Do You Need a Microsoft 365 Backup? An Australian Guide

Yes, in most cases you do. Microsoft keeps the Microsoft 365 service running, but you are still responsible for your own information. Microsoft's own Australia and New Zealand guidance says customers remain responsible for their data. Recycle bins and version history cover everyday slip-ups. They are not a plan for ransomware, a hijacked account, a staff member who deletes the wrong folder, or a subscription that lapses.

This guide explains what you already have, where it runs out, what your options are, and how to decide without buying more than you need. It is written for NSW households and small businesses, not for IT departments with spare time.

What Microsoft 365 already protects, and what it doesn't

It helps to separate two ideas that get blurred: availability and recoverability. Microsoft looks after availability, meaning the servers stay up. Recoverability, meaning you can get back the exact file from last Tuesday, is largely your job.

Here is what you get without paying for anything extra:

• Recycle bins. When you delete items from a SharePoint site, they go to the site Recycle Bin first, and you can restore them from there. Microsoft's restore guidance describes a 93-day retention window through the recycle-bin stages, subject to deletion and expiry conditions.
• Version history. Useful if a file was overwritten or corrupted, as long as the older versions still exist.
• Support-assisted restore. Microsoft describes a further short window for some SharePoint restorations, but it applies to whole site collections, not to a single file, list or library.

That is genuinely helpful. If someone drags a folder to the bin on Monday and you notice on Wednesday, you are fine.

The gaps show up in the slower, messier situations:

• A file quietly corrupted or encrypted months ago, and nobody noticed until the year-end.
• A departing employee who empties their OneDrive on the way out.
• Ransomware that syncs encrypted files into the cloud, overwriting good copies.
• A compromised account where an attacker deletes mail and files, then clears the bins.
• A subscription that ends. Microsoft states that for applicable services customer data is held in a limited-function account for 90 days, after which the account is disabled and the data, including backup copies, is deleted under its data management process.

None of these are unusual. They are the ordinary reasons we get a worried phone call.

Why Australian guidance points to a deliberate backup plan

The ACSC's message is consistent: prevention is not enough, and a backup only helps if it is unaffected by the incident and actually restores. Its guide on how to back up your files and devices explains that cloud backup services upload your data to a provider's servers, and that keeping an offline copy matters because malware and ransomware can reach connected devices and synchronised cloud storage.

For small businesses, the ACSC's technical example on regular backups walks through using third-party backup solutions for cloud services. Its practical checklist for choosing one is worth keeping:

1. It supports multi-factor authentication and modern secure sign-in.
2. It covers the workloads you actually use: Exchange (email), SharePoint, OneDrive and Teams.
3. It can create a copy that is not sitting in the same online environment as the original.
4. You can prove it works by doing a test restore.

The ACSC also warns that after a ransomware incident you should restore only from backups known to be clean. Restoring an infected backup can spread the problem again. That is one reason we always ask when a backup was last tested, not just whether one exists.

Your options, compared

There is no single best backup for Microsoft 365. There is the best fit for your size, risk and budget. Here are the realistic choices.

What Microsoft's own tool covers and costs

Microsoft's backup page says the tool can protect all or selected SharePoint sites, OneDrive accounts and Exchange mailboxes, with backups currently retained for one year from the time an item changed or a snapshot was taken. It is sold as a standalone, pay-as-you-go service.

On cost, Microsoft's pricing model lists $0.15 per GB per month of protected content. That page is Microsoft's US documentation, so check the currency and any GST in your own admin centre before budgeting. One detail catches people out: if you delete content from a protected site, you are still billed for it while the tool holds it for the year.

A worked example, using that list price: a small office with 200 GB of protected mail and files would be looking at 200 × $0.15 = $30 a month at list price, before any tax or currency conversion. Your real figure moves with how much you protect, so protect selectively rather than switching on everything.

Where it falls short

Teams chats, planner boards, and some tenant configuration (conditional access rules, mail flow settings, shared mailbox permissions) are not things a file-level backup necessarily restores. If rebuilding your settings would take a day, that is a cost worth counting. Check the current scope on Microsoft's page against the list of things your business actually relies on.

How much backup is enough for your situation

Households and home offices

You probably do not need a business-grade product. You need your photos, tax records, and anything irreplaceable in at least two places, with one disconnected. If your files live in OneDrive, remember that sync is not backup: a deleted or encrypted file is deleted or encrypted everywhere. A simple external drive that you plug in monthly, then unplug, closes most of the gap. Our 3-2-1 backup rule guide shows the layout step by step.

If something has already gone missing, act quickly and stop using the device. Our guide to recovering deleted files on Windows explains what to do in the first few minutes.

Sole traders and tradies

Your email is your invoices, quotes and customer history. Losing a mailbox hurts more than losing a laptop. A third-party mailbox backup, plus a monthly offline copy of your job files, is usually proportionate. Keep it simple enough that you will really maintain it.

Offices holding client records

Accountants, lawyers, clinics, real estate agencies and consultants carry extra weight here. The OAIC's guidance under Australian Privacy Principle 11 covers securing personal information, and it points organisations to consider what is included in backups, how far back they can be recovered and whether they are regularly tested. The same guidance expects personal information you no longer need to be destroyed or de-identified, including in backup copies. Its guide to securing personal information makes the same point about making copies and storing them securely.

That cuts both ways. More backups are not automatically safer. Every extra copy is another place client data sits, so retention needs a decision, not a default.

If your backup provider stores data offshore, read the OAIC's note on sending personal information overseas, because disclosure to an overseas recipient can trigger extra obligations. The same discipline applies to any customer-facing tool you add; this privacy testing checklist for website assistants shows the kind of questions worth asking before anything touches client data.

Ransomware: the case that settles the argument

If you remember one scenario, make it this one. Ransomware encrypts files on your computer and on anything synced to it. A cloud folder that mirrors your laptop will happily mirror the damage. Recycle bins may be emptied by an attacker who has your login. This is why the ACSC stresses an offline copy and clean restores.

Prevention still comes first. Our ransomware prevention tasks for small businesses and Microsoft 365 security controls guide cover the controls that make an incident less likely. A backup is what lets you recover if prevention fails. Recovery planning is also where other software teams think hard about resilience; how one software vendor describes protecting business data is a useful example of the questions to put to any supplier holding your information.

Best practice checklist for Microsoft 365 backup

You do not need a long policy document. You need answers to these questions, written down where two people can find them:

1. What is protected? List mailboxes, SharePoint sites, OneDrive accounts and Teams data, and note anything excluded.
2. How far back can you go? Pick a recovery window that matches the risk, such as a financial year for accounting records.
3. Is one copy independent? At least one copy should not depend on the same login as the original.
4. Is one copy offline? This is the ACSC's advice for ransomware resilience.
5. Who has admin rights? Use multi-factor authentication on every admin account, including the backup tool.
6. When did you last test a restore? Pick one mailbox and one folder each quarter and restore them to a different location.
7. What gets deleted, and when? Set a retention period and a process for destroying data you no longer need.
8. What happens if you cancel? Export mail, files and settings before you close a tenant or let a subscription lapse, given the 90-day limit above.

Migrating mail into Microsoft 365 is a good moment to set this up, since you are already deciding what moves and what stays. Our email migration guide covers that side.

Our perspective: we would rather prove it than promise it

When we look at a small business's Microsoft 365 setup, the story is rarely "no backup at all". It is usually "we thought it was covered". Someone assumes Microsoft does it, someone else assumes the cloud sync is the backup, and nobody has ever restored anything.

So we start with a plain question: what would hurt most to lose, and how long could you cope without it? A café owner might say next week's roster and supplier invoices. A clinic says patient correspondence. The answer shapes everything, and it often turns out the right setup is smaller and cheaper than people fear.

We also think restores matter more than reports. A green tick in a dashboard is nice. A file you have opened from last month's copy is proof. We work onsite across NSW and remotely where it suits, and we explain each step in plain English. You should not need technical terms to decide this. We handle the setup, test the restore with you watching, and leave you with a one-page note of what is protected.

- PC Scientist

Getting help in NSW

If you would like someone to check what you really have, our Data Recovery Scientist team can review your backup setup and help recover files when something has gone wrong. For the Microsoft 365 side, including mailboxes, sign-in problems and tenant settings, see our business email and Microsoft 365 support. Our positioning is simple: clear upfront pricing, no fix-no fee repairs, and several devices looked after in a single visit. On the Central Coast, there is also a local page for data recovery and backup. You do not need to know which service to ask for. Tell us what happened or what worries you, and we will work out the rest. You can start from pcscientist.com.

Sources

• Microsoft: Essential Eight backups for Australia and New Zealand
• Microsoft 365 Backup (Microsoft Australia)
• Pricing model for Microsoft 365 Backup (Microsoft Learn)
• Restore deleted items from the site collection recycle bin (Microsoft Support)
• Data management at Microsoft
• OAIC: APP 11 Security of personal information
• OAIC: Guide to securing personal information
• OAIC: Sending personal information overseas

Recommended

• 3 Microsoft 365 Security Controls to Be Audit Ready in Australia
• Add an Immutable Copy: 3 2 1 Backup Rule for Australians
• Authenticator Apps and Backups: Two Factor Authentication in Australia