This chapter covers the Microsoft 365 Backup solution, a service that provides an independent, immutable backup for Exchange Online, SharePoint Online, OneDrive for Business, and Microsoft Teams. Understanding this solution is critical for the MS-102 exam, as it addresses a key gap in native data protection and is a growing focus area. Approximately 10-15% of exam questions in the Tenant Management domain relate to backup, recovery, and data protection strategies. You will learn the architecture, configuration, restoration process, pricing, and how it differs from native retention and eDiscovery capabilities.
Jump to a section
Imagine a large corporate library where every book (your Microsoft 365 data) is stored on open shelves. The librarian (Microsoft) ensures books are always available, but occasionally a book gets damaged, lost, or vandalized. The library has a secure vault (Microsoft 365 Backup) in a separate building. Every night, a clerk makes a photocopy of every page of every book and stores it in the vault. The vault has its own index, so the clerk can quickly find any page from any book on any date. When a book is damaged, the librarian can request a new copy from the vault. The clerk retrieves the exact photocopy from the desired date, rebinds it, and places it back on the shelf. Importantly, the vault is not a live branch; it's a snapshot repository. If a patron writes in a book (modifies data), the next night's photocopy captures that change. The library also has a separate disaster recovery site (another library across town) that copies the entire shelf contents hourly (native redundancy), but that doesn't help if a book is vandalized and the vandalism replicates. The vault's nightly photocopies are independent and immutable—once stored, they cannot be altered. The librarian can also set a retention policy: keep photocopies for 30 days for standard books, 1 year for rare manuscripts. The vault's capacity is virtually unlimited, but the cost is per gigabyte of photocopies stored. If the librarian needs to restore a single page or an entire section, the vault can provide it. This is how Microsoft 365 Backup works: it's a separate, immutable backup store with granular restore capabilities, independent of native redundancy.
What is Microsoft 365 Backup and Why Does It Exist?
Microsoft 365 Backup is a SaaS-based backup service that provides an independent, immutable, and off-site copy of your Microsoft 365 data. It was introduced in 2023 to address a long-standing gap: native Microsoft 365 data protection relies on retention policies, recycle bins, and legal hold, but these are not true backups. Native protection is subject to the same service vulnerabilities—ransomware, accidental deletion by admins, or malicious insider actions can permanently destroy data if retention policies are misconfigured or bypassed. Microsoft 365 Backup creates a separate copy stored in Microsoft's backup storage, isolated from the production data plane. It supports Exchange Online (mailboxes, public folders), SharePoint Online (sites, lists, libraries), OneDrive for Business (user accounts), and Microsoft Teams (channels, chat messages, files). The service is designed for granular, item-level restore with point-in-time recovery.
How It Works Internally
Microsoft 365 Backup operates by taking periodic snapshots of the data. For Exchange Online, it uses the Exchange Web Services (EWS) or Graph API to export mailbox content. For SharePoint and OneDrive, it uses the SharePoint Online CSOM (Client Side Object Model) or Graph API. These snapshots are stored in a separate, immutable storage tier within Microsoft's Azure infrastructure. The backup process is: - Initial Full Backup: When you first enable backup for a workload, a full copy of all data is taken. This can take hours to days depending on data volume. - Incremental Backups: After the initial backup, only changes are captured. For Exchange, this is typically every 12 hours (default). For SharePoint and OneDrive, it's every 12 hours as well. These intervals are not configurable by the tenant admin. - Retention: You can set retention periods from 1 to 365 days for Exchange and SharePoint/OneDrive/Teams. The default is 30 days. After the retention period expires, the backup is automatically deleted. You can also set a minimum retention of 14 days. - Immutability: Backups are stored in a Write Once, Read Many (WORM) state. No user, including global admins, can modify or delete backups before the retention period ends. This protects against ransomware and malicious deletion. - Restoration: When you initiate a restore, the service retrieves the backup from the immutable store and writes it back to the production environment. Restores are point-in-time: you can choose a specific date and time (within the retention window) to restore from. Restores are item-level: you can restore a single email, a document, a SharePoint list item, or an entire site.
Key Components, Values, and Defaults
Backup Storage Quota: You are allocated 50 GB of backup storage per user for Exchange, and 50 GB per user for SharePoint/OneDrive/Teams. If you exceed this, you pay overage charges.
Pricing: As of 2025, pricing is consumption-based: $0.15 per GB per month for backup storage (first 50 GB per user included in the per-user license). There is also a restore cost: $0.05 per GB restored. These prices are subject to change.
Licensing: Microsoft 365 Backup is an add-on to Microsoft 365 subscriptions. You need a Microsoft 365 E3, E5, Business Premium, or equivalent license for each user whose data is backed up. There is no per-user license fee for the backup service itself; you pay only for storage and restore.
Supported Workloads: Exchange Online (mailboxes, archive mailboxes, public folders), SharePoint Online (sites, lists, libraries), OneDrive for Business (user accounts), Microsoft Teams (channels, chats, files). Note: Microsoft 365 Groups and Yammer are not supported as separate workloads but may be partially covered through SharePoint and Exchange.
Retention Range: 1 to 365 days. Default is 30 days. You can set different retention periods for each workload.
Restore Granularity: Item-level for Exchange (single email, calendar event, contact), site-level for SharePoint (document library, list, site), user-level for OneDrive (folders, files), and channel-level for Teams (messages, files).
Frequency: Backups occur automatically every 12 hours. You cannot trigger on-demand backups, but you can request a one-time backup by contacting support.
Data Residency: Backups are stored in the same region as your tenant's primary data (e.g., North America, Europe). You cannot choose a different region for backups.
Configuration and Verification Commands
Configuration is done through the Microsoft 365 admin center or via PowerShell (Exchange Online PowerShell and SharePoint Online Management Shell).
Enable Backup for Exchange Online (PowerShell):
Connect-ExchangeOnline
Set-OrganizationConfig -BackupEnabled $trueThis enables backup for all mailboxes in the tenant. To check status:
Get-OrganizationConfig | Select BackupEnabledEnable Backup for SharePoint/OneDrive/Teams (PowerShell):
Connect-SPOService -Url https://[tenant]-admin.sharepoint.com
Set-SPOTenant -BackupEnabled $trueTo verify:
Get-SPOTenant | Select BackupEnabledSet Retention Period (Exchange Online PowerShell):
Set-OrganizationConfig -BackupRetentionDays 90Valid values: 1 to 365. Default: 30.
Set Retention Period (SharePoint Online PowerShell):
Set-SPOTenant -BackupRetentionDays 90Initiate a Restore (via Admin Center): - Navigate to Admin centers > Backup (preview). - Select the workload (Exchange, SharePoint, OneDrive, Teams). - Choose the user or site. - Select the point-in-time (date and time). - Choose items to restore. - Confirm restore.
Restores can also be initiated via PowerShell using Restore-Mailbox and Restore-SPOSite cmdlets, but the admin center is the primary interface.
How It Interacts with Related Technologies
Native Retention Policies: Microsoft 365 Backup is independent of native retention policies (e.g., litigation hold, eDiscovery hold, retention labels). Even if a retention policy is deleted or misconfigured, the backup copy remains intact. However, if data is deleted before the backup snapshot, the next backup will not include that data. So, if you delete a mailbox and then immediately take a snapshot (which you can't control), the backup may miss it. But the previous snapshot still exists.
Recycle Bin: The SharePoint and OneDrive recycle bins have a 93-day retention (for sites without a retention policy). Microsoft 365 Backup provides an additional layer beyond that. If an item is deleted from the recycle bin, the backup can still restore it.
eDiscovery: eDiscovery holds preserve data for legal purposes but do not create immutable copies. Backup is not a substitute for eDiscovery but complements it.
Azure Backup: Microsoft 365 Backup is separate from Azure Backup. Azure Backup protects IaaS VMs, SQL Server, and on-premises workloads. Microsoft 365 Backup is specifically for SaaS data.
Third-Party Backup Solutions: Many organizations use third-party backup tools (e.g., Veeam, Commvault) that also use Graph APIs. Microsoft 365 Backup offers native integration and potentially lower cost, but third-party solutions may offer more features (e.g., longer retention, cross-tenant backup).
Enable Backup for the Tenant
In the Microsoft 365 admin center, navigate to Settings > Org settings > Services > Backup. Alternatively, use PowerShell as described. This step enables the backup service for all supported workloads. The tenant admin must have Global Administrator or SharePoint Administrator (for SharePoint) and Exchange Administrator (for Exchange) roles. Once enabled, the initial backup begins within 24 hours. There is no option to exclude specific users or sites at the tenant level; you enable backup for the entire tenant. However, you can later restore only specific items.
Initial Full Backup
After enabling, the service performs a full backup of all supported data. For Exchange, this includes all mailboxes, archive mailboxes, and public folders. For SharePoint, all site collections (including Teams-connected sites) are backed up. For OneDrive, all user OneDrive accounts. The initial backup can take several days depending on data volume. During this time, backup status shows 'In progress' in the admin center. The backup is stored in the immutable storage. There is no impact on production performance.
Incremental Backups Every 12 Hours
After the initial full backup, the service takes incremental snapshots approximately every 12 hours. These capture changes made since the last snapshot. The exact timing is managed by Microsoft and is not configurable. Incremental backups are much faster and consume less storage than full backups. The backup storage consumption increases over time as changes accumulate, but old snapshots are deleted after the retention period ends.
Configure Retention and Monitor
The admin can set the retention period (1-365 days) per workload via PowerShell or admin center. Default is 30 days. Monitoring is done via the Backup dashboard in the admin center, which shows backup status, storage usage, and restore history. Alerts can be configured for backup failures (e.g., if a backup job fails due to throttling). Storage usage is reported in GB and compared to the included quota (50 GB per user). Overage charges apply beyond the quota.
Perform a Restore
To restore data, go to Admin centers > Backup > select workload > choose user/site > select point-in-time > choose items > confirm. The restore process retrieves the data from the immutable backup store and writes it back to the production environment. For Exchange, restored items appear in the user's mailbox in a 'Recovered Items' folder. For SharePoint and OneDrive, restored files overwrite existing files or are placed in a 'Restored' folder if the original location is occupied. Restores can take minutes to hours depending on data volume. During restore, the service uses the tenant's outbound data transfer quota (if any) but no additional charges for internal restores within the same region.
Enterprise Scenario 1: Ransomware Recovery
A multinational corporation with 10,000 users experiences a ransomware attack that encrypts all SharePoint Online document libraries and OneDrive files. The attack also deletes many files. Native protection (recycle bin) is overwhelmed because the attacker systematically emptied recycle bins. The company has enabled Microsoft 365 Backup with a 90-day retention. The security team isolates the tenant, identifies the last known clean snapshot (e.g., 2 days before the attack), and initiates a bulk restore of all affected SharePoint sites and OneDrive accounts. The restore takes 48 hours due to the volume (50 TB of data). After restore, all files are recovered to their pre-attack state. The backup immutability prevented the attacker from deleting backups. The cost: storage of 50 TB at $0.15/GB/month = $7,500/month; restore cost of 50 TB at $0.05/GB = $2,500. This is significantly cheaper than paying ransom.
Enterprise Scenario 2: Accidental Deletion by Admin
A junior SharePoint admin accidentally deletes a critical site collection containing 5 years of project data. The site is not in the recycle bin because the admin performed a 'Remove-SPOSite' with -NoWait flag, which bypasses the recycle bin. The company has backup enabled with 365-day retention. The senior admin opens the Backup dashboard, selects the site, chooses a point-in-time from yesterday, and restores the entire site. The restore completes in 2 hours. The restored site appears with a suffix '-restored' to avoid naming conflicts. The admin then renames it and restores permissions. This scenario highlights the value of backup for administrative errors that bypass native protection.
Scenario 3: Compliance and Audit Requirements
A financial services firm must retain all communications for 7 years for regulatory compliance. They use Microsoft 365 Backup with maximum retention of 365 days, but that's insufficient. They combine backup with native retention policies (litigation hold) that preserve data indefinitely. Backup provides a secondary, immutable copy for operational recovery (e.g., accidental deletion within 1 year), while litigation hold ensures long-term retention. The firm also uses backup to restore data for eDiscovery requests quickly, without impacting production. Misconfiguration: if they set backup retention to 30 days, they lose the ability to recover data older than 30 days. They must understand that backup is not a long-term archive.
What MS-102 Tests on This Topic
Objective 1.5: Implement and manage Microsoft 365 Backup. The exam expects you to know: (1) How to enable backup for each workload (Exchange, SharePoint, OneDrive, Teams). (2) Default retention period (30 days) and valid range (1-365). (3) Backup frequency (every 12 hours). (4) Immutability feature. (5) Pricing model (per GB storage, per GB restore). (6) Restore granularity (item-level for Exchange, site-level for SharePoint). (7) Licensing requirements (E3/E5/Business Premium). (8) How backup differs from native retention and eDiscovery.
Common Wrong Answers and Why
'Backup is enabled by default.' Wrong. Backup must be explicitly enabled. Many candidates assume it's automatic because Microsoft 365 has built-in data protection. Reality: You must enable it via admin center or PowerShell.
'You can set backup frequency to hourly.' Wrong. Frequency is fixed at every 12 hours. Candidates confuse backup frequency with native replication (which is near real-time).
'Backup replaces eDiscovery hold.' Wrong. Backup is for operational recovery; eDiscovery hold is for legal preservation. They serve different purposes.
'You can restore data from any point within the retention period.' Partially true, but the exam emphasizes that you can only restore from snapshots taken every 12 hours. You cannot restore to an arbitrary minute.
'Backup storage is unlimited.' Wrong. There is a 50 GB per user quota; overage charges apply.
Specific Numbers and Terms
Default retention: 30 days. Range: 1-365 days.
Backup frequency: Every 12 hours.
Storage quota: 50 GB per user (Exchange) and 50 GB per user (SharePoint/OneDrive/Teams).
Pricing: $0.15/GB/month storage; $0.05/GB restore.
Licensing: Requires Microsoft 365 E3/E5/Business Premium (or equivalent).
Workloads: Exchange Online, SharePoint Online, OneDrive for Business, Microsoft Teams.
Immutable: Backups cannot be modified or deleted before retention expires.
Restore location: Exchange restores go to 'Recovered Items' folder; SharePoint/OneDrive restores overwrite or create 'Restored' folder.
Edge Cases and Exam Traps
Deleted users: If a user is deleted, their backup data is retained for the retention period. You can restore their data to another mailbox or export. The exam might ask: 'What happens to backup data when a user is deleted?' Answer: It remains until retention expires.
Backup for Teams: Teams data is backed up through its underlying SharePoint site (files) and Exchange mailbox (chat messages). The exam might ask which workloads are directly backed up. Answer: Teams is listed as a workload, but technically it's a combination of SharePoint and Exchange.
Cross-region restore: Not supported. Backups are stored in the same region as the tenant. You cannot restore to a different region.
Restore during outage: If Microsoft 365 is partially unavailable, restores may fail. The exam might test that backup is not a disaster recovery solution for the service itself.
How to Eliminate Wrong Answers
If an option says 'backup is automatic,' it's wrong unless it says 'after enabling.'
If an option mentions 'hourly backups,' it's wrong.
If an option says 'unlimited storage,' it's wrong.
If an option says 'backup replaces retention policies,' it's wrong.
Focus on the technical mechanism: snapshots every 12 hours, immutable store, granular restore.
Microsoft 365 Backup must be explicitly enabled; it is not automatic.
Default retention is 30 days; configurable from 1 to 365 days.
Backups are taken automatically every 12 hours (not configurable).
Backups are immutable; cannot be modified or deleted before retention expires.
Storage quota is 50 GB per user (Exchange) and 50 GB per user (SharePoint/OneDrive/Teams).
Restore granularity: item-level for Exchange, site-level for SharePoint/OneDrive/Teams.
Pricing: $0.15/GB/month storage (after quota), $0.05/GB restore.
Licensing: Requires Microsoft 365 E3, E5, or Business Premium (or equivalent).
Backup does not replace native retention or eDiscovery; it complements them.
Deleted users' backup data is retained for the configured retention period.
These come up on the exam all the time. Here's how to tell them apart.
Microsoft 365 Backup
Creates independent, immutable copies of data.
Backups are stored separately from production data in a WORM store.
Allows point-in-time restore to previous snapshots (every 12 hours).
Backup storage costs $0.15/GB/month after quota.
Retention range: 1-365 days.
Native Retention Policies (e.g., Litigation Hold)
Preserves data in-place using holds and retention labels.
Data remains in the same database; can be modified by authorized users.
Does not allow point-in-time restore; data is preserved as-is.
Included in Microsoft 365 subscription (no extra cost).
Retention can be indefinite or based on age/event.
Mistake
Microsoft 365 Backup is enabled by default for all tenants.
Correct
False. Backup must be explicitly enabled by a Global Admin via the admin center or PowerShell. There is no automatic backup.
Mistake
You can take on-demand backups whenever you want.
Correct
False. Backups are automatically taken every 12 hours. You cannot manually trigger a backup. You can request a one-time backup via support, but this is not a standard feature.
Mistake
Backup storage is free with Microsoft 365 E5.
Correct
False. Backup storage costs $0.15/GB/month after the first 50 GB per user (included). Restore also costs $0.05/GB. There is no per-user license fee, but storage and restore are metered.
Mistake
You can restore data from any point in time within the retention period.
Correct
Partially false. You can restore from the most recent snapshot or any previous snapshot (taken every 12 hours). You cannot restore to a specific minute that falls between snapshots. The exam tests that snapshots are taken every 12 hours.
Mistake
Microsoft 365 Backup protects against all forms of data loss.
Correct
False. It protects against accidental deletion, ransomware, and insider threats by providing an immutable copy. However, it does not protect against service-wide outages (e.g., Azure region failure) because backups are stored in the same region as the tenant. It also does not replace eDiscovery or long-term archiving.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
Enable backup via the Microsoft 365 admin center: go to Settings > Org settings > Services > Backup, then toggle the switch on. Alternatively, use PowerShell: for Exchange, run Set-OrganizationConfig -BackupEnabled $true; for SharePoint, run Set-SPOTenant -BackupEnabled $true. You need Global Admin or appropriate workload admin roles. Once enabled, the initial backup starts within 24 hours. There is no option to enable backup for only some users; it's tenant-wide.
Yes, for Exchange Online, you can restore individual items such as emails, calendar events, contacts, and tasks. In the Backup dashboard, select the user, choose the point-in-time, then browse the mailbox and select specific items to restore. Restored items appear in the user's 'Recovered Items' folder. For SharePoint and OneDrive, you can restore individual files or folders. For Teams, you can restore channel messages and files.
The backup data for that user is retained for the configured retention period (e.g., 30 days). After the retention period ends, the backup is automatically deleted. During the retention period, you can restore the user's data to another mailbox or export it. The backup is not deleted immediately upon user deletion. This is a key exam point: backup outlives the user until retention expires.
As of 2025, Microsoft 365 Backup is available in most commercial regions where Microsoft 365 is offered, including North America, Europe, Asia Pacific, and others. However, it may not be available in sovereign clouds (e.g., GCC, GCC High, DoD) or in all government regions. Check Microsoft documentation for region-specific availability. Backups are stored in the same region as your tenant's primary data.
No, Microsoft 365 Backup does not support cross-tenant restores. You can only restore data to the same tenant from which it was backed up. For cross-tenant migration, you would need third-party tools or manual export/import. The exam may test that backup is tenant-specific.
Teams data is backed up through its underlying components: channel messages are stored in the Exchange Online mailbox of the group, and files are stored in the SharePoint Online site. When you enable backup for both Exchange and SharePoint, Teams data is covered. The Backup dashboard includes a separate 'Teams' workload for convenience, but technically it's a combination. You can restore Teams channel messages and files individually.
If your backup storage exceeds the included 50 GB per user (for each workload), you are charged $0.15 per GB per month for the overage. For example, if you have 100 users and your Exchange backup storage is 6,000 GB (60 GB per user), you have 1,000 GB over the 5,000 GB quota (100 users * 50 GB). The overage cost is 1,000 GB * $0.15 = $150 per month. Restore costs are additional at $0.05 per GB restored.
You've just covered Microsoft 365 Backup Solution — now see how well it sticks with free MS-102 practice questions. Full explanations included, no account needed.
Done with this chapter?