RemoteBackup and disaster recovery
Backups that survive the attack, and a recovery you have already tested.
Ransomware goes for the backups first. A backup on the same network, behind the same admin login, is just another thing to encrypt. We keep copies locked, isolated and watched, and prove they restore before the day you need them.
Microsoft 365 backup is part of every Real Bytes managed plan. Server and site backup is sized to the recovery time each system needs.
- Locked copies attackers cannot delete
- Kept apart from production
- Restores tested, not assumed
Reviewed by Blake Bath, General Manager, on 30 October 2026.
What decides recovery
Five things decide whether you get your data back.
Having a backup is not the same as being able to recover. These are the differences.
Can an attacker delete it?
ASD's backup principle asks for encrypted backups on immutable, offline or logically isolated storage. A copy that an admin login can delete, an attacker with that login can delete too.
- Immutable or offline copies
- Encrypted in transit and at rest
- Retention set before anyone needs it
Is it kept apart?
Backup repositories should be separated from primary systems, everyday users and production workloads, so one compromise cannot reach both.
- Separate storage and network
- Separate admin accounts with MFA
- Few people with access
Does it cover Microsoft 365?
Microsoft keeps the service running, but a deleted mailbox is kept for 30 days and then permanently removed. Deleted items default to 14 days. That is retention, not a backup you control.
- Mail, OneDrive, SharePoint and Teams
- Kept outside your tenant
- Covered in every managed plan
Has it been restored?
ASD asks for restore tests that prove you can meet your recovery time and recovery point objectives. A green tick in a console proves the job ran, not that the data comes back.
- Real restores, timed
- Results kept as evidence
- Gaps fixed, then tested again
Is anyone watching it?
Backups fail quietly: a full disk, an expired credential, a changed password. The failure only matters on the day you need the copy.
- Failures raise an alert
- Someone named acts on it
- Coverage checked when systems change
Backup check
Eight things your backups should have.
Mostly ASD's own actions for regular and proven backups, in plain words. Tick what is true today and copy the gaps.
Tick what is true for your backups today. If you are not sure, leave it unticked.
Where you stand
0of 8 controls in place
8 gaps to close.
- Data, apps and settings backed up on a scheduleASD's action covers important data, applications and settings.
- Backups that cannot be changed or deletedRansomware goes after backups first.
- Backup storage separate from everything elseASD asks for repositories isolated from users and production so one attack cannot reach both.
- Only a few named people can touch backupsLeast privilege access applies to backups in ASD's mapping.
- Microsoft 365 backed up outside MicrosoftMicrosoft keeps a deleted mailbox for 30 days, then it is gone.
- Restores tested against your recovery targetsASD asks for tests that prove recovery time and recovery point objectives can be met.
- Recovery targets agreed for each systemWithout them, nobody can say whether a backup is good enough.
- Backup failures raise an alert someone acts onA backup that silently stopped weeks ago is only discovered on the day you need it.
From our jobs
What we did when a backup vendor was compromised.
In October 2026 a cloud backup service used by many MSPs, including us, had a vendor credential compromise. This is what we did across our client tenants.
- Disabled, not deletedWe turned off the service's sign-in in every client tenant rather than removing it, so it could be switched back on once the vendor confirmed the credential was rotated.
- The whole product family, not one appEvery app from the same vendor platform was disabled too. If one part is compromised, we treat the rest as exposed until proven otherwise.
- Hosting ranges blockedWe added a hard-block Conditional Access policy for the hosting IP ranges tied to the incident, tested it on our own tenant first, then deployed it across client tenants.
- Our own monitoring while theirs was offWhile the vendor brought its service back in phases without its monitoring, we wrote our own checks on client tenants and ran our identity threat detection harder.
The lesson for any business: your backup provider is a supplier with privileged access to your data. Know how you would cut that access off in an hour, and how you would turn it back on.
How we actually do it
What is behind it.
- Microsoft 365 in every plan
Mail, OneDrive, SharePoint and Teams are backed up outside your tenant on every Real Bytes managed plan.
- Server and site backup
For clients with servers on site, backup is sized to each system's recovery time. We are evaluating an on-site appliance for these workloads now.
- Recovery targets first
We agree how long each system can be down and how much work you can lose before choosing any tool.
- Evidence on file
Restore results and backup reports kept, ready for an insurer, an auditor or an SMB1001 assessment.
The Australian guidance
What ASD now asks of backups.
From ASD's Transitioning from the Essential Eight, published 15 October 2026. Regular backups maps to two Essentials principles: Regular and proven backups, and Least privilege access.
- Back up on a defined scheduleImportant data, applications and settings, to secure, resilient storage that is encrypted and immutable, offline, logically isolated or equivalent.
- Isolate the repositoriesSeparate from general user environments and production workloads, to prevent unauthorised change or deletion.
- Test restores against your targetsRegular tests that show backups can meet your recovery time and recovery point objectives.
Mistakes we see
Five ways backups fail on the day.
- Backup on the same networkThe backup drive in the office gets encrypted along with everything else.
- Retention mistaken for backupMicrosoft's recycle bins expire, and a compromised admin can empty them.
- Never actually restoredThe job says success. The data does not come back, or takes days.
- One admin login for everythingThe same account that runs the servers can delete the backups.
- Nobody watching the alertsBackups stopped weeks ago and the warning emails went to a former staff member.
How we set it up
From recovery targets to tested restores.
- Step 1Agree targets
For each system: how long you can be down and how much recent work you can lose.
- Step 2Map what matters
Data, applications and settings, including Microsoft 365, servers and line of business apps.
- Step 3Build it locked and apart
Immutable or isolated storage, separate admin access with MFA, encryption.
- Step 4Watch it
Failures raise alerts that someone named acts on.
- Step 5Prove it
Timed restore tests against your targets, with results kept.
- Step 6Plan the bad day
A written recovery order, so the most important systems come back first.
Related work
Backup is the last line. These come first.
Stopping an attack early means the backups are a safety net, not the whole plan.
- Managed Microsoft 365The tenant your mail and files live in.
- Detection and responseCatch ransomware before it reaches the backups.
- Microsoft 365 backup guideWhat Microsoft keeps, and for how long.
- Backup and DR guidePlanning recovery before you need it.
- ASD EssentialsRegular and proven backups is a principle.
Get help your way
Six ways to reach us. Pick whichever suits you.
Helpdesk hours are Monday to Friday, 8am to 5pm AEST. On Advantage and above, emergencies get a response within 1 hour and outages within 2, with 24/7 best-effort escalation.
- Call 07 3114 2808
An engineer answers Monday to Friday, 8am to 5pm AEST. After hours, weekends and public holidays, Chip, our AI agent, answers on the same number or on 07 3180 0965, logs it and escalates urgent incidents to the on-call engineer.
Call now - Email the helpdesk
Send it to helpdesk@realbytes.com.au and a ticket is logged straight away, with a reference number you can quote.
Email us - Client portal
Log and follow your tickets, see what we are working on and who has it.
Open the portal - Remote support
When an engineer asks to see your screen, start a secure session here. You start it, so nobody sees your screen until you do.
Start a session - Chat in Microsoft Teams
Clients can message Chip, our AI assistant, in Teams to log a request without leaving their desk.
How clients reach us - Service status
Check whether Microsoft 365 or another cloud service is down before you lose an hour troubleshooting.
See live status
Questions
What people ask about backup.
Doesn't Microsoft 365 already keep our data?
Only for a while. Per Microsoft's documentation, a deleted mailbox is kept for 30 days and then permanently deleted, and deleted email items are kept for 14 days by default, up to 30. Our plans include a separate backup of mail, OneDrive, SharePoint and Teams outside your tenant.
What is the difference between backup and disaster recovery?
Backup gets your data back. Disaster recovery gets the business running again, within a time you have agreed in advance. You need a backup to do disaster recovery, but a backup alone is not a plan.
What does a locked or immutable backup mean?
The copy cannot be changed or deleted until its retention period ends, even by someone with admin access. If an attacker reaches your systems, they still cannot destroy the backups. ASD lists immutable, offline or logically isolated storage as part of the backup principle.
What happens if the backup vendor itself is compromised?
It happened in October 2026 with a cloud backup service many MSPs use. We disabled its access to every client tenant rather than deleting it, blocked the hosting ranges involved, and watched tenants with our own scripts until the vendor's monitoring was back.
Do you back up servers on site?
Yes, where clients still run them. We are currently evaluating an on-site backup appliance for server workloads, and we size server backup to the recovery time each system needs.
How much does it cost?
Microsoft 365 backup is included in every Real Bytes managed plan, from $150 per person a month ex GST. Server and site backup is quoted after we agree recovery targets, at $195 per hour ex GST for project work.
Next step
Not sure your backups would work?
Tell us what you back up today and how. An engineer will tell you where the gaps are and what a tested recovery would look like.
Keep reading
- Microsoft 365 backup: native vs third party What Microsoft keeps, and what it does not.
- Backup and disaster recovery guide Planning the recovery before you need it.
- Ransomware guide What to do before and during an attack.
- ASD Essentials tracker Backups in the new framework.
Reviewed by Blake Bath, General Manager, on 30 October 2026. Backup actions from ASD. Exchange Online retention from Microsoft Learn. The vendor incident response is Real Bytes' own work from October 2026. ASD, Transitioning from the Essential Eight; Microsoft, delete or restore mailboxes in Exchange Online; Microsoft, Exchange data deletion