Microsoft 365 Disaster Recovery & Business Continuity

Microsoft 365 Disaster Recovery & Business Continuity: Enterprise Guide 2026

• Microsoft's service agreement explicitly states that customers are responsible for their own data backup.
• Default M365 retention for deleted items is 30–93 days — far too short for most compliance requirements.
• Third-party backup tools (Veeam, Avepoint, Acronis, Rubrik) are required for true enterprise data protection.
• Ransomware via OneDrive sync can encrypt thousands of SharePoint files before M365 detects and responds.
• EPC Group has designed and implemented DR strategies for enterprise M365 environments across regulated industries.

The Shared Responsibility Model

Microsoft is responsible for the availability of the Microsoft 365 platform. Microsoft is not responsible for your data. This distinction matters enormously for disaster recovery planning.

Microsoft maintains geographic redundancy, platform uptime (99.9%+ SLA), and infrastructure resiliency. If a Microsoft datacenter fails, the platform fails over automatically. Your data remains available.

What Microsoft does not protect against:

• A user permanently deleting a mailbox folder or SharePoint site
• Ransomware encrypting files via OneDrive sync before M365 detects it
• A departing employee wiping their OneDrive before the account is disabled
• An admin accidentally deleting a site collection
• Malicious deletion by a compromised account

In all of these cases, Microsoft replication faithfully replicates the damage. Microsoft explicitly states in their service agreement that customers are responsible for their own data backup. This is not a gap in the platform — it is by design. Plan your DR strategy accordingly.

Native M365 Data Recovery Capabilities

Microsoft 365 includes some native recovery tools. These cover short-term accidents — not enterprise DR requirements.

Exchange Online

• Deleted Items: Recoverable for 30 days by default.
• Recoverable Items (Dumpster): Soft-deleted items retained for 14 days by default. Extend to 30 days via retention policy.
• Litigation Hold: Preserves all mailbox content indefinitely for legal purposes. Not a backup — cannot restore a specific version of a document.
• In-Place eDiscovery: Allows searching and exporting archived mailbox content.

SharePoint and OneDrive

• Recycle Bin: Deleted items held for 93 days before permanent deletion.
• Version History: Restores previous document versions. Default version limit is 500. Does not protect against complete site deletion.
• OneDrive Restore: Restores individual OneDrive to any point in the last 30 days. Useful for ransomware recovery — but only for the individual OneDrive, not shared SharePoint libraries.

These native tools are useful for individual item recovery. They are not sufficient for enterprise-grade disaster recovery or compliance-required backup retention.

Third-Party Backup Tools

Enterprise disaster recovery for M365 requires third-party backup. Leading tools include:

Tool	Key Strengths
Veeam Backup for M365	Granular restore, immutable storage support, strong Exchange coverage
AvePoint Cloud Backup	SharePoint expertise, Teams backup, compliance-grade retention
Acronis Cyber Protect	Broad platform coverage, ransomware detection integration
Rubrik Security Cloud	Immutable backups, zero-trust architecture, ransomware recovery

EPC Group recommends solutions with immutable storage — backups that cannot be encrypted or deleted by ransomware, even if it reaches your backup environment. Immutable backups are the most important feature for ransomware resilience.

RPO and RTO Planning

Define your recovery objectives before selecting a backup tool or DR strategy.

• Recovery Point Objective (RPO): How much data loss is acceptable? An RPO of 24 hours means backups run daily and you can lose up to one day of data. An RPO of 1 hour requires near-continuous backup.
• Recovery Time Objective (RTO): How quickly must services be restored? An RTO of 4 hours means your team must be able to restore critical services within 4 hours of a declared disaster.

Set separate RPO and RTO targets for each workload. Email typically requires a lower RPO than SharePoint document libraries. Legal hold content requires indefinite retention regardless of RPO targets.

Ransomware Recovery Playbook

Ransomware reaching your M365 environment via OneDrive sync is the most common M365 disaster scenario. Follow these steps when ransomware is detected.

1. Isolate compromised accounts immediately. Disable sign-in for affected accounts and revoke all active sessions in Entra ID.
2. Identify the ransomware execution time. Use unified audit logs and Microsoft Defender alerts to determine when encryption began.
3. Restore from third-party backup. Use your backup tool to restore all affected content to the point-in-time before ransomware execution. This is why immutable backup is critical — M365 native tools cannot restore to an arbitrary point in time reliably.
4. Use OneDrive Restore for individual user recovery. For users whose personal OneDrive was affected, use the built-in OneDrive Restore feature to roll back to the pre-encryption state (up to 30 days).
5. Restore affected SharePoint sites from backup. Do not rely on version history alone for large-scale SharePoint encryption events. Use your third-party backup for bulk restores.
6. Reset credentials and review Conditional Access. Reset passwords for all affected accounts. Review Conditional Access policies to close the gap that allowed ransomware to spread.

Retention Policies as a DR Layer

Microsoft 365 retention policies preserve content even after a user deletes it. This provides a DR layer for compliance-required data — but it is not a substitute for backup.

Configure retention policies for:

• Exchange mailboxes: Retain all email for 7 years (standard financial services requirement) or 6 years (HIPAA minimum).
• SharePoint and OneDrive: Retain all content for the compliance period applicable to your industry.
• Teams channels and chats: Retain for the same period as email in regulated environments.

Retention policy preservation differs from backup restore. Retained content is available via eDiscovery search — but not via a simple point-in-time restore. Use both retention policies and third-party backup for complete data protection.

DR Testing

A DR plan that has never been tested is a hypothesis. Run tabletop exercises quarterly to validate that your team can execute the plan. Run actual restore tests at least annually — restore a mailbox, a SharePoint site, and a Teams channel from backup to verify that the restore process works.

Document test results. Auditors and cyber insurance providers increasingly require evidence of DR testing. A log showing quarterly tabletop exercises and annual restore tests satisfies most requirements.

EPC Group's M365 DR Practice

EPC Group designs and implements disaster recovery strategies for enterprise M365 environments across regulated industries — healthcare, financial services, government, and professional services. Our DR engagements cover shared responsibility gap analysis, backup tool selection and configuration, RPO/RTO definition, retention policy design, and ransomware recovery playbook development.

Frequently Asked Questions

Does Microsoft 365 back up my data?

No. Microsoft backs up the M365 platform infrastructure for availability purposes. Microsoft does not back up individual tenant data for recovery purposes.

Microsoft's service agreement explicitly states that customers are responsible for their own data. You need a third-party backup tool or Microsoft 365 Backup (generally available as of 2024) for enterprise-grade data protection.

What is the default retention period for deleted items in M365?

Deleted email items are recoverable for 30 days by default. Soft-deleted items in the Recoverable Items folder are retained for 14 days by default (extendable to 30 days). SharePoint Recycle Bin holds deleted items for 93 days. These defaults are insufficient for most compliance requirements — configure retention policies to extend them.

What third-party backup tool should I use for Microsoft 365?

EPC Group evaluates backup tools based on immutable storage support, granular restore capability, Teams coverage, and compliance reporting. Veeam Backup for M365 and AvePoint Cloud Backup are the most commonly selected tools in enterprise environments. The right choice depends on your budget, compliance requirements, and existing infrastructure.

Can OneDrive Restore recover from a ransomware attack?

OneDrive Restore can roll back an individual user's OneDrive to any point in the last 30 days. It is useful for individual user recovery but does not cover shared SharePoint libraries. For large-scale ransomware events affecting multiple users and SharePoint sites, third-party backup with immutable storage is required.

What RPO and RTO should I target for Microsoft 365?

Most enterprises target an RPO of 24 hours and an RTO of 4 hours for standard M365 workloads. Regulated industries or mission-critical environments should target lower: RPO of 1 hour, RTO of 1–2 hours. Define targets by workload — email typically has stricter requirements than SharePoint document libraries.

How does EPC Group approach M365 DR engagements?

EPC Group starts with a shared responsibility gap analysis — identifying what your current environment covers and what it leaves exposed. We then select and configure backup tools, define RPO/RTO targets, design retention policies, and build a ransomware recovery playbook. Engagements typically take 4–6 weeks end-to-end.

Build Your Microsoft 365 DR Strategy

EPC Group designs enterprise Microsoft 365 disaster recovery strategies — from shared responsibility gap analysis to backup tool configuration, retention policy design, and ransomware playbooks. We ensure your M365 environment is protected for the scenarios that Microsoft does not cover.

Call (888) 381-9725 or request a 30-minute discovery call.