Microsoft 365 Backup gives a tenant fast, point-in-time recovery of Exchange mailboxes, SharePoint sites and OneDrive accounts, but the protection is only as strong as the admin roles, policies and billing that control it. Version history, recycle bins and retention policies were designed for compliance and everyday mistakes, not for rolling back thousands of sites after ransomware or a malicious admin. Microsoft 365 Backup is the native service for that job: backups stay inside the Microsoft 365 trust boundary, use append-only storage, and restore whole sites or mailboxes to a chosen point in time. This guide explains how its access model, roles, Graph APIs, logging, retention and restore options work according to Microsoft's documentation, and how to configure them so a tenant compromise cannot also erase your recovery path. It is for Microsoft 365 administrators, identity engineers and resilience teams.
This is an independent guide from NHI Mgmt Group, based on Microsoft's public documentation as of November 2026. It is not sponsored or reviewed by Microsoft. Product features change, so confirm settings against Microsoft's current documentation.
Key takeaways
- Backup is separate from retention. Microsoft states that retention and deletion policies, GDPR deletion requests and compliance actions do not flow to backup data; only the backup policy controls the recovery window.
- Restore points every 10 minutes. Full OneDrive and SharePoint restores can target any 10 minute point in the last 14 days, then weekly points through the recovery window; Exchange restore points are every 10 minutes.
- The admin role is the crown jewel. The Microsoft 365 Backup Administrator role controls policies, restores and offboarding for all three services, so treat it as privileged and keep standing assignments to a minimum.
- Turn on critical action approval. Two-person approval governs any attempt to shorten the 90 day grace period before offboarded backups are permanently deleted.
- Billing is a security dependency. Offboarding also starts when the pay-as-you-go billing account becomes unhealthy, so protect the Azure subscription and monitor its health like any other recovery control.
How identity and access work in Microsoft 365 Backup
Microsoft 365 Backup is enabled from the Microsoft 365 admin center under Settings > Microsoft 365 Backup, after pay-as-you-go billing is linked to an Azure subscription. It protects three kinds of protection unit: a OneDrive account, a SharePoint site or an Exchange mailbox. Access to everything the tool can do comes from Microsoft Entra ID roles, so identity controls on those roles are the main security boundary.
| Element | How it works | Customer decision |
|---|---|---|
| Protection policies | One or more policies per service select which sites, accounts and mailboxes are protected, including dynamic inclusion rules | Protect every mailbox and account by rule, then add high value sites explicitly |
| Recovery window | Default one year; SharePoint and OneDrive policies can use 3 months, 6 months or 1 to 10 whole years (added 31 October 2026) | Match the window to the longest dwell time you expect, not only to compliance minimums |
| Storage and isolation | Data stays within the tenant, its Microsoft 365 trust boundary and existing data residency; SharePoint and OneDrive use append-only storage and Exchange backups cannot be reached by clients such as Outlook, OWA or MFCMAPI | Rely on this for isolation from user and client tampering; protect the admin plane separately |
| Deletion of backups | Backups are immutable unless deleted through offboarding by a Backup admin, which starts a grace period (90 days standard) | Configure critical action approval and watch offboarding events |
| Encryption keys | Microsoft states customer key (BYOK) integrates with Microsoft 365 Backup | Include backup in key management and key revocation planning |
Backup is one layer in a wider Microsoft 365 design. See the Microsoft 365 Security Guide and the SharePoint and OneDrive Security Guide.
Admin roles and privileged access
Microsoft's setup documentation lists the roles that can operate the tool. Plan assignments so that no one person can both disable protection and approve the faster deletion of what is left.
| Role | Scope in Microsoft 365 Backup | Recommended use |
|---|---|---|
| Global Administrator | Set up and manage OneDrive, SharePoint and Exchange backup; removes the read-only lock on new URL restores | Emergencies only, as Microsoft recommends; break-glass accounts |
| Microsoft 365 Backup Administrator | Controls the whole tool across all three services; views all activity logs | Small named group, eligible through just-in-time activation |
| SharePoint Administrator | Set up and manage OneDrive and SharePoint backup | Service owners for SharePoint and OneDrive |
| Exchange Administrator | Manage Exchange backup | Exchange service owners |
| SharePoint Backup Admin | Required for granular file and folder restore (generally available 2 September 2026) | Help desk or service desk staff who handle file recovery |
| Billing and Azure roles | Owner or Contributor on the Azure subscription and resource group used for billing | Separate team from Backup admins, with alerts on changes |
- Just-in-time access: make Backup Administrator, SharePoint Administrator and Exchange Administrator eligible rather than permanent, require MFA and an approval on activation, and alert on every activation. The Entra roles reference does not mark the Backup Administrator role as privileged, so add it to your own privileged role list. See the Privileged Identity Management (PIM) Guide.
- Phishing-resistant sign-in: require phishing-resistant MFA and compliant devices for these roles through Conditional Access. See Microsoft 365 admin centres and admin roles.
- Critical action approval: under Settings > Microsoft 365 Backup > Backup critical action approval, a Global Admin or Backup Admin nominates at least two approvers (no one can nominate themselves). Two approvals are needed to shorten the deletion grace period from 90 to 7 days; with three or more approvers the requester is excluded, new approvers wait two days before they can approve, and requests expire after 30 days. With fewer than two aged approvers the tenant stays at 90 days. Nominate three or more approvers from different teams so the requester never counts.
- Break-glass accounts: keep emergency Global Administrator accounts outside normal Conditional Access dependencies, so you can still reach the tool if your identity provider configuration is the thing that was attacked. See the Break-Glass Account Guide.
Integrations, API tokens and service accounts
Microsoft 365 Backup exposes the Microsoft 365 Backup Storage APIs in Microsoft Graph through the backupRestoreRoot resource. It covers protection policies for each service, protection units, inclusion rules, restore points, restore sessions, email notification settings and reports. These APIs are application identities with tenant-wide reach, so govern them as non-human identities.
- Permission scope: enabling the service uses
BackupRestore-Control.ReadWrite.All, available as both delegated and application permission. Microsoft documents these APIs as intended for registered Backup Controller applications, and calls through Microsoft Graph PowerShell return 403. Grant application permissions only to the controller app that needs them, and record an owner. - Partner applications: independent software vendors can build on the Microsoft 365 Backup Storage platform; operation and billing then run through the partner's application. Microsoft's FAQ notes that control can be moved from the first-party tool to a partner application but not yet moved back without a support ticket, so decide deliberately.
- Credentials: use certificate credentials or managed identities rather than client secrets for controller apps, store them in a vault, and rotate them on a schedule. See the Microsoft 365 Application Access Policies and RBAC for Applications Guide.
- Review consents: include any app holding a BackupRestore permission in quarterly app registration reviews, with the same rigour as apps holding mail permissions. See How to review Microsoft 365 app registrations with mail permissions.
Logging and detection
Microsoft gives two log sources. Microsoft Purview Audit is the system of record for investigations and records Backup activities such as creating a policy and restoring. The in-product Activity Logs (Microsoft 365 admin center, Microsoft 365 Backup, Reports > Recent activities > View more, added 13 October 2026) keep 365 days and up to 1 million activities, exportable to CSV. Read-only actions such as listing restore points are not logged.
| Activity | Impact level (Microsoft) | What to do |
|---|---|---|
| Pause or delete backups, policy deletion | High | Page the on-call team; confirm a change ticket exists |
| Product-level or protection-unit offboarding | High | Treat as a possible attack on recovery (ATT&CK T1490); verify within the hour |
| Large CSV-based restores | High | Confirm it matches an incident or planned exercise; in-place restores overwrite current content |
| Policy activation or modification, dynamic rule changes | Medium | Check that coverage did not shrink |
| Policy creation or rename | Low | Record for change review |
- Email notifications: turn on notifications on the Microsoft 365 Backup home page and add up to 20 recipients, distribution lists or security groups to the Backup Notification List. Microsoft highly recommends this at least for potentially harmful events. Include a security operations mailbox.
- SIEM: forward Purview Audit records for Backup into your SIEM and correlate them with role activations, Conditional Access changes and Azure billing changes. See the Microsoft 365 Unified Audit Log Guide for Detection.
- Billing health: alert on changes to the pay-as-you-go configuration, the Azure subscription, its resource group and payment status, since unhealthy billing triggers offboarding.
Useful metrics: percentage of mailboxes, OneDrive accounts and sites covered by a policy; time from a new user or site appearing to its first restore point; number of standing Backup Administrator assignments (target zero); restore exercises completed per quarter and their measured duration; and time to triage High impact activities.
Hardening baseline
- Set up billing on a dedicated subscription. Use an Azure subscription and resource group reserved for Microsoft 365 Backup, with a small Owner group, resource locks and budget alerts. Estimate cost first with Microsoft's pricing calculator: the pricing page lists $0.15 per GB per month of protected content, pay-as-you-go and consumption-based, with no additional Azure API or storage costs.
- Protect everything by rule. Create Exchange and OneDrive policies with dynamic inclusion rules so new users are covered automatically, and a SharePoint policy that covers all sites or every site created from your templates. Check Microsoft's list of unsupported site templates.
- Choose the recovery window. For SharePoint and OneDrive pick from 3 months, 6 months or 1 to 10 years; set it at least as long as your incident detection gap plus investigation time.
- Lock down roles. Make all Backup-capable roles eligible through PIM, require phishing-resistant MFA, and keep Global Administrator for emergencies.
- Configure critical action approval with three or more approvers from different teams.
- Turn on notifications and logging. Add a security mailbox to the Backup Notification List and stream Purview Audit records to the SIEM.
- Test restores. Restore a sample site and OneDrive to a new URL and an Exchange mailbox each quarter. Microsoft asks customers to limit test restores to two per month per protection unit; real recovery restores are not limited.
- Write the runbook. Document when to use in-place versus new URL restores, how to handle deleted users, and who removes the read-only lock. Link it from the Microsoft 365 Ransomware and Mass Deletion Playbook.
Choosing a restore type
| Restore | Use when | What to know |
|---|---|---|
| Full in-place (OneDrive or SharePoint) | A site or account was encrypted or mass deleted | Fastest, especially from an express restore point; replaces content and permissions with the chosen point, overwriting later edits |
| Restore to new URL | You need to compare or keep current content | New site with an R suffix, read-only until a Global Administrator removes the lock; copy data back to roll forward |
| Granular files and folders | A few files are lost or damaged | Last 14 days only, from a single folder, needs SharePoint Backup Admin; item-level permissions are not restored |
| Exchange mailbox items | Mail was changed, purged or deleted to Recoverable Items | Restores to the same mailbox only; drafts are not backed up; items merely moved to Deleted Items are recovered by the user |
Microsoft's targets are under one hour on average for the first full site or account, and under 12 hours for 1,000 units averaging 10 GB. Measure your own times in exercises rather than relying on targets.
Common misconfigurations
- Treating retention as backup: version history and retention holds are bounded by version limits and are optimised for export, not mass restore. Use Microsoft 365 Backup for rollback and keep retention for compliance.
- Static policy membership: policies built from a one-time list leave new joiners and new sites unprotected. Use dynamic inclusion rules and report coverage monthly.
- Standing Backup Administrator assignments: a permanently assigned account that is phished can pause policies and start offboarding. Use eligible assignments with approval.
- Approval roster of two: with exactly two approvers the requester's own approval counts. Nominate three or more.
- Wrong inactive mailbox process: for a permanently deleted user, use Purview "Recover an inactive mailbox"; "Restore an inactive mailbox" does not preserve backup data. For users deleted within 30 days, restore the user first.
- Unwatched billing: an expired payment method or a deleted subscription can start offboarding. Give the subscription an owner and alerts.
- Forgetting re-applied deletions: GDPR deletion requests do not delete backup data, so data restored from backup must have those requests re-run.
Framework mapping
| Control area | NIST CSF 2.0 | NIST SP 800-53 Rev 5 | CIS Controls v8.1 | ISO/IEC 27001:2022 |
|---|---|---|---|---|
| Backup policies and coverage | PR.DS-11 | CP-9 | 11.2 | A.8.13 |
| Restore testing and runbooks | RC.RP-03 | CP-10 | 11.5 | A.5.30 |
| Protecting backup admin roles | PR.AA-05 | AC-6 | 5.4, 6.5 | A.8.2 |
| Monitoring backup activity | DE.CM-03 | AU-6 | 8.11 | A.8.15 |
The attacker behaviours this design counters are Data Destruction (T1485), Data Encrypted for Impact (T1486) and Inhibit System Recovery (T1490). For tenant-wide incidents see the Microsoft 365 Tenant Compromise Playbook, and for keeping backup identities apart from production identities see the Backup Identity Isolation Guide.
Practitioner checklist
- Link billing to a dedicated Azure subscription with a named owner, locks and health alerts.
- Create Exchange, OneDrive and SharePoint policies with dynamic inclusion rules.
- Set the recovery window for SharePoint and OneDrive to cover your detection and investigation gap.
- Make every Backup-capable role eligible through PIM with phishing-resistant MFA and approval.
- Configure Backup critical action approval with three or more approvers from different teams.
- Add a security mailbox to the Backup Notification List and forward Purview Audit records to the SIEM.
- Alert on High impact activities: pause, delete, offboarding and large restores.
- Review apps holding BackupRestore Graph permissions quarterly.
- Run quarterly restore tests to a new URL and an Exchange mailbox, and record the times.
- Document deleted-user and inactive mailbox procedures in the recovery runbook.
Standards and references
- Microsoft Learn: Overview of Microsoft 365 Backup
- Microsoft Learn: Set up Microsoft 365 Backup
- Microsoft Learn: Restore data in Microsoft 365 Backup
- Microsoft Learn: Microsoft 365 Backup privacy and security
- Microsoft Learn: Offboarding in Microsoft 365 Backup
- Microsoft Learn: Microsoft 365 Backup pricing
- Microsoft Graph: backupRestoreRoot resource
- NIST: SP 800-53 Rev. 5
Related NHI Mgmt Group resources: SaaS Backup Buyer's Guide · Backup Security and Immutable Backup Guide · Exchange Online Security Guide · Backup and Recovery Testing Checklist · Microsoft 365 Security Checklist