Content reviewed and updated 15 September 2026.
Microsoft 365 has protection. Do you have a recovery plan?
Microsoft 365 includes resilience and recovery features. Microsoft also offers a dedicated Microsoft 365 Backup service. So the blanket claim that “Microsoft does not provide backup” is no longer a useful starting point.
The better question is what your organisation has actually configured: which data is protected, how far back you can restore, who can perform the recovery and how long it takes.
For a Sydney business relying on email and shared files, a successful backup job is only part of the answer. The important test is getting usable information back when people need it.
Which mailboxes, sites, accounts and workloads are protected?
Confirm coverage, including new usersWhich restore points and retention windows are available?
Check the actual service configurationHow long does a realistic restore take?
Test and record the resultThese are planning questions, not promised recovery times. See broader incident and recovery facts in our library.
Six myths worth retiring
1. “The cloud cannot lose data”
High availability does not remove deletion, account compromise or configuration risks.
What to check
List the scenarios you need to recover from. Service resilience and your own recovery requirements are different questions.
2. “Microsoft never provides backup”
Microsoft 365 Backup exists as a dedicated service.
What to check
Check whether it is enabled and configured for your data. Compare its supported workloads, costs and recovery options with other products rather than assuming every subscription has the same protection.
3. “Sync is my backup”
Sync keeps working copies aligned; unwanted changes may be synchronised too.
What to check
Document the restore options for your setup. Separate the convenience of sync from a tested recovery process.
4. “Retention means restore everything”
Retention, version history and backup solve different needs.
What to check
Match the available recovery tools to accidental deletion, mass changes and business-wide recovery. Avoid relying on a single feature name.
5. “Everything is kept forever”
Retention and restore windows depend on the workload and policy.
What to check
Check settings for leavers, deleted content and long-term records. Microsoft 365 Backup documentation describes its own recovery window separately from Purview retention policies.
6. “A green tick proves we can recover”
A completed job is not a restoration test.
What to check
Restore a representative mailbox or site to a safe location. Record time, permissions, missing items and who approves the result.
Run a recovery rehearsal before a crisis
Pick one critical business process and the data it depends on. Agree how much recent work could be lost and how long the team could operate without it.
Ask the person responsible for backup to demonstrate the restore path. Check who can access backup administration if the main account is compromised, and how a new starter or new site becomes protected.
Keep the evidence simple: the date, what was restored, the result and any actions. Security and backup work together; neither replaces the other.
Sources & further reading
Can your team demonstrate a restore?
Explore ITFR’s Microsoft 365 backup service and review the recovery needs of your Sydney business.
