After helping organizations set up M365 backup across dozens of tenants, a few patterns keep repeating: the same gaps, the same overconfident assumptions, the same surprises during an actual incident. This guide is the distillation of those field observations — what actually matters when designing an M365 backup strategy, not what sounds good in a vendor presentation.
Start With the Recovery Scenario, Not the Backup Tool
The most common mistake is buying a backup solution before defining what "recovery" actually means for your organization. Does recovery mean restoring a single deleted email within 4 hours? Does it mean recovering an entire SharePoint site collection to last week's state? Does it mean proving to an auditor that a specific document existed and was unmodified on a specific date? Each of those scenarios has different requirements, and the backup tool that handles one well may handle another poorly.
Write out your top three recovery scenarios before evaluating any product. Get sign-off from legal, HR, and the CISO on what those scenarios are. That document becomes your requirements spec.
Set Real RPO and RTO Targets
Recovery Point Objective (RPO) is how much data loss you can tolerate — if your backup runs every 24 hours, your RPO is 24 hours. Recovery Time Objective (RTO) is how quickly you need to be operational again. For most organizations, an RPO of 6–24 hours and an RTO of 2–4 hours for individual item restores is reasonable for M365 data.
Regulated industries often have stricter requirements. Financial services under FINRA may need to demonstrate they can restore specific records within a defined window as part of a regulatory examination. Healthcare organizations under HIPAA need documented backup procedures with tested recovery times. Don't set RPO and RTO targets based on what the backup tool can do by default — set them based on your actual business and regulatory requirements, then verify the tool meets them.
Use S3 Object Lock for Immutable Storage
Writing backup data to writable storage is increasingly indefensible from a security standpoint. If an attacker compromises your backup server credentials — or if a ransomware operator specifically targets backup systems, which they frequently do — writable backup storage is just more data to encrypt or delete.
S3 Object Lock in Compliance mode means backup objects are locked for a defined retention period and cannot be deleted or overwritten by any API call, including calls from account administrators. Even if your AWS root credentials are compromised, locked objects stay locked. This is the closest thing to true air-gapping available in cloud storage.
Configure Object Lock at the bucket level with a retention period that exceeds your longest required retention window. For most organizations, 90 days of daily backups plus 12 monthly snapshots covers both operational recovery and compliance requirements.
Scope Backup to All Workloads, Not Just Email
Many organizations start M365 backup with Exchange because email feels most critical, then add other workloads when they have time. The problem is that time often doesn't come before an incident involving SharePoint or OneDrive. A document library that took years to build can be accidentally deleted in seconds.
Back up Exchange, OneDrive, SharePoint, and Teams from day one. The marginal cost of adding workloads is low, but the operational complexity of a partial backup during an incident — when you're trying to figure out what was and wasn't protected — is very high.
Test Restores, Not Just Backups
A backup that's never been restored is untested software, not a safety net. Schedule quarterly restore tests — actual full item and full mailbox restores — and document the results. The first time you need to do a restore should not be the first time you've done one.
Test the whole flow: locate the item in the backup, initiate the restore, verify the restored item is correct and accessible. Time it. If a restore takes 6 hours and your RTO is 2 hours, you need to either adjust the RTO or address the bottleneck in your restore process.