Export and retrieval: the backup as a file

Not every restore leads back into Microsoft 365. Often the file is the better route: after a ransomware incident, for disclosure to third parties, or where Microsoft offers no way back for that source type.

Export requires no consent to write back. It is always available.

How it works

1. In the guide, choose as a file as the target.
2. Set the recipients. Without an entry, the notification goes to the owners and administrators of the account.
3. Wait. Depending on volume, creation takes minutes to hours.
4. The completion notice contains a button for retrieval.

The retrieval link

The link is valid for exactly one sign-in address: the one the notification went to. A forwarded mail is of no use to anyone, and as a result the audit log records not only that the file was collected, but by whom.

Retrieval remains available for seven days. After that the link no longer leads anywhere; a new export can be requested at any time.

If the link leads nowhere, the page says why: incomplete or withdrawn, expired, or issued to a different sign-in address.

Opening the archive

The file is encrypted with AES-256. It opens with 7-Zip, WinZip, WinRAR or PeaZip. The archive tool built into Windows and macOS does not support this method and will either report an error or keep asking for the password.

The password is not in the mail but on the page behind the button, that is, only after signing in. Intercepting the mail therefore yields nothing.

Exports created before 23 August 2026 carry no password.

What the audit log records

Every retrieval is logged, with the time and the person retrieving. The page itself shows you when the file was last collected — a second retrieval you did not initiate is therefore visible.