Operating guide · Microsoft 365

Deciding what Microsoft 365 retention protects and what still needs backup

A recovery requirements and product-assessment plan.

Where things stand

The operating problem

An organisation uses Exchange, OneDrive, SharePoint and Teams but has no approved recovery objectives. Leaders assume Microsoft can restore any item indefinitely, while administrators rely on native recycle features.

A better working position

Each Microsoft 365 workload has approved loss scenarios, recovery objectives, mapped native controls, an explicit backup decision and successful restoration tests using agreed examples.

Gaps to close

  • Replace assumptions with workload-specific evidence
  • Balance recovery, retention, privacy and cost
  • Separate backup administration
  • Test the business outcome

Decisions to settle

  • Recovery time and data-loss objectives
  • Retention and deletion obligations
  • Third-party backup coverage
  • Administrator separation and provider exit
  • How recovery is tested when the usual tenant administrator is unavailable

How to know it is working

  • Objectives are approved per workload
  • Native and third-party controls are documented accurately
  • The chosen restores meet agreed tests
  • Review and test dates are assigned

Working documents

  • Recovery requirements matrix
  • Control and product assessment
  • Restore-test evidence
  • Operating and review schedule

Putting the routine in place

  1. 01

    Scenario workshop

    Define accidental and malicious deletion, ransomware, user departure, legal hold, configuration loss and provider disruption.

  2. 02

    Native-control map

    Document current versioning, recycle, retention, recovery, licensing and administration per workload.

  3. 03

    Gap and option assessment

    Compare historical depth, separation, granularity, export, monitoring, restoration and exit requirements.

  4. 04

    Restore test

    Test selected messages, files, sites, permissions and business use, then schedule the next exercise.

Useful operational references

  1. Microsoft Learn — Learn about retention
  2. Australian Signals Directorate, Australian Cyber Security Centre — Backups
  3. Australian Signals Directorate, Australian Cyber Security Centre — Small business cloud security guides

A practical next step

Plan the work around the real environment.

Share what is not working, what is changing or what decision needs to be made. Technical answers can come after the business context is clear.