Microsoft 365 Cloud Backup Solutions 2026

A Microsoft 365 cloud backup solution must recover the client records your practice actually stores in Exchange Online, OneDrive and SharePoint. Choose Microsoft 365 Backup for protection managed inside Microsoft’s services, or a separate backup repository when your recovery arrangement needs it.

Protect Microsoft 365 Practice Records

List your practice’s mailboxes and document locations before selecting protection. Include shared client email, staff mailboxes with client correspondence, OneDrive working files and SharePoint client libraries. A folder visible on a laptop does not tell you which cloud service owns it.

Record the service, mailbox address or site location beside each group of records. Assign a record owner who decides what belongs in the client file. Name a backup operator separately, even when a sole practitioner holds both roles.

Office 365 cloud backup and Microsoft 365 cloud backup often describe the same buying task. The wording does not establish coverage. A desktop Office licence, personal OneDrive account and business subscription are different products. Identify the business plan and enabled services before listing anything as protected.

Add a new mailbox or client site to the protection register when you create it. During staff departure, confirm where their client records live before deleting the account. Your wider practice recovery arrangement also needs to cover records held outside these services.

Separate Retention From Recoverable Backup

Retention keeps records for a defined purpose, while a backup supplies a recoverable earlier copy. Microsoft Purview has retention and records-management features with their own licensing requirements. Retaining evidence for a records duty does not by itself recreate a working mailbox or site.

Exchange Online’s normal deleted-item recovery has a limited window. Microsoft documents a default of 14 days, adjustable to 30 days. Holds and other retention settings affect what remains available. An item still in Deleted Items needs ordinary recovery before a backup restoration.

For an overwritten SharePoint document, Version history can make an earlier version the current version. Microsoft says this creates a copy of the selected version. That action changes one document. It does not restore the original site, its entire permission arrangement or other missing records.

A deleted user has a separate recovery path. Microsoft allows user restoration within 30 days and requires available licences for continued use. OneDrive departed-user retention is separately configurable. Treat account deletion, item deletion and document overwrite as different recovery events.

An export may retain useful contents but lose the original folder arrangement or access settings. Record the required recovery outcome alongside the history your practice needs. Use record-retention duties to decide what must remain available, then choose protection that can supply it.

Compare Coverage and Recovery Limits

Compare Microsoft 365 Backup and a third-party product against the same mailboxes and client libraries. Microsoft’s service creates backups within its protected-service boundaries. A separate backup repository adds another storage arrangement to manage. Neither choice makes every object in your subscription recoverable.

Decision	Microsoft 365 Backup	Veeam Backup for Microsoft 365
Services relevant here	Selected Exchange mailboxes, OneDrive accounts and SharePoint sites	Exchange Online, business OneDrive and SharePoint, with configured backup jobs
Recovery method	Mailbox item recovery, site/account recovery and selected files or folders	Restore Portal supports recovery of backed-up service data within the operator’s scope
History	Restore points within the active policy’s recovery window	Repository retention can be snapshot-based or item-level
Permissions	Granular file recovery inherits destination permissions and does not restore item-level permissions	Mailbox-folder and Calendar sharing permissions are excluded from backup
Cost basis	Consumption-based protection with separate billing setup	Protected-user licensing plus repository and operating costs

Veeam Backup for Microsoft 365 is the self-managed product discussed here. Its configuration and responsibilities differ from Veeam’s hosted products. Personal OneDrive is excluded. Its licensing also considers users with access to protected non-personal SharePoint sites, so site count alone is an inadequate budget.

Veeam’s snapshot retention follows restore points. Item-level retention follows an item’s creation or last-modified time. That distinction affects older, unchanged client documents. Its exclusions also include archived SharePoint sites and the site collection recycle bin. Avoid assuming that backing up a site captures every neighbouring object.

Microsoft 365 Backup is a practical choice for a sole practitioner who wants protection administered in Microsoft 365. It still requires billing setup and active protection policies. Choose a separately managed repository, such as Veeam, when that storage arrangement is part of your recovery requirement and you have someone to maintain it.

For a team with shared client folders, operator scope and restored access carry more weight than staff count. Veeam’s Restore Portal separates infrastructure administration from delegated recovery. Microsoft has workload-specific administrator roles. Select the option whose permissions fit the people responsible for recovery.

Staff departure needs its own entry in the recovery plan. Microsoft documents retained backups for deleted users, with additional handling for their identity and destination. For Veeam, define the retained repository history and a supported destination before offboarding. A backup licence count is not evidence that a departed user’s records remain recoverable.

Assign Access and Recovery Responsibility

Separate the authority to configure protection from the authority to approve a restoration. Ordinary access to a client folder must not automatically give a staff member permission to recover other clients’ records.

Assign four responsibilities in the practice’s recovery instructions:

• The record owner approves which version is needed and which staff may see it.
• The backup administrator maintains protected objects, billing and service permissions.
• The operator checks failures and performs authorised recovery.
• The principal approves a restoration that could replace current client work.

Microsoft’s setup documentation requires a valid Azure subscription and billing information. Azure Owner or Contributor access is needed for that billing setup. SharePoint and Exchange administrators manage their relevant workloads, while Microsoft 365 Backup Administrator covers all supported workloads. Use the narrowest role that permits the task.

Veeam’s modern app-only connection requires a Microsoft Entra application with documented service permissions. Its setup uses Global Administrator authority for adding the organisation. Restore permissions depend on the service and selected method. Assign ongoing Restore Portal access separately from that setup authority.

Before relying on either option, record the enabled services, protection selection and first available restore point. Check which account can still access backups if the usual operator leaves. Assign certificate renewal and permission changes to a named role, and send failure notifications to someone who can act.

Microsoft’s multi-admin notifications can flag potentially harmful changes, including removed protection and paused billing. Give those alerts a second recipient where the practice has one. An alert sent only to a departing administrator is a weak handover arrangement.

Restore a Fictional Client Record

Restore a disposable document to a separate location before attempting recovery of live client work. This fictional exercise uses a restricted SharePoint test library and a document called Client record recovery exercise.docx. It contains only the invented text Original document contents, with no client details.

Give the authorised operator access to the test library. A second test account must have no access. Save the original and wait until its backup is available. Keep an unchanged reference copy in a separate restricted folder, then change the test document to Replacement document contents.

Use Microsoft 365 Backup’s documented SharePoint procedure:

1. Open Microsoft 365 Backup, select SharePoint Restore and choose Restore specific files or folders. The operator needs the SharePoint Backup Admin role stated in Microsoft’s granular-restore instructions.
2. Select the protected test site and a restore point from before the change. Browse its document library and select only the exercise document.
3. Choose Create a new folder and restore to it. Review the destination, then start restoration. The changed source document must remain in place.
4. Open the recovered document in the new folder. Expect Original document contents. Compare it with the restricted reference copy and confirm the source still contains Replacement document contents.
5. Inspect destination permissions before returning the record to a client folder. The authorised operator must have the required access, and the excluded test account must remain unable to open it.

For a missing item, check the protected site and library selection first. An absent version requires checking the available restore point and when protection began. Microsoft’s restore instructions also exclude granular recovery from locked sites and rights-managed libraries.

If access is incorrect, inspect destination inheritance. Granular recovery does not recreate item-level permissions. Stop before copying the file into live work. Give the administrator or Microsoft support the restoration task details, source location and observed error, without attaching client contents.

For Veeam recovery, begin with the operator’s allowed objects in Restore Portal and the relevant service’s restore instructions. Escalate an absent object to the backup administrator to inspect job selection and operator scope. Keep the successful recovery location and permission checks in the practice’s recovery record.

Keep Tax Genie’s Records Separate

Microsoft 365 protection covers supported records present in your protected mailboxes and document locations. Tax Genie collects client forms and documents, checks answers with rules and AI, generates engagement letters and sends approved details to your tax software.

Tax Genie also files completed documents to SharePoint. Those filed documents enter Microsoft 365 protection only when their destination is included in a working backup policy. The backup of a SharePoint copy is separate from the records retained in Tax Genie.

Tax Genie excludes Tax File Numbers (TFNs) from emails, exports and generated documents. Those backed-up outputs still exclude TFNs. Protecting them does not create a backup connection to Tax Genie. List the copied document and its destination in your recovery register, then assign the recovery arrangement for each original record where it is held.