Business continuity IT is often discussed as a concern for large enterprises, yet a single deleted mailbox or an encrypted file share can interrupt a London small business for an extended period. Many SMEs now run email, files and collaboration tools in Microsoft 365, and they assume the platform protects their information automatically. In practice, the service provides availability and its own retention settings, but these do not always match what a business needs after an accidental deletion, a departing employee or a malicious change. This article sets out where the gaps lie and how to build a recovery plan that leadership can own.
Table of Contents
- Quick Takeaways
- Why Microsoft 365 Needs a Dedicated Backup
- Backup and Replication Are Not the Same
- Setting Recovery Time and Recovery Point Targets
- Building a Disaster Recovery Plan
- Comparing Backup Approaches for Microsoft 365
- Common Mistakes That Leave SMEs Exposed
- Frequently Asked Questions
- References
Quick Takeaways
| Key Insight | Explanation |
|---|---|
| Microsoft 365 is not a complete backup | Service availability and retention settings do not guarantee that a deleted item or overwritten file can be restored to a chosen point in time. |
| Synchronisation spreads damage | Cloud sync copies deletions and encrypted files to every connected location, so sync cannot serve as a recovery copy. |
| Apply the 3-2-1 guideline | Keep three copies of important data on two types of storage, with one copy held offsite. |
| Set RTO and RPO for each system | Agree the maximum tolerable downtime and data loss with leadership before choosing a product or provider. |
| Test restores on a fixed schedule | Untested backups frequently fail, and a documented restore test shows whether recovery targets are realistic. |
| Confirm what the provider covers | Request written confirmation of restorable items, retention periods and the recovery process before an incident occurs. |
| Assign named responsibilities | A written plan should identify who declares an incident, who restores data and who communicates with staff and clients. |
Why Microsoft 365 Needs a Dedicated Backup
Microsoft 365 is a hosted service, and Microsoft operates the infrastructure that keeps it available. Microsoft promotes a native backup solution for data held in Exchange Online, OneDrive and SharePoint, which indicates that backup is a distinct capability that a business must deliberately adopt. Service availability is not the same as the ability to restore a file to the state it held last Tuesday.
Accidental deletion and departing staff
Emails, files and shared documents can be removed by users, by administrators or by retention policies. When a team member leaves, the mailbox and OneDrive content are typically handled according to a schedule. A business that has not reviewed those settings may find that the records it needs are no longer available.
Ransomware and malicious changes
Synchronisation can spread encrypted versions of files to cloud storage before an infection is noticed. Point-in-time versions held in a separate backup allow the business to roll back to a clean state rather than rebuilding work from memory.
Pro tip: Ask your Microsoft 365 administrator to export the current retention and deletion settings for each workload and record them in the continuity plan. This gives leadership a clear view of what can and cannot be recovered.
Backup and Replication Are Not the Same
Replication and backup are often confused, yet they serve different purposes. Replication creates a hot copy of production data that updates quickly, while a backup is a separate, protected cold copy. BizTech’s small business guide draws the same distinction and notes that backups function as long-term archives that can be accessed when needed.
A copy that updates as quickly as the original will also copy an error as quickly as it copies correct data.
Why synchronisation is not a backup
Cloud sync tools keep devices and online storage aligned. That alignment becomes a problem during an incident, because deletions and corruption propagate to every synchronised location. A backup must be isolated from the live environment so that a compromised account cannot alter or erase it.
Setting Recovery Time and Recovery Point Targets
Commvault’s guide to disaster recovery for small businesses describes two measures that should guide planning. The recovery time objective (RTO) is the maximum tolerable downtime for a system, and the recovery point objective (RPO) is the maximum tolerable data loss, measured from the last usable backup to the incident.
An RPO of 24 hours means the business accepts that up to a day of work may need to be recreated. A professional services firm that relies on Microsoft 365 email for client instructions may need a much shorter RPO than a firm whose archived project folders change rarely.
Turning targets into a budget decision
Shorter targets require more frequent backups, more storage and more monitoring, so costs rise as recovery objectives tighten. Leadership should approve targets for each system rather than a single figure for the whole company. This ties spending to the processes that generate revenue.
Building a Disaster Recovery Plan
A disaster recovery plan describes the steps a business takes in different scenarios, such as equipment failure, account compromise or loss of a premises. BizTech recommends beginning with an assessment of the most sensitive data, then deciding whether that data belongs in onsite or cloud storage. Backups should then be integrated into the wider plan so that restoration is a documented response rather than an improvised task.
Prioritising data before choosing storage
Not every file requires the same protection. Customer records, financial data and contracts usually sit at the top of the list, while temporary working files may need only basic protection. Ranking data by sensitivity and business impact prevents overspending on low-value content and underprotecting critical records.
Encryption and access control
Backups hold the same sensitive information as live systems, so they need equal protection. Encryption of data at rest ensures that copies are unreadable without authorised credentials. Administrative access should be limited to a small number of named individuals, with multi-factor authentication applied to every administrator account.
Comparing Backup Approaches for Microsoft 365
Most London SMEs choose between three approaches. Each offers a different balance of control, cost and effort, and the right choice depends on data volume, regulatory obligations and the internal skills available to maintain it.
| Approach | Strengths | Limitations |
|---|---|---|
| Native Microsoft 365 backup | Built for Exchange Online, OneDrive and SharePoint data and maintained by the platform provider | Scope, retention and restore options depend on configuration and licence, so each requirement must be checked against agreed RTO and RPO values |
| Third-party cloud backup managed by a provider | Keeps a separate copy outside the primary Microsoft 365 environment, with monitored jobs and scheduled restore tests | Ongoing subscription cost, and the restore process must be tested and documented |
| Hybrid approach with cloud and local copies | Combines an offsite copy with faster local restoration of large files | More components to manage, and local copies need their own protection |
For most SMEs without an internal IT team, a managed option offers the clearest accountability. An outsourced IT department can run the backup schedule, perform restore tests and report results against agreed targets. Our virtual IT department service is structured around this model.
Common Mistakes That Leave SMEs Exposed
The same errors appear repeatedly when small businesses review their continuity arrangements. Most are inexpensive to correct, yet they tend to surface only during an incident.
Assuming the provider restores everything
Service availability and data recoverability are separate responsibilities. A business should confirm in writing what is covered, which items can be restored, over what period and through which process. Recovery requests raised during an incident are a poor time to discover the answers.
Never testing a restore
Untested backups frequently fail, as Commvault’s guidance notes. A restore test should retrieve a sample mailbox, a folder of shared files and a SharePoint site, then record the time taken. The result shows whether the RTO is realistic, not merely whether a job reported success.
Pro tip: Schedule a restore test each quarter and keep a short log with the date, the items restored, the time taken and any issues found. The log gives leadership evidence that the plan works in practice.
Relying on one administrator
When a single person understands the backup configuration, their absence creates a continuity risk within the continuity plan itself. Documentation, shared administrative controls and a named external partner reduce this dependency.
Frequently Asked Questions
What is business continuity IT?
Business continuity IT is the set of technical and procedural measures that allow a business to keep operating, or to restore operations quickly, after an incident affecting systems or data. It covers backup, recovery planning, security and the roles people perform during an outage.
Does Microsoft 365 back up my data automatically?
Microsoft 365 provides a hosted service with availability features and retention settings, but these are not a substitute for a dedicated backup. Recovery depends on the workload, configuration and licence, so businesses should confirm exactly what can be restored and for how long.
How often should a small business back up Microsoft 365 data?
The frequency should follow the recovery point objective agreed for each system. A business that can accept up to 24 hours of data loss has different needs from one that requires much shorter intervals for client correspondence and billing records.
What is the 3-2-1 backup guideline?
The 3-2-1 guideline recommends keeping three copies of important data, on two different types of storage, with one copy held offsite. It is a practical planning rule that reduces the chance of a single incident removing every copy.
How often should a disaster recovery plan be reviewed?
Review the plan after significant changes to systems, staff or suppliers, and at least once a year. Restore test results should feed into each review so that documented recovery times reflect the current environment.
We would welcome your experience: has your organisation ever needed to restore Microsoft 365 data, and which step of the process proved most difficult?