365 Backup: back up and restore Microsoft 365

Microsoft runs Microsoft 365 with high availability, but it does not back up your content for you. A deleted mailbox is gone after thirty days, an overwritten document once the version limit is reached, a deleted team once the recycle bin retention expires. None of that helps against a ransomware incident, a mistaken bulk deletion, or a person leaving. That is what 365 Backup is for.

What gets backed up

Nine source types, each selectable on its own:

• Mailbox and archive mailbox, including folder structure and attachments
• Group mailbox with conversations and the group calendar
• OneDrive and SharePoint lists with files and metadata
• Microsoft Teams with channels and channel messages
• Teams chat with history and attachments
• Planner with plans, tasks and assignments
• Microsoft Entra ID as a directory extract with users and groups

What is discovered in your tenant is not yet backed up. A source is backed up only once it has been selected under Users or Groups. See What gets backed up.

Per-protection-unit encryption

Every protection unit carries its own key. A mailbox, a OneDrive, a team are each a separate unit with a separate key, and that key is not held by the storage provider. Anyone holding the storage would still hold not a single readable item.

This has a consequence you should know about: deletion on request is carried out per protection unit, not per person. In a Microsoft 365 backup, information about a person does not reside in that person's own unit but is distributed across the mailboxes, channels and documents of their correspondents. See Legal holds and deletion.

Restore and export

Two ways lead back out of a backup:

Back into Microsoft 365. Items are written into the original or another target. This requires its own consent, separate from the backup, and depending on your settings a four-eyes approval.

As a file. An encrypted ZIP archive of the items, retrieved through a link valid for exactly one sign-in address. This route is always available, even without consent to write back.

See Restoring and Export and retrieval.

Operated in the EU

By default the backups are held in the object storage of Impossible Cloud GmbH in Frankfurt am Main, that is, demonstrably in Germany. For heightened data sovereignty requirements a tenant can be switched to the object storage of STACKIT GmbH & Co. KG in region eu01 (Germany); STACKIT is certified to C5 Type 2. Customers who provide their own S3-compatible storage target can have the backups written there.

Both providers are named in Annex 1 to the Data Processing Agreement.

Getting started

An administrator of the Microsoft tenant grants consent, after which you select what should be backed up. Continue with Setup.