Remote Support
Why Microsoft 365 needs backup
Microsoft 365 has high availability, geo-redundancy and 30 to 93 day retention for items deleted in most workloads. That is not the same thing as a backup. Microsoft operates a shared responsibility model: they keep the platform running, you are responsible for your data inside it.
The Microsoft Services Agreement makes this explicit and recommends customers regularly back up their content. The risks Microsoft does not cover include accidental deletion, malicious deletion by a compromised account, ransomware that encrypts OneDrive, retention policy errors, departed staff mailboxes purged after licence reassignment, and legal hold or audit obligations beyond default retention.
Australian context
Under the Notifiable Data Breaches scheme, you must be able to assess what personal information may have been affected during an incident. Without proper backup, that assessment is often impossible. The ASD Essential Eight includes Regular Backups as one of the eight core mitigation strategies.
What native protection actually covers
What Microsoft 365 already does
- Geo-redundant infrastructure across regions
- Recycle bin and deleted items recovery (limited window)
- SharePoint version history
- Litigation hold and retention policies if licensed and configured
- 30-day retention for deleted users by default
What Microsoft does NOT do
- Long-term backup beyond retention windows
- Recover from ransomware encrypting OneDrive sync
- Restore individual items years later
- Protect Teams chat and channel history fully
- Provide an immutable, attacker-proof copy outside the tenant
- Rapid bulk restore during a major incident
Microsoft 365 Backup (the native service)
In 2024 Microsoft released their own paid product called Microsoft 365 Backup. It backs up Exchange Online, OneDrive and SharePoint inside the same Microsoft tenant, with very fast in-tenant restore performance and a clean integration into the admin centre.
What it is good at
- Extremely fast restore inside the same tenant after accidental deletion or large-scale corruption
- No third-party storage or vendor to manage
- Native admin experience and audit logging
- Useful as the operational rollback layer for ransomware and human error
Where it falls short
- Data stays inside Microsoft. If your tenant is fully compromised or shut down, the backup is in the same blast radius.
- Per-user pricing on top of existing licensing adds up quickly
- Limited support for Teams chat, public folders and some advanced scenarios
- Not designed as a long-term archive
Microsoft 365 Backup is a good operational rollback layer. It is not a replacement for an independent offsite backup that lives outside Microsoft.
Third-party vendors compared
Third-party Backup-as-a-Service tools store an independent copy of your data in their cloud (or yours), separate from Microsoft. This is the layer that protects you against tenant-level events, long-term retention obligations, and adversarial deletion.
Our preferred platform: ConnectWise BCDR (powered by Axcient)
Real Bytes standardises on the ConnectWise BCDR platform (delivered by Axcient, a ConnectWise company) for the majority of our Australian clients. It gives us a single console covering Microsoft 365, Google Workspace, on-premises servers, endpoints and Azure workloads, with immutable AirGap storage, SOC 2 certified data centres, and full audit logging.
ConnectWise x360Cloud (Axcient)
Microsoft 365 and Google Workspace cloud-to-cloud backup
Cloud-to-cloud backup of Exchange Mail, Calendar, Contacts, OneDrive, SharePoint and Teams. SmartSearch across 100+ million objects in under 5 seconds. AirGap immutability protects against ransomware and malicious deletion. SOC 2 certified Axcient Cloud. Full audit logs for e-discovery and compliance. Deploys per tenant in under 10 minutes.
Best for: Our default choice for Microsoft 365 and Google Workspace backup across SMB and mid-market clients.
ConnectWise x360Recover (Axcient)
Server, endpoint and Azure backup with disaster recovery
Hybrid BCDR for Windows, VMware, Linux, macOS, NAS and Azure. Direct-to-Cloud (no appliance) or appliance-based deployment. 15-minute RPO and sub-1-hour RTO. AutoVerify boot tests every backup. AirGap immutability. Virtual Office for full DR failover into the Axcient Cloud. Geo+ redundancy across multiple data centres.
Best for: Servers, on-premises infrastructure, hybrid environments, and Azure workload protection.
ConnectWise Cloud Backup
Lightweight Microsoft 365 backup option
Simplified Microsoft 365 backup option from the same Axcient platform. Simple per-user pricing, immutable storage, fast onboarding. Same audit and compliance benefits as x360Cloud at a lower entry point.
Best for: Smaller environments where x360Cloud feature depth is not required but business-grade backup still is.
Why we prefer ConnectWise BCDR
- One vendor and one console for Microsoft 365, Google Workspace, servers, endpoints and cloud workloads
- AirGap immutability protects backups from ransomware and adversarial deletion at the data layer
- AutoVerify automatically boot-tests every backup so we know recovery actually works
- Virtual Office in the Axcient Cloud lets us spin up entire failed environments in under an hour
- Strong audit and reporting alignment with SMB1001 and ISO 27001 evidence requirements
Alternatives we also deploy and support
Where another platform is a better fit (existing licensing, sovereignty preferences, or workload edge cases), we deploy and manage the alternatives below. We are not locked to a single vendor. Each card below covers what the platform is good at, who it suits, and where to be careful.
Microsoft 365 Backup (native)
In-tenant operational rollback
Microsoft's own paid backup service released in 2024. Backs up Exchange, OneDrive and SharePoint inside the tenant with very fast restore. Data stays inside Microsoft, which is the trade-off. Useful as a first-line operational rollback layer, not a substitute for independent off-platform backup.
Best for: Large SharePoint or OneDrive estates where rapid in-tenant rollback after corruption or ransomware sync events is the priority.
Watch outs: Per-user pricing on top of existing licensing. Backup lives in the same Microsoft tenant blast radius. Limited Teams chat coverage.
Veeam Data Cloud for Microsoft 365
Mature self-hosted or SaaS backup
The most established Microsoft 365 backup product. Granular restore for mailboxes, OneDrive, SharePoint and Teams. Self-hosted or fully managed Veeam Data Cloud SaaS option, with support for Australian object storage including AWS Sydney, Azure Australia East, and Wasabi Sydney. Strong fit where self-hosting or hyperscaler-owned storage is required.
Best for: Mid-market and enterprise environments with existing Veeam estates, sovereignty requirements, or where customer-controlled storage is mandated.
Watch outs: Self-hosted deployments need infrastructure to run the backup proxy and repository. SaaS option simplifies this but moves storage decisions back to Veeam.
Acronis Cyber Protect Cloud
Backup plus endpoint security in one platform
Combines Microsoft 365 backup with anti-malware, EDR, patch management and DLP in a single agent and console. Backs up Exchange, OneDrive, SharePoint, Teams, Public Folders, Project Online and OneNote. Strong fit when one platform for backup plus endpoint protection is preferred and your MSP can manage both layers consistently.
Best for: Smaller environments that want backup, EDR and patching consolidated under one vendor and one bill.
Watch outs: Doubling up on EDR and backup vendor lock-in. If endpoint security is already mature with another vendor, the bundle benefit erodes.
Datto / Kaseya SaaS Protection
MSP-native per-user backup
Built specifically for the MSP delivery model. Per-user pricing, infinite retention, simple onboarding, and tight PSA integration. Backs up Exchange, OneDrive, SharePoint and Teams. Common in smaller MSP stacks where simplicity and predictable pricing outweigh deep enterprise features.
Best for: Smaller Australian SMBs where retention simplicity and MSP-managed delivery are the priority.
Watch outs: Less granular for advanced e-discovery scenarios. Storage is in Datto/Kaseya cloud, which suits most clients but should be confirmed against sovereignty requirements.
AvePoint Cloud Backup
Enterprise SharePoint and Teams governance
Long-standing leader for SharePoint, OneDrive and Teams backup with governance, e-discovery and migration tooling on the same platform. Strong choice for organisations with significant SharePoint estates or formal records management obligations.
Best for: Enterprise and regulated organisations with deep SharePoint usage, complex permissions, or records management obligations.
Watch outs: Higher price point. Feature depth can be more than smaller environments need.
Barracuda Cloud-to-Cloud Backup
Simple SaaS backup with unlimited storage
Cloud-to-cloud backup for Microsoft 365 with unlimited storage and unlimited retention as a default. Restores at the item level for Exchange, OneDrive, SharePoint and Teams. Strong fit for mid-market organisations that want a fixed cost and minimal config.
Best for: SMBs that value flat-rate pricing and minimal admin overhead over deep customisation.
Watch outs: Less mature on Teams chat fidelity than tier-one options. Audit and reporting depth lags Veeam and AvePoint at the high end.
Dropsuite (Microsoft 365 Backup)
Email-first backup and archive
Built on top of email archiving heritage. Strong Exchange Online backup, journaling, archiving and e-discovery, with Microsoft 365 OneDrive, SharePoint and Teams coverage. Popular in MSP stacks where compliance archiving is a separate requirement to backup.
Best for: Australian businesses that need both backup and email journaling/archive in one product.
Watch outs: OneDrive and SharePoint feature parity with email is improving but not always at the same depth as backup-first vendors.
N-able Cove Data Protection
Direct-to-cloud backup for MSPs
Direct-to-cloud architecture (no local appliance required) covering Microsoft 365, servers, endpoints and Microsoft 365 with deduplicated storage in the N-able cloud. Pay-as-you-grow pricing model. Common in MSP stacks where Cove is already in use for endpoint and server backup.
Best for: Clients on existing N-able Cove infrastructure or MSPs standardised on the N-able platform.
Watch outs: Microsoft 365 module is part of a wider stack. Best value when used alongside Cove for servers and endpoints.
UniFi Drive 4.0
On-premises Microsoft 365 protected backups
New in February 2026, UniFi Drive 4.0 added Microsoft 365 Protected Cloud Backups for Work or School accounts. Off-cloud, multi-version, isolated storage on UniFi hardware. A genuine option where on-premises sovereignty or zero ongoing licence cost matters.
Best for: UniFi-standard sites that want a sovereignty layer or fixed hardware-cost backup without per-user licensing.
Watch outs: Newer to market than Axcient and Veeam, fewer enterprise features around audit and e-discovery, no SaaS managed-cloud option.
Australian regulatory context
Backup is not just an IT decision. For Australian businesses it intersects with a number of regulatory obligations that vary by industry.
ASD Essential Eight: Regular Backups
Backups must be performed and retained, synchronised, isolated, and tested. The ACSC publishes the Essential Eight Maturity Model that defines what good looks like at ML1, ML2 and ML3.
Privacy Act and Notifiable Data Breaches
You must be able to identify what personal information was affected during an incident. Without backup that supports forensic restore, this is often impossible.
APRA CPS 234 (Financial services)
Regulated entities must maintain capability to identify, manage, and recover from information security incidents. Backup with tested restore is core to this.
My Health Records Act and OAIC guidance (Healthcare)
Healthcare providers handling MHR data have specific retention and breach reporting obligations that drive longer retention windows.
SMB1001:2027 control 3.1.1.1
Requires an offline copy of backups, a backup register, defined retention of at least 6 months, and tested restore at least annually.
Our recommended stack
For most Australian SMBs and mid-market clients, Real Bytes deploys a layered approach. The exact mix depends on data volume, regulatory obligations, and existing infrastructure, but the layering principle stays the same.
Layer 1: Native protection
Use Microsoft 365 retention policies, version history, and recycle bin. Enable retention labels for compliance-critical content. This is the cheapest layer; it is also the most limited.
Layer 2: Microsoft 365 Backup (optional)
Consider native Microsoft 365 Backup for very fast operational rollback on large SharePoint and OneDrive estates. Treat it as a first-line restore tool, not your only backup. Data still sits inside Microsoft.
Layer 3: Independent third-party backup (mandatory)
ConnectWise x360Cloud for Microsoft 365 and Google Workspace. ConnectWise x360Recover for servers, endpoints and Azure workloads. Backups live in the immutable Axcient Cloud, fully independent of the Microsoft tenant.
Layer 4: On-premises options where appropriate
For UniFi-standard sites, UniFi Drive 4.0 introduced Microsoft 365 Protected Cloud Backups in February 2026, providing off-cloud copies on local hardware. Useful as an additional sovereignty layer or where cost predictability matters.
Layer 5: Retention, testing and runbooks
Define retention against your industry obligations. Test restore at least annually using AutoVerify and a sample bulk restore. Document the runbook so any engineer can execute recovery under pressure.
A note on UniFi Drive 4.0
UniFi Drive 4.0 brought Microsoft 365 Protected Cloud Backups for Work or School accounts to UniFi hardware in February 2026. It is a genuinely useful addition for UniFi sites that want off-cloud archive copies without ongoing per-seat licence costs. It is not a full replacement for ConnectWise x360Cloud where audit logging, e-discovery search, granular restore at scale, and SOC 2 certified storage are required, but it is a strong complement for many Australian SMBs already standardised on UniFi.
Common mistakes
"Microsoft backs us up"
They do not, in the way you mean. Microsoft keeps the platform running. You are responsible for your data inside it.
Backup only configured for Exchange
OneDrive, SharePoint and Teams hold most of the at-risk data now. Backup must cover all four workloads.
Backup stored in the same Microsoft tenant only
A compromised admin account or tenant-level event takes both production and backup. Independent storage is non-negotiable.
No restore testing
Backup that has never been restored is not backup. Test annually at minimum, including a full mailbox and a SharePoint site.
Retention not aligned to obligations
Default 30 day retention does not meet most regulatory windows. Align retention to your industry, not the vendor default.
No coverage for departing staff
When a licence is reassigned, the original mailbox can be purged. Backup before offboarding, retain per policy.
Forgetting Teams chat
Teams chat history is held in hidden mailbox folders and is not always covered by every backup tool. Verify with your vendor.
Get Microsoft 365 backed up properly
Real Bytes deploys Veeam, Acronis and Microsoft 365 Backup for Australian businesses. We design retention to meet your compliance obligations and test restores so you know recovery actually works.