Article · Backup and recovery
Backup best practices for businesses that cannot afford to lose data
A backup only matters on the day you need to restore from it. This guide covers how to structure copies so ransomware and mistakes cannot destroy them, what Microsoft 365 does and does not protect, and how to prove your backups work.
- Published
- 7 min read
On this page
Key takeaways
- Follow the 3-2-1-1-0 rule: three copies, two media types, one offsite, one offline or immutable, and zero errors on verified restores.
- Immutable or air-gapped copies are what protect you when ransomware operators deliberately target backups.
- Microsoft 365 keeps the service running, but protecting your data against deletion, compromise and long-term loss is largely your responsibility.
- Protect the backup system itself with separate credentials, MFA and restricted access.
- Test restores on a schedule and record how long they take, because a successful backup job is not the same as a successful recovery.
The 3-2-1-1-0 rule explained
The original 3-2-1 rule has been extended to reflect ransomware, which now commonly seeks out and deletes backups before encrypting production systems.
3 copies of your data
The production data plus at least two backup copies, so a single failure never leaves you with nothing.
2 different media or platforms
For example, a local backup appliance and a cloud storage service, so a fault in one technology does not affect both.
1 copy offsite
Stored in a different location from your office, protecting against fire, flood, theft or a regional outage.
1 copy offline or immutable
A copy that cannot be modified or deleted for a defined period, even by an administrator account, or that is physically disconnected.
0 errors after verification
Backups are monitored, failures are investigated, and restores are tested so you know the data is recoverable.
Immutability and protecting the backup system
Immutable storage uses write-once, read-many controls, such as object lock on cloud storage or hardened Linux repositories, so that backup data cannot be changed or deleted until a retention period ends. If an attacker gains administrator access to your network, they can still see the backups but cannot destroy them. Choose a retention period long enough to cover the time an intrusion might go unnoticed before it is discovered.
The backup platform is a high-value target, so treat it accordingly. Use dedicated backup administrator accounts that are not members of your everyday domain or Microsoft 365 admin groups. Require MFA on the backup console and the cloud storage account. Restrict network access to backup servers. Turn on alerts for changes to retention settings, deleted jobs and failed logins. Store the information needed to rebuild the backup system, including encryption keys and recovery codes, somewhere that does not depend on the systems being backed up.
Encrypt backups in transit and at rest, and manage the encryption keys deliberately. A backup encrypted with a key that was stored only on the server that failed is not recoverable.
Microsoft 365 and the shared responsibility model
Microsoft operates a resilient service, replicating data across its data centres and recovering from infrastructure failures. Under its shared responsibility model, however, you remain responsible for your data, identities and access. If a user deletes a SharePoint library, a compromised account encrypts OneDrive files, a departing employee’s mailbox is removed, or a sync error overwrites documents, Microsoft’s infrastructure resilience does not undo it.
Built-in features help: recycle bins, deleted item recovery, file version history and retention policies. They are valuable, but they have time limits and configuration dependencies, they are managed with the same admin credentials an attacker might hold, and restoring at scale can be awkward. Retention policies are designed for compliance and legal preservation rather than fast, point-in-time recovery.
A dedicated Microsoft 365 backup, whether Microsoft 365 Backup from Microsoft or a third-party service, stores independent copies of Exchange Online, OneDrive, SharePoint and Teams data with its own retention and restore tools. Apply the same principles as for any backup: separate admin access, MFA, immutability where offered, and tested restores.
Decide what to back up, and how often
Start from what the business needs to operate, not from what is easy to back up.
- Microsoft 365 or Google Workspace data: email, files, SharePoint sites and Teams content.
- Servers and virtual machines, including file servers and line-of-business application databases, with application-consistent snapshots for databases.
- Cloud applications such as accounting, practice management or CRM platforms; check each vendor’s export and backup options and contract terms.
- Configuration data: firewall and switch configurations, Intune and Conditional Access policies, DNS records and documentation of how systems are built.
- Endpoints where data cannot be redirected to cloud storage, though redirecting desktop and documents folders to OneDrive is usually the better answer.
- Recovery point objectives for each system, which determine backup frequency: a file server might need hourly snapshots while an archive needs weekly copies.
Test restores like you mean it
Restore testing is where most backup programs fall short. Successful job reports do not prove that data is complete, uncorrupted and usable.
Monthly file and mailbox restores
Restore a sample of files, a folder and a mailbox item to an alternate location and confirm they open correctly.
Quarterly application restore
Restore a server or application database to an isolated environment and confirm the application starts and data is current to the expected point.
Annual full recovery exercise
Simulate losing a critical system and time the full recovery, including obtaining credentials, provisioning hardware or cloud resources, and validating with a business user.
Record and improve
Log the date, scope, result and time taken for every test. Compare recovery times against business expectations and fix the gaps.
Monitoring, retention and documentation
Someone must review backup results every business day. A job that has silently failed for weeks is one of the most common discoveries during an IT assessment. Configure alerts for failures and for jobs that have not run at all, and treat a persistent warning as a failure until it is resolved.
Retention should balance recovery needs, storage cost and any record-keeping obligations. A common pattern keeps daily backups for a few weeks, monthly backups for a year and annual copies for longer where required. Ask your professional or legal advisers which retention periods apply to the records your business holds.
Finally, document the recovery process. A clear runbook stating where backups live, how to access them, the order systems should be restored in and who to contact turns a stressful outage into a manageable procedure.
Backup is part of disaster recovery, not the whole of it
Backups give you the data. Disaster recovery planning decides which systems come back first, how quickly, on what infrastructure and who makes the calls. If you have backups but no recovery plan, start there next.
Frequently asked questions
Doesn’t Microsoft back up our Microsoft 365 data?
Microsoft protects the service against infrastructure failure and offers recycle bins, version history and retention features. It does not provide independent, long-term, point-in-time backups of your data by default. A dedicated Microsoft 365 backup fills that gap.
Is a USB drive or NAS in the office enough?
On its own, no. A device in the same building shares the same risks of fire, theft and ransomware on the same network. It can be one copy, combined with an offsite and an immutable or offline copy.
How often should we test restores?
Test small restores monthly, application or server restores quarterly, and a full recovery scenario at least annually or after major changes. Record results so you can show the backups work.
What does immutable backup mean in practice?
It means backup data is locked against modification or deletion for a set retention period, even by administrators. If ransomware or an attacker gains admin access, those copies remain available for recovery.
Related services
Products and packages
Find out whether your backups would really restore
A backup and recovery assessment reviews what is protected, how copies are secured and whether restores have been tested, then sets out practical improvements.