How to Back Up Microsoft 365 Email, OneDrive, SharePoint & Teams
A Microsoft 365 backup plan should protect more than email. Small businesses increasingly depend on Exchange Online mailboxes, OneDrive files, SharePoint sites and Microsoft Teams, but those workloads do not all store data in exactly the same place. A good backup strategy starts by understanding what needs protection, where that data lives and how you would recover it after deletion, ransomware, account loss or an administrative mistake.
Microsoft 365 backup at a glance
For a small business, the easiest way to think about Microsoft 365 backup is by workload. Each workload contains different business information and has different recovery consequences.
| Workload | What you are protecting | Primary recovery concern |
|---|---|---|
| Exchange Online / Outlook | Mailboxes, email and related mailbox content | Deleted or damaged messages, mailbox loss and user offboarding |
| OneDrive | Files associated with individual users | Deleted files, ransomware, overwritten content and departed-user data |
| SharePoint | Team sites, document libraries and shared business files | Site-wide deletion, mass file changes and recovery of shared information |
| Microsoft Teams | Files, conversations and collaboration data distributed across Microsoft 365 services | Understanding which underlying workloads must be protected and what the selected backup product actually covers |
First: retention is not the same as backup
Microsoft 365 includes resiliency, recycle bins, version history, retention capabilities and other recovery mechanisms. Those features are valuable, but they do not eliminate the need to decide whether your business requires a dedicated backup service.
Retention and backup solve related but different problems. Retention is commonly designed around preserving or governing information according to organizational or compliance rules. Backup is centered on creating recoverable copies or restore points so administrators can return data to a usable earlier state after an incident.
For a deeper explanation of that distinction, see Does Microsoft 365 Back Up Your Data? and Microsoft 365 Backup vs. Third-Party Backup.
Step 1: decide what your business cannot afford to lose
Before selecting a product or creating a backup policy, inventory the Microsoft 365 data your company actually depends on. A five-person consulting company may care most about email and OneDrive. A 30-person organization may have years of operational documents spread across SharePoint sites and Teams-connected libraries.
At minimum, review:
- active employee Exchange Online mailboxes;
- shared or operational mailboxes that contain business records;
- OneDrive accounts containing business files;
- SharePoint sites and document libraries used by departments or projects;
- Teams-connected SharePoint and OneDrive content;
- data belonging to employees who are leaving the company;
- recovery requirements for deleted, overwritten or ransomware-affected content; and
- whether Microsoft Entra ID configuration or identity recovery is also part of your resilience plan.
This inventory becomes the basis for both your backup scope and your budget. Our Microsoft 365 Backup Pricing for Small Business guide explains how protected users and data volume can affect cost.
Step 2: choose native Microsoft 365 Backup or a third-party service
There are two broad approaches. Microsoft offers its own Microsoft 365 Backup service, while third-party providers offer independent Microsoft 365 backup platforms with their own pricing, storage, retention and recovery models.
Using Microsoft 365 Backup
Microsoft's native service is administered through Microsoft 365 and uses backup policies for Exchange, OneDrive and SharePoint. An administrator enables the service, configures billing and then creates policies defining which mailboxes, OneDrive accounts and SharePoint sites should be protected.
Microsoft also supports Full Workload Backup for eligible workloads, which can automatically protect eligible protection units that are not already assigned to another policy. That can reduce the chance that a newly created mailbox, OneDrive account or SharePoint site is accidentally left outside the backup scope.
Using a third-party Microsoft 365 backup service
A third-party service can be attractive when you prefer predictable per-user pricing, independent administration, different retention options or a recovery workflow outside Microsoft's native backup interface. Coverage varies by provider, so compare exactly which Microsoft 365 workloads and item types are protected rather than relying only on a product's headline claim that it “backs up Microsoft 365.”
For example, IDrive publishes Microsoft Office 365 Backup coverage for Exchange/Outlook, OneDrive, SharePoint and Teams-related data. Small businesses considering it can compare that coverage against Microsoft's native approach and other products in our Best Microsoft 365 Backup for Small Business guide.
Check IDrive Microsoft 365 Backup
Step 3: back up Exchange Online and Outlook email
For many businesses, email is the first workload that comes to mind when discussing Microsoft 365 backup. Exchange Online mailboxes can contain years of customer conversations, contracts, attachments, approvals and operational history.
With Microsoft 365 Backup, Exchange protection is configured through an Exchange backup policy. The important planning decision is not simply whether email is “backed up,” but which mailboxes are enrolled and what happens when users are added, removed or deleted.
Include more than obvious employee mailboxes
Review the mailboxes that actually hold business information. Depending on your environment, that may include active users as well as shared or operational mailboxes. Confirm that every mailbox you expect to recover is eligible for and included in the backup product you choose.
Plan for deleted users
Employee departures are one of the easiest ways for backup gaps to appear. Microsoft documents specific recovery behavior for protected Exchange and OneDrive data after a user is removed or deleted. Your offboarding process should therefore include a backup check before licenses, accounts or data are removed.
Step 4: back up OneDrive
OneDrive is often where employees keep their working files, drafts, spreadsheets, presentations and other business documents. That makes it especially important to include OneDrive in both your backup policy and your employee-offboarding process.
Microsoft 365 Backup treats OneDrive accounts as protection units. With a third-party service, the terminology may differ, but the principle is the same: identify which user accounts contain business data and make sure they are actually enrolled in protection.
Protect active accounts and plan for departing employees
A backup policy should account for both current users and employees who leave the company. Before deleting an account, determine which OneDrive files belong to the business, who should take ownership of them and whether the account is protected by your backup service.
Do not confuse OneDrive with a shared company file server. OneDrive is primarily associated with individual users, while SharePoint is generally the better home for files that belong to a department, project or team. Our OneDrive vs. SharePoint for Small Business guide explains that distinction in more detail.
Test file-level recovery
Your recovery test should include more than confirming that a OneDrive account appears in a dashboard. Select a noncritical test file, verify that restore points exist and confirm that an administrator can recover the file or an earlier version through the backup system.
Step 5: back up SharePoint
SharePoint can contain some of the most important shared information in a Microsoft 365 environment: department documents, policies, project files, procedures, templates and the document libraries used by Microsoft Teams.
With Microsoft 365 Backup, SharePoint sites are protected through SharePoint backup policies. Small businesses should pay particular attention to site coverage because creating a new SharePoint site does not help your recovery plan if the site never enters the intended backup scope.
Inventory important SharePoint sites
Start with the sites that would materially disrupt the business if their content disappeared or became unusable. That may include:
- department and operations sites;
- client or project sites;
- document libraries containing policies and procedures;
- sites connected to active Microsoft Teams workspaces; and
- sites containing records that must be retained for business or regulatory reasons.
Record the site owner and business purpose as part of the inventory. A technically successful restore is much less useful if nobody knows who owns the recovered information or where it belongs.
Plan for broad recovery events
SharePoint recovery is not only about a single deleted document. Consider what you would do after mass deletion, ransomware-driven file changes, accidental content changes or a problem affecting a large portion of a site. Your selected backup service should match the scale of recovery your organization may realistically need.
Step 6: understand what "backing up Teams" actually means
Microsoft Teams is different from a traditional application whose information lives in one self-contained data store. Teams is a collaboration layer that relies on multiple Microsoft 365 services.
Files shared through Teams commonly rely on SharePoint or OneDrive. That means protecting the underlying SharePoint sites and OneDrive accounts is an important part of protecting the files users access through Teams. Conversations, channel information and other collaboration data can involve different Microsoft 365 services and may have different backup and recovery behavior.
This is also why Microsoft's native Microsoft 365 Backup documentation focuses its backup policies on Exchange, OneDrive and SharePoint rather than presenting Teams as a separate fourth backup-policy workload.
Questions to ask about Teams coverage
- Are files from standard Teams channels protected through the associated SharePoint site?
- How are files associated with chats or other OneDrive-backed locations handled?
- Does the product protect Teams conversations or only files?
- Can individual items be restored, or is recovery performed at a broader workload level?
- What happens to Teams-connected data after a user, team or site is deleted?
- Are there retention or recovery limitations that differ from Exchange, OneDrive or SharePoint?
A provider that says "Teams backup included" should be able to answer those questions clearly.
Step 7: protect your offboarding process
User offboarding deserves its own backup procedure because deleting or changing a Microsoft 365 account can affect several workloads at once. The departing employee may own an Exchange mailbox, a OneDrive account, Teams-connected files and access to shared SharePoint content.
| Before removing a user | What to verify |
|---|---|
| Exchange | Required mailbox data is protected and ownership or access requirements are documented |
| OneDrive | Business files are identified, backup coverage is confirmed and a new owner is assigned where appropriate |
| SharePoint | The user's departure will not leave important sites or libraries without an appropriate owner |
| Teams | Team ownership and the location of important shared files are understood |
| Backup system | The organization understands how long protected data remains recoverable after account deletion |
A simple checklist incorporated into your normal employee-departure workflow can prevent a rushed account deletion from becoming a data-recovery problem later.
Step 8: test recovery before you need it
A backup that has never been restored is an assumption. Recovery testing verifies that administrators understand the process and that the protected data can actually be returned in a useful form.
For a small business, a practical test can be modest. You do not need to manufacture a disaster. Use controlled test data and verify several representative recovery scenarios.
| Recovery test | What it proves |
|---|---|
| Restore a test email or mailbox item | Exchange recovery is available and administrators know how to use it |
| Restore a OneDrive file | Individual user files and restore points can be recovered |
| Recover SharePoint content | Shared business information can be restored at the required scope |
| Review Teams-related recovery | Your team understands which underlying services contain the data and what the backup product can restore |
| Review a deleted-user scenario | Your offboarding process preserves the data the business expects to retain |
Document the recovery procedure
Record who has permission to initiate restores, where the backup console is accessed, how administrators locate restore points, who approves significant recoveries and how restored data should be validated. Keep this documentation somewhere that remains available during a Microsoft 365 incident.
Common Microsoft 365 backup mistakes
Most backup failures are not caused by choosing the wrong brand. They are caused by gaps between what the organization assumes is protected and what is actually configured.
- Assuming Microsoft 365 automatically equals independent backup. Built-in resilience and retention should not be confused with a backup strategy tailored to your recovery requirements.
- Protecting email but forgetting OneDrive and SharePoint. Modern businesses often store as much critical information in files and collaboration sites as they do in mailboxes.
- Treating Teams as one isolated workload. Understand its dependencies on SharePoint, OneDrive and other Microsoft 365 services.
- Forgetting new users or sites. Review whether your backup policy automatically includes newly created protection units or requires manual enrollment.
- Deleting employees before checking their data. Make backup verification part of offboarding.
- Never testing a restore. A green dashboard does not prove your staff can recover the right data under pressure.
- Choosing only by price. Workload coverage, retention, restore controls and administrative requirements matter alongside subscription cost.
Microsoft 365 backup checklist for a small business
Use this as a practical implementation checklist:
- Inventory Exchange mailboxes, OneDrive accounts and important SharePoint sites.
- Identify Teams workspaces that contain business-critical collaboration data.
- Decide what data must be recoverable and for how long.
- Choose between Microsoft 365 Backup and a third-party backup service.
- Confirm exactly which workloads and item types the selected product protects.
- Enroll the required users, mailboxes, OneDrive accounts and SharePoint sites.
- Determine how new users and newly created sites enter the backup scope.
- Add backup verification to employee offboarding.
- Assign backup-administrator permissions to appropriate staff.
- Perform controlled Exchange, OneDrive and SharePoint recovery tests.
- Document the recovery procedure and responsible personnel.
- Review backup coverage periodically as the Microsoft 365 environment changes.
Which Microsoft 365 backup approach should you use?
Microsoft 365 Backup is a natural starting point when you want Microsoft-operated backup integrated with the Microsoft 365 environment and are comfortable with its protected-data consumption model.
A third-party backup service can make more sense when you want independent administration, predictable per-user pricing, different retention options or recovery capabilities that better match your operational requirements.
There is no universal winner. A ten-person company with modest data volume can reach a different decision from a 50-person organization with years of SharePoint content. Compare the actual products in Best Microsoft 365 Backup for Small Business, then use our Microsoft 365 Backup Pricing for Small Business guide to estimate the budget.
Bottom line
Backing up Microsoft 365 is not simply a matter of protecting Outlook email. A resilient small-business plan accounts for Exchange mailboxes, OneDrive accounts, SharePoint sites and the Microsoft 365 services that support Teams collaboration.
The strongest implementation starts with an inventory, selects backup coverage based on recovery requirements, includes employee offboarding and finishes with actual restore testing. If you cannot identify where important business information lives and explain how you would recover it, that is a gap worth resolving before an incident occurs.
FAQ
Does Microsoft 365 automatically back up email, OneDrive and SharePoint?
Microsoft 365 provides service resilience, retention and recovery features, and Microsoft also offers Microsoft 365 Backup as a separate backup service. Whether your organization needs that service or a third-party backup product depends on its recovery, retention, administration and risk requirements.
Does Microsoft 365 Backup protect Teams?
Microsoft's native Microsoft 365 Backup policies focus on Exchange, OneDrive and SharePoint. Teams uses multiple Microsoft 365 services, so protecting Teams-related information requires understanding where the relevant files and other data are stored and what the selected backup service can recover.
Should a small business back up OneDrive if files can be restored from the recycle bin?
Recycle-bin and version-history features are useful recovery tools, but a business should decide whether they satisfy its full recovery requirements. Dedicated backup can provide additional restore points, administrative recovery workflows or retention behavior depending on the service selected.
How often should Microsoft 365 backup recovery be tested?
There is no single schedule for every business, but recovery should be tested periodically and after meaningful changes to the backup platform, Microsoft 365 environment or administrative process. The goal is to verify that both the data and the recovery procedure work before a real incident.
What should happen to Microsoft 365 backups when an employee leaves?
Before deleting the account, verify backup coverage, identify business-owned mailbox and OneDrive data, determine who should own or access that information and understand how long the selected backup service will keep deleted-user data recoverable.
Sources and further reading
Microsoft 365 Backup behavior and workload information in this guide were checked against current documentation on September 14, 2026. Product capabilities can change.
- Microsoft Learn: Microsoft 365 Backup overview
- Microsoft Learn: Set up Microsoft 365 Backup
- Microsoft Learn: Restore data with Microsoft 365 Backup
- IDrive: Microsoft Office 365 Backup
Related Tech Fit Guide resources: Does Microsoft 365 Back Up Your Data?, Best Microsoft 365 Backup for Small Business, Microsoft 365 Backup Pricing for Small Business, Microsoft 365 Backup vs. Third-Party Backup, OneDrive vs. SharePoint for Small Business, and Small Business Backup Strategy.