Microsoft operates a shared responsibility model. They provide the infrastructure, the uptime, and the tools, but the data you put into those tools is your responsibility. If a member of staff deletes a critical folder and notices six months later, or if a disgruntled admin wipes a SharePoint site, Microsoft is not obligated to get that data back for you. This is why a third-party Microsoft 365 backup service is a standard requirement for UK SMEs.
Choosing the right service is not about finding the cheapest monthly per-user price. It is about ensuring that when things go wrong, the recovery is fast, complete, and legally compliant. Most businesses assume that because their files are in the cloud, they are inherently backed up. In reality, Microsoft's native tools are designed for availability, not long-term archival or recovery from malicious intent.
What a backup service actually needs to cover
Many entry-level backup products only look at Exchange Online (your email). While email is critical, it is often only half of the story. A comprehensive backup must cover the entire Microsoft 365 ecosystem. This includes OneDrive for Business, where individual staff keep their working files, and SharePoint Online, which usually houses your company's shared file structure and intranet.
Crucially, it must also cover Microsoft Teams. Backing up Teams is more complex than just grabbing files from the underlying SharePoint site. A proper service needs to capture the structure of the Teams themselves, the channel configurations, and the chat history. If you lose a Team and only restore the files, you lose the context of the conversations that led to those files being created. We also look for coverage of secondary apps like Microsoft Planner and OneNote, which often contain significant intellectual property that is difficult to recreate from memory.
Retention periods and the 30-day trap
By default, Microsoft 365 keeps deleted items in a recycle bin for 93 days, and some items for only 30 days. After that, they are purged. For most UK businesses, this is insufficient. A project might be archived and not touched for a year; if it was accidentally deleted before archiving, you would not know it was gone until it was too late to recover using native tools.
When evaluating a backup service, look for 'infinite' or 'unlimited' retention. This means as long as you pay for the licence, the data is kept. This is particularly important for firms in regulated sectors, such as law or finance, where you may be legally required to hold records for seven years or more. The backup service acts as your long-term archive, allowing you to remove the data from your live Microsoft 365 environment to save on storage costs while knowing it remains accessible in the backup.
Granularity and the speed of recovery
There is a significant difference between being able to restore a whole mailbox and being able to restore a single email from three years ago. This is known as granularity. A good service allows you to search for a specific file name, a sender, or a date range and restore just that one item directly back to its original location or to a new folder.
We also look for the ability to perform 'point-in-time' restores. If a ransomware attack encrypts your entire SharePoint library at 10:15 am, you need to be able to tell the backup service to restore the library to exactly how it looked at 10:10 am. Without this, you are left trying to manually identify which files are encrypted and which are safe, which is an impossible task for a business with thousands of documents.
Data sovereignty and the UK location
For UK SMEs, where your data is stored matters for GDPR compliance. If your backup service stores your data in a US-based data centre, you are exporting personal data outside of the UK's jurisdiction. This requires specific legal safeguards and risk assessments.
We recommend choosing a provider that offers a UK-based data centre, such as London or Cardiff. This ensures that your primary data in Microsoft 365 (which is usually in the UK or Europe) and your backup data remain under the same regulatory framework. It also usually results in faster restore speeds, as the data does not have to travel across the Atlantic.
Immutability and protection against the 'Inside Job'
One of the most dangerous threats to a business is a compromised global admin account. If a hacker gets hold of your admin credentials, they can delete your live data and then go into your backup settings and delete the backups too. This is why 'immutability' is a non-negotiable feature.
An immutable backup is stored using WORM (Write Once, Read Many) technology. Once the data is written to the backup, it cannot be changed or deleted by anyone, not even your own IT admin, for a set period. This provides a 'gap' between your live environment and your backup that cannot be bridged by a single set of compromised credentials. If the live data is wiped, the immutable backup remains untouched and ready for recovery.
Why the restore test is the only metric that matters
A pattern we see on most tenants we take on is that 'backups' have been running for years, but nobody has ever actually tried to restore a folder to a different location to see if the permissions remain intact. A backup that hasn't been tested is merely a hope.
We perform regular restore tests for our clients. This involves picking a random folder or mailbox once a quarter and restoring it to a sandbox area. We check that the folder structure is correct, that the file versions are what we expect, and that the metadata (like who last edited the file) is preserved. If your current provider cannot show you a log of successful restore tests, you should assume the backup might not work when you need it most. This is a core part of any backup and disaster recovery strategy.
The financial impact of not having a backup
To understand the value of a backup service, you have to model the cost of downtime. Take a 25-person firm where the average hourly cost per employee (salary, NI, pension, overheads) is £30. If a data loss event takes the team offline for just four hours while you scramble to find a solution, that is £3,000 in lost productivity alone. This does not account for lost revenue, missed deadlines, or the reputational damage of telling a client you have lost their files.
A typical Microsoft 365 backup service costs roughly £3 per user, per month. For that same 25-person firm, the annual cost is £900. In this scenario, the backup pays for itself if it prevents just 1.5 hours of total company downtime over the course of an entire year. For most business owners, that is an easy trade to make.
Common pitfalls in backup selection
- Relying on 'Sync' as a backup: Tools like the OneDrive sync client are not backups. If you delete a file on your laptop, the sync client faithfully deletes it in the cloud. A backup must be independent of the sync process.
- Ignoring the audit log: A good backup service should alert you if it fails to back up a specific account. We often see systems where one user’s mailbox has been failing for months because of a licensing change, but nobody noticed because they weren't checking the logs.
- No Multi-Factor Authentication (MFA): Your backup portal is a goldmine for attackers. If the service you choose does not support MFA for the admin login, do not use it.
How Black Sheep Support helps
We don't just sell backup software; we manage the entire recovery process. We select the right platform for your specific data footprint, ensure it is configured for UK data sovereignty, and handle the ongoing monitoring and restore testing so you don't have to. We treat backup as a critical insurance policy that must be ready to fire at a moment's notice.
If you are unsure whether your current setup actually protects your SharePoint and Teams data
and we will help you identify the gaps in your recovery plan.
Not ready to talk yet? Run our free IT Health Check to assess your business risk and security posture in minutes, no commitment. We also handle hardware, broadband, mobile and networking, helping you consolidate your IT into one reliable place.
Microsoft 365 Backup FAQ
Does Microsoft 365 Business Premium include a backup?
No. While Business Premium includes advanced security features like Defender for Business, it does not include a third-party backup service. It relies on the standard recycle bin and versioning features, which do not protect against long-term data loss or malicious deletion of backups.
Where is my Microsoft 365 backup data stored?
This depends on the provider you choose. We ensure our clients' data is stored in UK-based data centres to maintain GDPR compliance and data sovereignty. You should always verify the physical location of the storage before signing a contract with a backup provider.
Can I back up just the directors' mailboxes?
Technically yes, but we advise against it. Data is often spread across the business in shared SharePoint sites and Teams channels. Backing up only a few users leaves the majority of your company's intellectual property unprotected and makes a full recovery impossible after a site-wide incident.
How long does it take to restore a mailbox?
For a standard 50GB mailbox, a full restore usually takes between one and four hours, depending on the speed of the backup provider's API connection to Microsoft. However, granular restores of individual files or emails are typically near-instant and can be completed in minutes.
Want this handled for you? See Microsoft 365 support.
Based in Brighton or Hove? We are too: see IT support in Brighton.
