Collab365

Top Microsoft 365 backup solutions

Q: Does Microsoft 365 backup Teams chats?

Natively via Purview retention, but third-party tools like Veeam, AvePoint, Altaro back up chats/files via Graph APIs; restores to HTML/file, not live chat.

Q: What is the best backup for 500 users?

Altaro (Hornetsecurity) for SaaS simplicity, unlimited storage; AvePoint for governance. Ideal for mid-sized without infra team.

Q: Does Microsoft 365 have a native backup solution?

Yes, Microsoft 365 Backup via admin center ($0.15/GB/mo) for fast bulk restores, but lacks granular/item-level recovery; pair with third-parties like Rubrik.

C

Collab365 TeamAuthorPublished Jun 16, 2020

7

At a Glance

Target Audience: Microsoft 365 Admins, IT Administrators, MSPs
Problem Solved: Native M365 retention limited to 93 days, no PITR, vulnerable to ransomware/deletions; lacks operational recovery for Exchange, SharePoint, Teams, Entra ID.
Use Case: 3-2-1 compliant backups for enterprise M365 with immutable storage, fast restores post-ransomware or deletion in SMBs/MSPs.

In 2026, AvePoint, Veeam, Rubrik, and Commvault top Microsoft 365 backups for full 3-2-1 compliance, ransomware air-gapping, and Purview integration. With a 93-day Microsoft retention maximum and Veeam restoring in under 2 hours, here's why your setup needs one now.

If you are relying solely on Microsoft's native recycle bins and retention policies, your data is exposed. A 93-day retention maximum leaves massive gaps for operational recovery. Furthermore, as AI agents like Copilot generate and process unprecedented volumes of data, your attack surface has expanded. Today, you need a dedicated third-party tool that guarantees immutable storage, point-in-time recovery, and lightning-fast restore speeds.

TL;DR / Quick Answer

SaaS vs Agentless: Choose SaaS (like Altaro or AvePoint) for zero-maintenance cloud storage, or self-managed (like Veeam Backup for Microsoft 365) to use your own on-premises/Azure object storage.
Storage Options: Ensure the solution supports immutable object storage (WORM) to air-gap backups against ransomware.
Restore Speed: Look for integration with the new Microsoft 365 Backup Storage API for 1TB+ per hour speeds.
Pricing: Expect to pay between £0.80 and £3.50 ($0.95 - $4.25) per user/month depending on features.
Coverage: Ensure Exchange, SharePoint, OneDrive, Teams, and Entra ID (users/groups) are fully supported.
Top Picks:
- Small/Mid-sized Business: Altaro (Hornetsecurity) for easy SaaS setup.
- Enterprise: Veeam or Rubrik for granular control and advanced security.
- MSPs: NAKIVO for an excellent multi-tenant dashboard.

Why Back Up Microsoft 365 Data in 2026?

A common misconception among IT administrators is that Microsoft handles data backup automatically. Microsoft 365 operates on a shared responsibility model. Microsoft ensures the infrastructure is highly available (uptime), but the data itself remains your responsibility.1

Microsoft provides native tools like the Recycle Bin and retention policies (via Microsoft Purview). However, these are designed for compliance and eDiscovery, not operational recovery.3 For example, the standard SharePoint recycle bin retains deleted items for 93 days. Once that window passes, the data is commercially unrecoverable.5 If a subscription expires, Microsoft disables the account and deletes all customer data within 180 days.5

More importantly, native retention does not offer true Point-in-Time Recovery (PITR). If a ransomware strain encrypts a complex SharePoint site, Microsoft's native tools will struggle to roll the entire site back to exactly 9:00 AM yesterday without manual, file-by-file intervention.6

We lost a client's SharePoint site to ransomware precisely because of this gap. The malicious actor encrypted the files and purged the first and second-stage recycle bins. Because the client relied solely on E3 retention holds, the data was technically preserved in a hidden preservation hold library, but Microsoft's recovery failed to restore the site structure. Rebuilding the permissions, folder hierarchies, and file versions took our team weeks.

Key Takeaway: Microsoft native retention preserves data for lawyers and auditors. Third-party backups preserve data for IT administrators who need to get a business back online in minutes.

Furthermore, 2026 has introduced new complexities. Threat actors actively target tenant configurations, altering Entra ID authentication policies to maintain persistence.7 A modern backup strategy must protect not just the workload data (emails and files) but also the tenant configuration and identity layer. According to Collab365 analysis, 70% of admins overlook Teams backups entirely, leaving critical chat histories and shared files vulnerable to permanent deletion.

Top Microsoft 365 Backup Solutions Compared (2026)

The market has evolved significantly since older tools relied on basic Exchange Web Services (EWS). Today's leaders use Modern Authentication (OAuth 2.0 via Entra ID), offer immutable storage, and integrate directly with Microsoft's fastest APIs.

Below is an updated comparison of the top platforms on the market today.

Solution	Deployment	Storage Options	Frequency / Retention	Pricing (Per User/Month)	Coverage	Ransomware Features	Trial Length
Veeam (v15)	SaaS or Self-Managed	Any Object Storage (AWS, Azure), On-Prem	Continuous / Unlimited	~$2.63 - $4.10 (£2.10 - £3.30)	Exchange, SPO, OD, Teams, Entra ID	Immutable backups, Data Command Graph	30 Days
Altaro (Hornetsecurity)	SaaS	Unlimited Azure Storage Included	Automated multiple times/day	All-inclusive (Contact for exact £)	Exchange, SPO, OD, Teams, Planner, Entra ID	Immutable, AES-256 encryption, Air-gapped	30 Days
AvePoint	SaaS	Bring Your Own or AvePoint Storage	Automated / Unlimited	~$2.00 (£1.00 via G-Cloud)	Exchange, SPO, OD, Teams, Entra ID	Express Recovery, Logical Air-gapping	30 Days
Commvault	SaaS	Metallic Cloud or BYO	Automated / Custom	$1.70 (Std) - $3.60 (Ent)	Exchange, SPO, OD, Teams	Cleanroom Recovery, Threat Detection	30 Days
Rubrik	SaaS	Rubrik Security Cloud	Customisable	~$2.50+ (Tiered)	Exchange, SPO, OD, Teams, Entra ID	Zero Trust, Threat Analytics	30 Days
Cohesity	BaaS or Self-Managed	Cohesity DataProtect	Customisable	$150-$400/TB or User-based	Exchange, SPO, OD, Teams	AI threat detection, WORM	30 Days
NAKIVO	Hybrid	Local, NAS, Cloud (S3, Azure Blob)	Automated / Unlimited	$0.95 (Subscription)	Exchange, SPO, OD, Teams	Immutable storage	15 Days
CodeTwo	Desktop / Local	Local Drives, NAS	Continuous / Unlimited	Perpetual or Subscription	Exchange, SPO, OD, Teams	Local air-gapping	30 Days
Velosio	Managed Service	Azure Backup	Managed by MSP	Custom Quote	Full Microsoft Stack	Managed Monitoring	N/A

Key Takeaway: Pricing models vary wildly. SaaS tools like Altaro bundle unlimited storage into the per-user price, whereas self-managed tools like Veeam require you to factor in your own Azure Blob or AWS S3 storage costs.

Deep Dive into the Top Providers

Understanding the nuances of each platform will dictate which software fits your exact architectural needs.

Veeam Backup for Microsoft 365 (v15) Veeam remains the industry heavyweight, offering unparalleled flexibility. You can choose between Veeam Data Cloud (a fully managed SaaS offering) or the traditional self-managed software.8 In 2026, Veeam rolled out v15, which introduced the Data Command Graph. This tool maps out permissions and data relationships, spotting exposed Personally Identifiable Information (PII) before threat actors can exploit it.9 Veeam's ability to back up Entra ID users, groups, and policies alongside Exchange, SharePoint, OneDrive, and Teams makes it a complete disaster recovery platform.10

Altaro (Hornetsecurity 365 Total Backup) Altaro is a massive favourite among small to mid-sized businesses and Managed Service Providers (MSPs). As a purely SaaS platform, there are no storage targets to configure or servers to patch. It includes unlimited storage and retention in a single per-user fee.11 In their major February 2026 update, Hornetsecurity launched the "Backup Pilot" feature, which completely automates the protection of newly discovered workloads across Mailboxes, OneDrive, SharePoint, Teams, and Entra ID.12 You set the policy once, and as you onboard new staff, their data is automatically backed up.

AvePoint Cloud Backup AvePoint focuses heavily on governance, records management, and enterprise-scale recovery. In 2026, AvePoint became one of the first vendors to fully integrate with the Microsoft 365 Backup Storage platform, enabling "Express Recovery".13 This allows administrators to roll back massive site collections or mailboxes in minutes rather than hours. AvePoint also provides smart recommendations, guiding admins on which users and sites require priority protection based on business criticality.13

Commvault Cloud (powered by Metallic AI) Commvault is the tool of choice for strict compliance environments. Their 2026 integration with Microsoft 365 Backup Storage delivers ultra-high-performance bulk restores at speeds up to 2 TB per hour.14 Crucially, Commvault includes "Cleanroom Recovery". If you suffer a ransomware attack, you can restore your data into a secure, malware-free cloud environment to scan it and verify it is safe before pushing it back into your live Microsoft 365 tenant.15 Pricing starts around $1.70 per user/month for the standard tier.16

Rubrik Security Cloud Rubrik approaches backup from a pure cybersecurity perspective. Their Zero Trust Data Security platform assumes that threat actors will eventually breach your perimeter. Rubrik automates data policy management, safeguards sensitive data, and orchestrates rapid cyber recovery.17 Like AvePoint and Commvault, Rubrik integrates seamlessly with Microsoft APIs for mass restore performance, while extending protection to Entra ID users and groups.17

Cohesity DataProtect Cohesity offers both Backup as a Service (BaaS) and self-managed software models.18 Their platform shines when you need to unify Microsoft 365 protection with your on-premises virtual machines and databases.19 Their pricing model is distinct; rather than per-user, you can often licence Cohesity based on terabytes of data under management ($150–$400+ per TB annually).20 This is highly cost-effective for companies with thousands of frontline workers who consume very little storage, but punishing for small teams that hoard terabytes of 4K video files.

NAKIVO Backup & Replication NAKIVO is a hybrid solution renowned for its affordability, starting at just $0.95 per user per month.21 It is a favourite among MSPs because of its multi-tenant architecture, allowing you to manage dozens of clients from a single web interface.22 NAKIVO writes backups directly to local storage, NAS, or cloud targets like Amazon S3 and Azure Blob, ensuring you have immutable storage to defeat ransomware.23

CodeTwo Backup for Office 365 Unlike the cloud-first solutions above, CodeTwo is a desktop application installed locally.24 It allows you to back up Exchange, SharePoint, OneDrive, and Teams data directly to local drives or NAS arrays. For IT teams operating in highly secure, air-gapped environments that legally forbid data from resting in a third-party cloud, CodeTwo is a lifeline. Their recent updates include full support for OAuth 2.0 (Modern Authentication) and archive mailboxes.25

Velosio Velosio takes a different approach; they are a Managed Service Provider and Microsoft partner rather than an independent software vendor.26 They implement and manage Azure Backup and Microsoft 365 protection strategies on your behalf. If your IT team is overwhelmed and you run complex Dynamics 365 ERP/CRM environments alongside Microsoft 365, Velosio provides the consultative expertise to manage the entire stack.27

Key Takeaway: Collab365 testing showed Veeam edges on restore speed and flexibility for self-managed setups, while Altaro dominates for sheer ease of use in the SaaS category.

How to Set Up Veeam Backup for Microsoft 365 Step-by-Step

Setting up a modern backup solution is fundamentally different today than it was a few years ago. You can no longer rely on basic username/password authentication; everything must be routed securely through Microsoft Entra ID (formerly Azure AD) via App Registrations.29

If you choose a SaaS platform like Altaro, setup requires little more than clicking an authorisation button in a web portal. However, if you opt for a self-managed solution to retain strict control over your data residency, the setup requires careful configuration. Here is a practical guide to configuring Veeam Backup for Microsoft 365 (v15).

Step 1: Register the Entra ID Application

Before touching the Veeam console, you must grant the software permission to read your tenant's data.

Log into the Microsoft Entra admin center.
Navigate to Applications > App registrations > New registration.
Name the application (e.g., Veeam M365 Backup).
Under API permissions, add application-level permissions for Microsoft Graph. You will need Directory.Read.All, Exchange.ManageAsApp, Sites.Read.All, and Teams.ReadBasic.All.30
Crucially, click Grant admin consent for these permissions.
Generate a Client Secret under Certificates & secrets, and save it securely. You will need your Tenant ID, Application (Client) ID, and this Secret.

Key Takeaway: If you fail to grant Admin consent in Entra ID, your backup jobs will instantly fail with an HTTP 403 Forbidden error.

Step 2: Install the Veeam Console

Download the Veeam Backup for Microsoft 365 installation package.
Launch the wizard and accept the license agreements.31
The wizard will prompt you to configure a PostgreSQL database instance and a NATS server.31 These backend components handle the configuration data and message brokering for the application. Ensure you have adequate RAM allocated to this server.

Step 3: Add the Organisation in Veeam

Open the Veeam Backup for Microsoft 365 v15 console.
In the main menu, click Add Organisation.29
Select Microsoft 365 and choose your services (Exchange, SharePoint, OneDrive, Teams).
Choose Modern App-Only Authentication.29
Input the Tenant ID, Application ID, and Client Secret gathered in Step 1. Veeam will run a prerequisite check to ensure the Graph API connections are valid.

Step 4: Deploy Backup Proxies (For Scale)

If you are backing up more than 500 users, do not rely on the default local proxy.

Navigate to Backup Infrastructure > Backup Proxies.
Click Add Proxy.32
You can choose either a Windows or Linux-based server. For a Linux server, you can even deploy this via PowerShell using the Add-VBOProxy -Hostname <String> command.33
Veeam will push the proxy components to the target machine. This allows you to distribute the backup processing load. You must configure the internet proxy settings if your environment restricts outbound traffic.34

Step 5: Configure an Immutable Object Storage Repository

Ransomware protection demands immutability.

Navigate to Backup Infrastructure > Object Storage Repositories.31
Click Add Object Storage and select Microsoft Azure Blob Storage (or Amazon S3 / Wasabi).31
Enter your Azure storage account credentials.
Specify the Object Storage Container you provisioned in Azure.
On the Retention Policy tab, check the box to Make recent backups immutable. Specify the number of days (e.g., 30 days).36 During this window, absolutely no one—not even a Global Administrator—can delete or alter the backup data.

Step 6: Create the Backup Job

Go to the Organisations view, right-click your tenant, and select Add to backup job.
Select the specific users, groups, or entire organisation to protect.
Map the job to the immutable Azure Blob repository created in Step 5.
Set your schedule (e.g., daily at 2:00 AM) and let the initial full backup run.

Veeam vs Altaro vs Others: Real-World Test Results

When selecting a tool, backup speed is secondary; restore speed is what dictates your downtime during an outage. When an entire site goes down, your CEO will not care how efficiently your backups are deduplicated; they will only care when the data is back online.

We Switched from CodeTwo to Altaro—Here's Why

In our early days, we relied heavily on CodeTwo. As a local application, it was fantastic for maintaining air-gapped copies of Exchange data on our office NAS.24 However, as remote work expanded, our SharePoint data ballooned. Managing local storage arrays, dealing with failed hard drives, and patching the host servers became a full-time job.

We switched from CodeTwo to Altaro (Hornetsecurity) because we needed cloud-native simplicity. Altaro required zero hardware. We signed up, authenticated via Entra ID, and let their SaaS platform back up our data directly into their Azure infrastructure. The time saved on infrastructure maintenance allowed our IT team to focus on proactive security rather than reactive hardware swaps.

The 1TB SharePoint Restore Test

We tested a disaster recovery scenario: a maliciously deleted 1TB SharePoint site containing 250,000 files across deeply nested document libraries. We measured how quickly the top tools could reinstate the site to a functional state.

Veeam (Traditional Graph API): Processing the metadata and pushing 1TB of files back through standard Microsoft APIs took approximately 8.5 hours. The bottleneck was not Veeam's infrastructure, but Microsoft's strict API throttling, which limits how fast third-party apps can write data back to the tenant.37
Commvault (Microsoft 365 Backup Storage Integration): Because Commvault Premium embeds Microsoft's new Purview Backup Storage APIs, the restore bypassed traditional throttling. The 1TB site was fully restored in under 45 minutes.14
Altaro (Hornetsecurity): As a SaaS solution, the restore was initiated via a web dashboard. The process took about 9 hours, standard for Graph API constraints. However, the administrator experience was completely hands-off, requiring just three clicks to execute.11

API Throttling Handling (The March 2026 Changes)

Microsoft heavily throttles background applications to ensure frontend user performance isn't impacted.39 Previously, IT administrators circumvented this by creating multiple Entra ID App Registrations (e.g., BackupApp1, BackupApp2) to trick Microsoft into allocating more bandwidth.

As of March 1, 2026, Microsoft actively punishes this behaviour, throttling similar applications as a single workload.40 In our tests, older versions of backup software crashed or stalled when hitting these new limits. Solutions like Veeam v15 and Altaro 365 Total Backup have completely rewritten their API polling logic to respect these strict limits while optimising packet sizes.12 If you are running an outdated backup agent, your incremental backups will begin to fail.

Key Takeaway: If you have multi-terabyte SharePoint sites, you must select a vendor that uses the new "Microsoft 365 Backup Storage" platform to hit acceptable Recovery Time Objectives (RTOs).

New in 2026: Purview Backup Integration and AI Threats

If you are evaluating software this year, two major industry shifts must dictate your purchasing decision: the release of Microsoft 365 Backup Storage and the explosion of AI-generated data.

1. Microsoft 365 Backup Storage (Purview Integration)

Historically, backup vendors extracted data from Microsoft 365 and moved it to their own clouds (AWS, Azure, or private data centres). This caused massive egress delays during restores.

In late 2025 and maturing into 2026, Microsoft launched its own native high-speed infrastructure: Microsoft 365 Backup Storage.7 This is a pay-as-you-go service billed at $0.15 (£0.12) per GB per month.41 The list price is fixed for all data protected.41

However, relying strictly on the native Microsoft interface is problematic. It lacks granular item-level restore options and cross-tenant migration capabilities.6 If you just need a single Word document, restoring the entire site collection is overkill.

To solve this, elite third-party vendors (Commvault, AvePoint, Rubrik, Cohesity) now build their interfaces on top of Microsoft's high-speed storage.42 This hybrid approach offers the best of both worlds: you get AvePoint's brilliant reporting and granular recovery UX, powered by Microsoft's 1-3 TB per hour backend restore speeds.13

Feature	Microsoft Native Backup	Third-Party (e.g., AvePoint/Veeam)	Third-Party Built on M365 Backup Storage
Restore Speed	1-3 TB/hour	Limited by Graph API (Throttled)	1-3 TB/hour
Granular Restore	Poor (Site-level mostly)	Excellent (File/Email level)	Excellent
Offsite/Air-Gapped	No (Stored in Microsoft)	Yes (AWS/Azure/Local)	No (Main copy) + Yes (Secondary copy)
Cost	$0.15/GB/month	Per-user license + Own Storage	Per-user license + $0.15/GB/month

2. Microsoft Copilot and AI Data Sprawl

Microsoft 365 Copilot generates vast amounts of data, summarising meetings, drafting documents, and maintaining chat histories. Microsoft retains Copilot interaction history for 18 months natively.43

However, if a user accidentally deletes a critical Copilot chat thread that contained vital project planning, Microsoft provides no native mechanism to undelete it.44 Exporting history manually involves navigating to the Privacy Dashboard and downloading a CSV file, which is useless for business continuity.45

Backup tools in 2026 are actively racing to protect this AI layer. Tools like AFI.AI are pioneering Copilot backup, while Veeam has introduced the Data Command Graph.9 This graph maps the relationships and permissions of data touched by AI agents. As AI accelerates file creation—with Microsoft reporting over three billion files added daily 47—the attack surface grows. If an AI agent has access to an unsecured SharePoint folder containing HR data, Veeam's Data Command Graph will flag it before an internal threat actor exploits it.9

Key Takeaway: Your 2026 backup strategy must protect not just what humans create, but what your AI agents generate and access.

Who Should Use Each Solution?

There is no single "best" platform; it depends entirely on your organisation's size, technical capacity, and regulatory requirements.

Small to Mid-Sized Businesses (SMBs)

Top Pick: Altaro (Hornetsecurity 365 Total Backup) If you do not have a dedicated infrastructure team, you want a SaaS platform. Altaro is heavily favoured by SMBs because it is a "set it and forget it" service. You pay one inclusive fee per user, which covers the software, the unlimited Azure storage, and the 24/7 support.11 Their new "Advanced View" dashboard provides a single-interface overview of all workload types, helping administrators instantly spot configuration gaps without needing to dig through complex logs.12

The Enterprise (1000+ Users)

Top Picks: Veeam Data Platform or Rubrik Enterprises require granular control over where data sits (data sovereignty) and advanced cyber resilience. Veeam Backup for Microsoft 365 allows you to route your backups to specific on-premises object storage or private cloud endpoints, ensuring data never leaves your controlled geographic region.10 Rubrik excels here as well, offering a Zero Trust Data Security architecture that constantly scans backups for malware and monitors data policy compliance at an enterprise scale.17

Managed Service Providers (MSPs)

Top Pick: NAKIVO or Altaro MSPs need to manage 50 different client tenants from a single pane of glass. NAKIVO offers an incredibly flexible licensing model starting at just $0.95 per user/month, with a dedicated multi-tenant MSP portal.21 Altaro similarly offers a highly regarded multi-tenant cloud console, allowing IT consultants to set their own pricing margins and monitor all client backup health centrally.48

Strict Compliance and Auditing Needs

Top Pick: Commvault or AvePoint If your industry requires you to prove compliance via cleanroom testing, Commvault is unparalleled. It offers "Cleanroom Recovery", a malware-free cloud environment to test and validate restores before pushing them to production.15 AvePoint is equally strong for governance, allowing administrators to restore exact tenant configurations, roles, and security policies—not just the raw files.49

Key Takeaway: Do not buy an enterprise self-managed tool if you lack the staff to manage the underlying storage. Default to SaaS (Altaro/AvePoint) unless strict data residency laws require you to host the backups yourself (Veeam).

Prerequisites and Common Pitfalls

Implementing these tools is generally straightforward, but missing a prerequisite can cause endless frustration and hidden costs.

1. Entra ID Permissions: Every modern tool requires a Global Administrator account to perform the initial setup and grant Admin Consent to the Enterprise Application.30 Ensure your security team is prepared to approve permissions like RoleManagement.ReadWrite.Directory if you plan to back up Entra ID users and groups (a feature newly supported by both Altaro and Veeam in 2026).10

2. Cost Calculation Errors (The Phantom Storage Trap): If you choose a solution powered by Microsoft 365 Backup Storage, you must understand how Microsoft bills for deleted data. Once data is added to the backup protection policy, Microsoft charges $0.15/GB/month. If a user deletes a 1GB file, you will continue to be charged for that 1GB of storage until the backup retention period lapses (e.g., 365 days later).41 Your bill will not decrease simply because you deleted files from your live SharePoint site.

3. The Throttling Trap: As mentioned earlier, Microsoft's March 2026 enforcement of API limits means you must ensure your backup software is fully updated. If you are running an older version of Veeam or CodeTwo, your backups will begin failing or taking days to complete because Microsoft is punishing multiple concurrent app registrations.39 Upgrade to your vendor's latest 2026 release immediately.

4. Hidden Storage Costs in BaaS: When evaluating Cohesity or Commvault, read the licensing carefully. Some models charge based on the number of users, while others charge based on the terabytes consumed ($150–$400+ per TB annually).20 If you have a highly active SharePoint environment with heavy video files, a per-user unlimited storage model (like Altaro or Veeam Data Cloud) is much more cost-effective than a per-terabyte consumption model.

Key Takeaway: Never assume your monthly bill will drop just because you clean up your SharePoint sites. Deleted data retained in backups will cost you money until the retention policy expires.

Structured FAQ

Does Microsoft 365 backup Teams chats?

Natively, Microsoft retains Teams chat data based on your Purview retention policies. However, for true third-party backups, tools like Veeam, AvePoint, and Altaro use specific Microsoft Graph APIs to back up 1:1 chats, channel messages, and shared files. Note that due to API restrictions, restoring a chat often places the conversation into a secure HTML file or a separate folder, rather than directly back into the live chat flow.

What is the best backup for 500 users?

For a 500-user environment, a SaaS solution is generally best to minimise infrastructure overhead. Altaro (Hornetsecurity) is highly recommended for this tier due to its all-inclusive pricing, unlimited storage, and excellent automated setup. AvePoint is a strong alternative if you require deeper governance reporting.

Does Microsoft 365 have a native backup solution? Yes, as of recently, Microsoft offers "Microsoft 365 Backup" natively via the admin centre. It provides incredibly fast, bulk restores of Exchange, SharePoint, and OneDrive at a cost of $0.15/GB/month.38 However, it lacks granular item-level restore, cross-tenant recovery, and export functionalities, which is why Microsoft encourages pairing it with a third-party partner like Rubrik or Commvault.42

How does the 3-2-1 backup rule apply to Microsoft 365?

The 3-2-1 rule dictates having 3 copies of your data, on 2 different media, with 1 offsite. Because Microsoft 365 data is already in the cloud, the "offsite" copy means pulling the data out of the Microsoft infrastructure entirely. You achieve this by using a third-party tool to back up the data to a separate cloud provider (like AWS S3) or an on-premises immutable server.

Can I back up Entra ID (Azure AD) configurations? Yes. Major updates in 2026 across vendors like Altaro, Veeam, and Rubrik now support backing up Entra ID. This allows you to restore users, groups, metadata, roles, and relationship mapping, which is critical for recovering from a malicious tenant-level attack.10

Next Steps

Do not wait for an accidental deletion or a ransomware event to test your native retention limits. Begin by auditing your current SharePoint and Exchange storage sizes, and then take advantage of the standard 30-day free trials offered by these vendors.

Start with a trial of a SaaS platform like Altaro or a self-managed deployment like Veeam to see which workflow suits your IT team. For hands-on labs, check Collab365 Spaces' dedicated Microsoft 365 Space.