxes only. Teams conversations, Planner, Forms, Power Platform data and endpoints need separate verification.
- A backup you have never restored from is an assumption. Document recovery objectives and run restore tests on a schedule.
- Regulated practices (healthcare, accounting, legal, real estate) should treat this as a risk decision tied to retention obligations, not a luxury.
Table of Contents
- What Microsoft actually protects
- Five situations where the gap shows up
- What native Microsoft 365 Backup covers
- Native backup or an independent product?
- What a real backup plan includes
- Who should not skip it
- Our perspective
- How we can help
- FAQ
- Sources
What Microsoft actually protects
Microsoft 365 has real resilience built in. Data is replicated, there are recycle bins, versioning and retention features, and the platform has its own disaster recovery. These controls answer one problem: a Microsoft data centre fails and the service must stay up.
They do not answer a different problem: your data is changed or destroyed by someone with legitimate credentials, or by malware running as that person. The Microsoft 365 Backup FAQ draws this line itself. A disaster recovery copy holds the current state of content, not historical versions from earlier points in time. If a ransomware process encrypts your files and the encrypted versions sync, the “current state” is the damaged one.
The recycle bin window is shorter than most people think
Take SharePoint. According to Microsoft’s data deletion documentation, a deleted item stays in the site Recycle Bin for 93 days from deletion, and deleted site collections are retained for 93 days before permanent removal. That is helpful for a staff member who deleted a file last week. It does little for a file that was quietly corrupted four months ago, or for a deliberate purge of the second-stage bin by someone with admin rights.
Version history helps with single files too, but Microsoft’s best-practices paper makes the scale point: recovery after a large-scale incident is a different problem from restoring one document. Its whitepaper on recovery and business continuity frames evaluation around restore speed and scale, not just whether copies exist. We cover the OneDrive side of this in our guide to OneDrive ransomware protection and the 30-day restore window.
Legal holds are not backups
A common shortcut is to place mailboxes on litigation hold and call it a backup. Microsoft warns that legal holds are optimized for eDiscovery and export, not for mass restore. A hold preserves content for a legal purpose. It does not give you a clean, time-stamped restore of a whole tenant on a bad Monday morning.
Five situations where the gap shows up
The risks are specific. These are the ones we see small and mid-sized organizations underestimate.
- Ransomware that reaches synced cloud files. Endpoints sync to OneDrive and SharePoint. When the endpoint is encrypted, the sync client can carry the damage upward. You need a point-in-time state from before the incident.
- Malicious or careless deletion. A departing employee, a compromised account or an administrator running the wrong script can remove data faster than a recycle bin policy anticipates.
- Retention obligations longer than native recovery windows. If a contract, professional body or regulator requires you to keep records for years, relying on default deletion behaviour is a gamble.
- Destructive overwrites. Bulk edits, bad automation or a migration error can replace good content with bad, and version history may not scale to thousands of files.
- Business-critical concentration. One shared mailbox that holds every client request, or one SharePoint library holding every matter file, makes a small loss a large problem.
The common thread is that none of these are Microsoft outages. They are the customer-side incidents Microsoft’s guidance tells you to plan for.
What native Microsoft 365 Backup covers
Microsoft now sells its own backup product, and for many businesses it is a legitimate starting point. Per the Microsoft 365 Backup FAQ, it protects SharePoint sites, OneDrive accounts and Exchange Online user or shared mailboxes. It supports full site or account recovery, and Exchange supports searching and restoring individual mail, calendar, contact and task items. If you are asking about backing up Office 365 emails specifically, Exchange Online mailboxes are in scope.
What it does not automatically cover
Scope is the most common surprise. Verify coverage separately for:
- Teams conversations and channel content
- Planner and Forms
- Power Platform data (Power Apps, Power Automate flows)
- Endpoints, laptops and on-premises servers
- Azure workloads
- Third-party SaaS applications connected to your tenant
Microsoft states on its product page that granular file-level restore for SharePoint and OneDrive is still being rolled out, so check the current status before you rely on it for single-file recovery.
It is a separate paid product
Native backup is not bundled into every subscription. It is a pay-as-you-go product that needs an Azure subscription and a SharePoint or Exchange Online license. Microsoft’s pricing model page lists $0.15 per GB per month of protected content, and notes that deleted content is retained and billed for a year. Confirm current Canadian currency, tax and consumption billing before you budget, because list prices in US dollars are not what lands on your invoice.
A quick illustration of scale, using the list price only: 500 GB of protected SharePoint, OneDrive and mailbox content at $0.15 per GB per month is $75 per month before tax and any exchange rate. A 5 TB tenant would be $750 per month. The figure grows with your data and with deleted content you keep for retention, so model it with Microsoft’s calculator rather than guessing.
Setup is administrator work
End users cannot turn on tenant backup. An authorized administrator enables pay-as-you-go billing in the Microsoft 365 admin center, selects Microsoft 365 Backup, and creates policies for OneDrive, SharePoint or Exchange. Microsoft’s setup guide says policy activation can take up to 60 minutes to process and another 60 minutes to create restore points. Initial protection takes about 15 minutes per 1,000 protection units.
To back up SharePoint, a SharePoint or Global Administrator creates a policy, chooses all or selected sites and activates it. Restoration can then return a site to an earlier point in time.
Native backup or an independent product?
This is where the “Veeam versus AvePoint” and “SkyKick versus AvePoint” style questions come from. We will not rank individual vendors here, because the right choice depends on your data and obligations rather than on a brand. The criteria below decide it.
| Criterion | Native Microsoft 365 Backup | Independent third-party backup |
|---|---|---|
| Workload coverage | SharePoint, OneDrive, Exchange Online | Varies widely. Some add Teams, Planner, Groups and more |
| Restore speed at scale | Designed for fast, large-scale restore within the Microsoft platform | Depends on architecture. Copying large datasets from a remote repository can be slower |
| Separation from your tenant | Lives in Microsoft’s environment | Often stored outside the tenant, which can limit the blast radius of a compromised admin account |
| Retention flexibility | Per Microsoft’s policy model | Often configurable by workload, with long-term options |
| Data location controls | Check Canadian residency terms | Check where the provider stores copies |
| Immutability and audit trail | Confirm in current documentation | Ask for proof, not marketing language |
| Cost model | Pay-as-you-go per GB | Usually per user per month |
Microsoft itself says the practical approach is risk-based: protect the workloads whose loss would threaten patient care, accounting deadlines, transactions or legal obligations, define recovery objectives, then choose native backup or a recognized partner product whose retention, geographic controls, immutability, auditability and coverage meet those objectives. We agree with that framing. If you want a neutral way to think about comparing tools, this comparison of backup products, written for a different platform, shows the kind of coverage and recovery questions worth asking of any vendor.
What a real backup plan includes
A second copy is not a plan. The Australian Cyber Security Centre’s technical example on regular backups is a useful reference for small businesses. It notes that many third-party backup solutions request Global Administrator privileges, which is exactly why access to the backup must be controlled. The principles behind it apply in Canada too:
- Cover everything needed to resume operations: data, software and configuration settings, not just mailboxes.
- Restrict who can touch the backup. If one compromised administrator account can delete both the tenant and its backup, you have one copy with extra steps.
- Test restores regularly. Pick a mailbox, a document library, a full site, and confirm permissions and metadata come back correctly.
- Define recovery objectives. Decide how much data you can afford to lose (recovery point) and how long you can be down (recovery time) before you shop for a product.
Our own view on immutability and the classic copy rules is in two companion pieces: immutable backups and ransomware and upgrading the 3-2-1 rule to 3-2-1-1-0.
A simple decision test
Answer these four questions for each workload:
- Would losing it stop revenue, patient care or a filing deadline?
- Are we required to keep it longer than the native recovery window?
- Could a single compromised admin account delete it permanently?
- Have we ever restored it end to end, and how long did it take?
If the answer to any of the first three is yes, or the fourth is “never”, you need a backup for that workload. For most businesses with shared mailboxes, client files in SharePoint or OneDrive, and any regulatory exposure, that means all three core workloads.
Who should not skip it
Healthcare administrators. Patient correspondence and scheduling often live in shared mailboxes and document libraries. Downtime affects care, and records have retention rules. If you handle health information, confirm with your privacy officer and legal counsel which Canadian provincial rules apply to where backups are stored and how long they are kept.
Accounting firms. Tax deadlines do not move because a library was encrypted. Client working papers in SharePoint and OneDrive deserve point-in-time recovery and long retention.
Real estate agencies. Transaction documents, signed forms and email threads are the business. One lost mailbox can be one lost deal.
Startups. You may feel too small to be a target, but a small tenant with one founder holding all admin rights is a single point of failure. Backup is cheap relative to rebuilding.
Our perspective
We run managed IT with a cybersecurity-first approach, and the most common conversation we have after an incident is the same: the client assumed Microsoft backed everything up. Microsoft does protect the platform. It does not take responsibility for your recovery objectives, and its own documentation says as much.
We do not recommend duplicating everything blindly. We recommend starting with the workloads that would hurt most to lose, writing down how fast you need them back, choosing native Microsoft 365 Backup or an independent product that meets those objectives, and then proving it with a restore test. Backup and security belong together: protected admin accounts, endpoint protection and monitoring reduce the odds you will ever need the restore, and a tested backup limits the damage when prevention fails.
For teams already on Microsoft 365, we manage tenant configuration, security and recovery together through our Microsoft 365 support in Canada, so the backup is not a separate project nobody owns.
— 247techify Team
How we can help
If you want backup designed around your actual recovery objectives, our automated cloud backup and disaster recovery service covers Microsoft 365 data and the systems around it, with 24/7 support and an under-30-minute average response time. If you want it bundled with security monitoring and helpdesk, our managed IT plans for businesses are published at 1099-2499 CAD per month on the GTA managed IT price index. Backup pricing depends on your data volume and retention, so we scope it with you rather than quoting a flat figure.
FAQ
Does Microsoft 365 back up my data?
Microsoft replicates data and provides recycle bins, versioning and retention so the service stays available. That is not the same as a customer-controlled, point-in-time backup. Microsoft also offers a separate paid Microsoft 365 Backup product for SharePoint, OneDrive and Exchange.
How do I back up SharePoint?
A SharePoint or Global Administrator creates a Microsoft 365 Backup policy in the admin center, chooses all or selected sites and activates it. Microsoft says processing and restore-point creation can take up to two hours in total. After that, a site can be restored to an earlier point in time.
Can I back up Office 365 emails without backing up everything else?
Yes. Exchange Online user and shared mailboxes can be protected on their own, and Exchange supports restoring individual mail, calendar, contact and task items. Most businesses still do better protecting mailboxes, OneDrive and SharePoint together, because incidents rarely respect workload boundaries.
Is a legal hold or retention policy enough?
No. Holds and retention preserve content for compliance and eDiscovery, and Microsoft notes they are not designed for mass restore. They complement a backup. They do not replace one.
Sources
- Overview of Microsoft 365 Backup, Microsoft Learn
- Frequently asked questions about Microsoft 365 Backup, Microsoft Learn
- Set up Microsoft 365 Backup, Microsoft Learn
- Pricing model for Microsoft 365 Backup, Microsoft Learn
- Microsoft 365 Backup product page
- Microsoft 365 Backup best practices whitepaper
- SharePoint data deletion in Microsoft 365, Microsoft Learn