Enterprise guide to the shared responsibility model, backup strategies, third-party tools, retention policies, RPO/RTO planning, and DR testing for your entire Microsoft 365 environment.
Microsoft 365 Disaster Recovery Business Continuity Guide 2026 — enterprise reference guide from EPC Group, built since 1997 of Microsoft consulting engagements at Fortune 500 scale. Covers architecture, governance, compliance, pricing benchmarks, and implementation timelines for the Microsoft ecosystem.
By Errin O'Connor, Founder & Chief AI Architect, EPC Group
Do you need disaster recovery for Microsoft 365? Yes, you do. Microsoft offers a 99.9% SLA for platform uptime. However, this does not ensure that your data is recoverable in every situation. Under the shared responsibility model, you, the customer, are responsible for:
Note that native recycle bins have a 93-day limit. There is no option for point-in-time mailbox restore. Also, data from users who have left is deleted after 30 days.
EPC Group recommends using third-party backup for every enterprise Microsoft 365 tenant. This backup should aim for:
These targets should apply across all services.
The most dangerous assumption in enterprise IT is that Microsoft backs up your Microsoft 365 data. This is not true — at least not in the way you need.
Microsoft does replicate your data across geo-redundant data centers. This protects against their infrastructure failures. However, it does not cover all scenarios.
In these cases, Microsoft replication simply replicates the damage.
EPC Group has helped organizations recover from every one of these scenarios — and the ones that had backup in place recovered in hours. The ones that did not had permanent data loss. This guide covers exactly what you need to protect your Microsoft 365 environment from data loss scenarios that Microsoft native features cannot address.
We address several key areas to enhance your recovery strategy:
Understanding who is responsible for what is the foundation of Microsoft 365 data protection. Microsoft protects the platform. You protect the data.
| Responsibility Area | Microsoft | Customer | Details |
|---|---|---|---|
| Data Center Infrastructure | - | Physical security, power, cooling, networking, hardware replacement | |
| Platform Availability (99.9% SLA) | - | Service uptime, geo-redundant replication, failover between data centers | |
| Operating System & Application Patching | - | Security patches, feature updates, vulnerability remediation | |
| Data Backup & Point-in-Time Recovery | - | Third-party backup, granular restore, long-term retention beyond native limits | |
| Accidental/Malicious Deletion Recovery | - | Native recycle bins have time limits. After expiry, data is unrecoverable without backup. | |
| Retention Policy Configuration | - | Define and apply retention policies per compliance requirements (HIPAA, SOX, FINRA) | |
| Account Security & Access Control | - | MFA, Conditional Access, identity protection, insider threat management | |
| Ransomware Protection & Recovery | - | Endpoint protection, backup for recovery, incident response procedures | |
| Regulatory Compliance Evidence | - | Audit logs, retention proof, data governance documentation for regulators | |
| Business Continuity Planning | - | DR procedures, communication plans, RTO/RPO targets, testing cadence |
Key Takeaway: Microsoft handles 3 out of 10 data protection areas. You are responsible for the remaining 7. The most important customer responsibilities include:
Organizations often find themselves unprepared in several key areas. Microsoft service agreement Section 6b states: "We recommend that you regularly backup Your Content and Data that you store on the Services."
Each Microsoft 365 service has different native recovery options — and different gaps. Understanding these gaps is essential for building a complete backup strategy.
Deleted Items (14-30 days), Recoverable Items folder (14-30 days), Litigation Hold (indefinite), In-Place Archive
No point-in-time mailbox restore, no recovery after recoverable items period, litigation hold is not a backup (cannot selectively restore)
Third-party backup with 1-hour RPO, 4-hour RTO for mailbox restore
First-stage recycle bin (93 days), Second-stage recycle bin (93 days after user delete), Version history (up to 500 versions)
No recovery after 93-day window, version history counts toward quota, site collection deletion by admin bypasses recycle bin with short recovery window
Third-party backup with 4-hour RPO, 8-hour RTO for site collection restore
Recycle bin (93 days), Version history, "Restore your OneDrive" (30-day point-in-time)
30-day restore window insufficient for late-detected ransomware, departed user OneDrive deleted after license removal (30-day grace), no granular file restore beyond version history
Third-party backup with 4-hour RPO, retain departed user data for 1+ year
Chat retention (via retention policies), Channel files (SharePoint), Channel messages (compliance records)
No native Teams backup product, chat deletion by user may not be recoverable, Teams settings and configurations not backed up, private channel content requires separate backup
Third-party backup covering chats, channels, files, and Teams configuration
Dataset version history (limited), workspace recovery (admin restore within window)
No native backup for reports, dashboards, or datasets. Deleted workspace has limited recovery window. No point-in-time restore for datasets.
Export PBIX files to version-controlled repository (Azure DevOps), automated backup scripts
Soft-delete for users (30 days), audit logs (30-90 days), Conditional Access policy export
No native backup of Conditional Access policies, group memberships, app registrations in a restorable format. Policy changes are not versioned.
Automated configuration backup via Graph API, infrastructure-as-code for policies
Enterprise Microsoft 365 backup requires a third-party solution. Native retention features assist with short-term recovery, but they do not adequately protect enterprise data.
| Tool | Coverage | Pricing | Strengths |
|---|---|---|---|
| Veeam Backup for M365 | Exchange, SharePoint, OneDrive, Teams | $2-4/user/month | Industry leader, fastest restore speeds, self-hosted or cloud, unlimited retention, granular search |
| AvePoint Cloud Backup | Exchange, SharePoint, OneDrive, Teams, Groups | $3-5/user/month | Strong SharePoint expertise, compliance reporting, automated DR testing, SaaS deployment |
| Commvault Metallic | Exchange, SharePoint, OneDrive, Teams, Entra ID | $3-6/user/month | Enterprise-grade, multi-cloud, advanced search and eDiscovery, Entra ID backup |
| Druva inSync | Exchange, SharePoint, OneDrive, Teams | $4-6/user/month | Pure SaaS (no infrastructure), automated compliance, legal hold, global deduplication |
| Microsoft 365 Backup | Exchange, SharePoint, OneDrive (expanding) | Pay-per-use (preview pricing) | Native Microsoft integration, fast restore via Microsoft infrastructure, no third-party dependency |
EPC Group Recommendation: For most enterprise deployments, we recommend Veeam Backup for Microsoft 365. It provides:
For organizations looking to remove infrastructure management, Druva inSync is the leading pure-SaaS option.
We are closely monitoring Microsoft 365 Backup (Preview). We will recommend it once it is fully available and supports Teams completely.
The Recovery Point Objective (RPO) indicates the amount of data you can afford to lose. The Recovery Time Objective (RTO) specifies the time available for recovery. These two metrics influence all decisions regarding backup architecture, including:
| Service | Standard RPO | Standard RTO | Critical RPO | Critical RTO |
|---|---|---|---|---|
| Exchange Online | 4 hours | 8 hours | 1 hour | 2 hours |
| SharePoint Online | 4 hours | 8 hours | 1 hour | 4 hours |
| OneDrive for Business | 4 hours | 4 hours | 1 hour | 2 hours |
| Microsoft Teams | 4 hours | 8 hours | 1 hour | 4 hours |
| Power BI | 24 hours | 24 hours | 4 hours | 8 hours |
| Entra ID Config | 24 hours | 4 hours | 4 hours | 1 hour |
Standard RPO/RTO targets are suitable for general business data. However, critical targets are necessary for:
The cost difference between standard and critical targets is about 2-3 times higher in backup infrastructure and licensing.
EPC Group holds business impact analysis (BIA) workshops. These workshops help us identify the right RPO/RTO for each service and data classification.
Next, we size and set up backup infrastructure to meet these targets. We also validate our configurations through quarterly disaster recovery (DR) testing.
A backup that has never been tested is not a backup — it is a hope. EPC Group DR testing validates that recovery actually works within your RPO/RTO targets.
Restore a random mailbox, SharePoint site, and OneDrive account from backup. Verify data completeness and integrity. Log actual restore time. Compare to RTO target.
Metric: Pass/Fail: Restore within RTO?
Simulate a real incident: ransomware recovery, departed employee data restoration, accidental admin deletion. Full end-to-end recovery including detection, escalation, and restore.
Metric: Mean time to recovery (MTTR)
Full business continuity exercise. Tenant-level recovery scenario. All service RPO/RTO validation. Communication plan testing. Executive participation. Lessons learned review.
Metric: Full BC plan validation
After every test, update recovery runbooks with actual steps, timing, and issues encountered. Keep runbooks in a location accessible during an outage (not only in the M365 tenant being recovered).
Metric: Runbook accuracy score
Retention policies serve as the first line of defense before backup. They define how long Microsoft keeps deleted and modified content. When set up correctly, retention policies can help prevent many common data loss problems. However, they should not take the place of backup solutions.
Scope: All mailboxes including shared and room mailboxes
Apply via Microsoft Purview retention policy. Covers deleted items beyond recycle bin period.
Scope: All SharePoint sites including OneDrive
Use label-based retention for CUI, PHI, or financial documents. Location-based for general content.
Scope: 1:1 chats, group chats, and channel messages
FINRA Rule 3110 requires retention of all electronic communications including Teams chat.
Scope: All terminated/departed users
Automate via lifecycle workflows in Entra ID. Prevent license removal from deleting OneDrive data.
Scope: Specific users or content relevant to legal matter
Overrides all retention policies. Content preserved until hold is released by legal team.
Scope: All Microsoft 365 audit events
E5 Advanced Audit provides 1-year retention. Export to Microsoft Sentinel for longer retention.
Yes — absolutely. Microsoft guarantees infrastructure uptime (99.9% SLA) but does NOT guarantee your data is recoverable in all scenarios. The shared responsibility model means Microsoft protects against: data center failures, hardware failures, and platform outages. YOU are responsible for protecting against: accidental deletion (user or admin), malicious insider deletion, ransomware encrypting synced files, retention policy misconfiguration, compliance holds expiring, and account compromise leading to data destruction. Microsoft native retention covers some scenarios (recycle bins, version history) but has gaps: 93-day recycle bin limits, no point-in-time restore for mailboxes, and no protection against retention policy changes. EPC Group recommends third-party backup for every enterprise Microsoft 365 environment.
Microsoft is responsible for: physical infrastructure (data centers, networking, power), platform availability (99.9% SLA with financial credits), geo-redundant replication across regions, and security of the platform itself. You are responsible for: data backup and recovery, retention policy configuration, access control and account security, protection against accidental or malicious deletion, compliance with data retention regulations, and business continuity planning. The critical gap: Microsoft replicates your data for THEIR disaster recovery (data center failure), not for YOUR disaster recovery (deleted mailbox, ransomware, departed employee wiping their OneDrive). Microsoft explicitly states in their service agreement: "We recommend that you regularly backup Your Content and Data that you store on the Services." EPC Group closes this gap with comprehensive backup and DR strategies.
Native Microsoft 365 recovery capabilities by service: Exchange Online — deleted items (14-30 days configurable), recoverable items (14-30 days), litigation hold (indefinite but not a backup). SharePoint Online — recycle bin (93 days), version history (up to 500 versions), site collection recycle bin (93 days after user deletion). OneDrive — recycle bin (93 days), version history, "Restore your OneDrive" feature (30-day point-in-time restore). Teams — chat retention (based on retention policies), channel messages (retained in SharePoint). Limitations: no granular point-in-time mailbox restore, no recovery after retention period expires, no protection if admin changes retention policies, no offline copy of data, and version history counts toward storage quotas. For enterprise compliance, these native features are insufficient.
Top enterprise Microsoft 365 backup solutions: Veeam Backup for Microsoft 365 — industry leader, supports Exchange, SharePoint, Teams, OneDrive, unlimited retention, granular restore, $2-4/user/month. AvePoint Cloud Backup — strong SharePoint/Teams coverage, compliance-focused, built-in reporting, $3-5/user/month. Commvault Metallic — enterprise-grade, multi-cloud support, advanced search, $3-6/user/month. Druva inSync — SaaS-only (no infrastructure to manage), automated compliance, legal hold, $4-6/user/month. Microsoft 365 Backup (Preview) — Microsoft native backup via Microsoft 365 Backup Storage, fast restore, currently in preview with limited GA availability. EPC Group recommends Veeam for most enterprise deployments based on restore speed, cost, and feature completeness. We deploy and manage backup solutions as part of our managed services.
RPO (Recovery Point Objective) defines maximum acceptable data loss. RTO (Recovery Time Objective) defines maximum acceptable downtime. Recommended targets by service: Exchange Online — RPO: 1 hour (backup frequency), RTO: 4 hours (mailbox restore). SharePoint Online — RPO: 4 hours, RTO: 8 hours (site collection restore). OneDrive — RPO: 4 hours, RTO: 4 hours (individual restore). Teams — RPO: 4 hours, RTO: 8 hours (channel and chat restore). For mission-critical scenarios (executive mailboxes, legal documents, financial records): RPO: 15 minutes, RTO: 1 hour. These targets drive backup frequency, storage costs, and tool selection. EPC Group sizes backup infrastructure to meet client-specific RPO/RTO requirements validated through quarterly DR testing.
Microsoft 365 DR testing should follow a structured cadence: Monthly — restore a random mailbox, SharePoint site, and OneDrive account from backup. Verify data integrity and completeness. Document restore time (validates RTO). Quarterly — simulate a major incident scenario: ransomware attack (restore encrypted files from pre-encryption backup), departed employee (restore deleted account and all data), admin error (restore after accidental site collection deletion). Annually — full business continuity exercise: complete tenant-level recovery scenario, validate all service RPO/RTO targets, test communication plans and escalation procedures, update DR runbooks based on lessons learned. EPC Group includes DR testing in all managed services engagements. We maintain documented runbooks for every recovery scenario and test them on schedule.
Ransomware impacts on Microsoft 365: OneDrive/SharePoint — ransomware encrypts local files, which sync to cloud and overwrite clean versions. OneDrive "Restore" feature provides 30-day point-in-time rollback. SharePoint version history preserves previous clean versions (if not exhausted). Exchange — compromised accounts may delete or encrypt mailbox contents, forward sensitive data, and send phishing to contacts. Teams — files stored in SharePoint are affected as above. Recovery strategy: 1) Isolate compromised accounts immediately (disable sign-in, revoke sessions), 2) Identify ransomware execution time using audit logs and Defender alerts, 3) Use third-party backup to restore all affected content to the point before ransomware execution, 4) Use OneDrive "Restore your OneDrive" for individual user recovery, 5) Restore SharePoint sites from version history or third-party backup, 6) Reset all affected account credentials and review Conditional Access policies. Without third-party backup, recovery depends entirely on version history and the 30-day OneDrive restore window — which may be insufficient for late-detected attacks.
Essential Microsoft 365 retention policies: 1) Exchange mailbox retention: 7 years for regulated industries (HIPAA, SOX, FINRA), 3 years for general business, applied via Microsoft Purview retention policies. 2) SharePoint/OneDrive document retention: 7 years for regulated content, 3 years for general business documents, applied via sensitivity label-based retention or location-based policies. 3) Teams chat retention: 7 years for regulated industries (FINRA communication compliance), 1-3 years for general business. 4) Teams channel messages: follow SharePoint retention (messages stored in channel SharePoint site). 5) Deleted user data retention: hold departed user mailbox and OneDrive for minimum 1 year (legal protection). 6) Litigation hold: applied on a per-case basis, preserves all content indefinitely regardless of retention policies. EPC Group configures retention policies during every Microsoft 365 deployment and validates them quarterly.
Microsoft 365 backup and DR costs: Third-party backup licensing: $2-6/user/month depending on tool and features. For 500 users: $12,000-$36,000/year. Backup storage: typically included in per-user licensing for the first 50-100GB per user. Additional storage: $0.05-$0.15/GB/month. DR planning and documentation: $15,000-$50,000 one-time for comprehensive DR plan, runbook development, and initial testing. Ongoing DR management: $5,000-$15,000/year for quarterly testing, runbook updates, and incident response readiness. Total annual cost for 500 users: approximately $30,000-$80,000/year. Compare this to the cost of data loss: average cost of a data breach is $4.45 million (IBM 2023). Average cost of ransomware recovery without backup: $1.85 million. EPC Group backup and DR solutions start at $15,000 for initial implementation plus $3/user/month for ongoing backup management.
Enterprise Microsoft 365 deployment, migration, governance, and managed services from EPC Group.
Read moreProactive monitoring, incident response, and continuous optimization for your Microsoft environment.
Read moreIndustry-specific compliance controls for healthcare, financial services, government, and education.
Read moreSchedule a free Microsoft 365 data protection assessment with EPC Group. We will evaluate your:
After our assessment, we will provide a protection roadmap. This will include RPO/RTO targets, tool recommendations, and cost estimates.
Microsoft 365 does not automatically back up your data. Microsoft ensures platform availability but does not provide data backup. This guide explains:
EPC Group has implemented disaster recovery strategies for regulated enterprise M365 tenants.
Microsoft is responsible for the availability of the Microsoft 365 platform. Microsoft is not responsible for your data. This distinction matters enormously for disaster recovery planning.
Microsoft maintains geographic redundancy, platform uptime (99.9%+ SLA), and infrastructure resiliency. If a Microsoft datacenter fails, the platform fails over automatically. Your data remains available.
What Microsoft does not protect against:
In all these cases, Microsoft replication clearly shows the damage. Microsoft states in their service agreement that customers must back up their own data. This requirement is not a flaw in the platform; it is intentional.
As a result, you should plan your disaster recovery (DR) strategy accordingly.
Microsoft 365 includes some native recovery tools. These cover short-term accidents — not enterprise DR requirements.
These native tools are useful for individual item recovery. They are not sufficient for enterprise-grade disaster recovery or compliance-required backup retention.
Enterprise disaster recovery for M365 requires third-party backup. Leading tools include:
| Tool | Key Strengths |
|---|---|
| Veeam Backup for M365 | Granular restore, immutable storage support, strong Exchange coverage |
| AvePoint Cloud Backup | SharePoint expertise, Teams backup, compliance-grade retention |
| Acronis Cyber Protect | Broad platform coverage, ransomware detection integration |
| Rubrik Security Cloud | Immutable backups, zero-trust architecture, ransomware recovery |
EPC Group suggests using solutions with immutable storage. These backups cannot be encrypted or deleted by ransomware, even if it infiltrates your backup environment.
Immutable backups are crucial for protecting against ransomware. They provide the strongest defense for your data.
Define your recovery objectives before selecting a backup tool or DR strategy.
Set separate RPO and RTO targets for each workload. Email typically requires a lower RPO than SharePoint document libraries. Legal hold content requires indefinite retention regardless of RPO targets.
Ransomware reaching your M365 environment via OneDrive sync is the most common M365 disaster scenario. Follow these steps when ransomware is detected.
Microsoft 365 retention policies preserve content even after a user deletes it. This provides a DR layer for compliance-required data — but it is not a substitute for backup.
Configure retention policies for:
Retention policy preservation differs from backup restore. You can access retained content using eDiscovery search. However, it cannot be retrieved through a straightforward point-in-time restore.
For complete data protection, it is essential to use:
A disaster recovery (DR) plan that has not been tested is just a theory. To make sure your team can execute the plan, follow these steps:
These tests confirm that the restore process is effective.
Document test results. Auditors and cyber insurance providers increasingly require evidence of DR testing. A log showing quarterly tabletop exercises and annual restore tests satisfies most requirements.
EPC Group creates and implements disaster recovery strategies for enterprise M365 environments in regulated industries. These industries include healthcare, financial services, government, and professional services.
Our disaster recovery (DR) services include:
No. Microsoft backs up the M365 platform infrastructure for availability purposes. Microsoft does not back up individual tenant data for recovery purposes.
Microsoft's service agreement specifies that customers are responsible for their own data. To achieve enterprise-level data protection, consider using a third-party backup tool or Microsoft 365 Backup.
This backup solution will be generally available in 2024.
You can recover deleted email items for up to 30 days by default. Soft-deleted items in the Recoverable Items folder are stored for 14 days. However, you can extend this period to 30 days. Additionally, the SharePoint Recycle Bin retains deleted items for 93 days.
These default settings may not meet most compliance needs. To ensure compliance, configure retention policies to extend these durations.
EPC Group assesses backup tools using several key criteria. These include:
In enterprise settings, the most popular tools are Veeam Backup for M365 and AvePoint Cloud Backup. Choosing the right tool depends on several factors:
OneDrive Restore lets users go back to any point in their OneDrive within the last 30 days. This feature is useful for individual user recovery.
However, it does not work for shared SharePoint libraries.
For large-scale ransomware incidents that impact multiple users and SharePoint sites, consider the following:
Most enterprises aim for a Recovery Point Objective (RPO) of 24 hours and a Recovery Time Objective (RTO) of 4 hours for standard M365 workloads. However, regulated industries or mission-critical environments should set lower targets:
It's important to define targets based on the specific workload. For example, email usually has stricter requirements than SharePoint document libraries.
EPC Group begins with a shared responsibility gap analysis. This process identifies what your current environment covers and what it leaves exposed.
Next, we:
Engagements typically take 4–6 weeks from start to finish.
EPC Group creates Microsoft 365 disaster recovery strategies. Our services include:
We make sure your M365 environment is safe for scenarios that Microsoft does not address.
AI assistant — not human