SharePoint Backup Best Practices: The Architecture of Resilience

SharePoint Online is a cornerstone of the Microsoft 365 ecosystem. It serves as a central repository for documents and a primary source of knowledge, enabling collaboration within and across teams. As a system critical to an organization’s business continuity, it requires comprehensive and reliable data protection.

The article explains why storing data in the Microsoft cloud only is not a backup solution. You will also learn about SharePoint backup best practices to secure your collaboration environment and ensure the ability to restore key business data effectively.

Microsoft Does Not Guarantee Business Continuity for Your Internal Teams

As a provider of cloud services, Microsoft is responsible for the availability of the infrastructure, not end-user’s data. Native tools such as retention policies, Litigation Hold, and version history do not constitute an effective SharePoint backup strategy, as stated across Microsoft Learn documentation.

The Shared Responsibility Model and Limited Liability

Cloud services providers, including Microsoft, limit their contractual liability. This is justified, as they have no control over, for example, malicious or accidental data deletions by customers’ employees.

To address this, they implement the industry-standard Shared Responsibility Model, where they are responsible for the availability of cloud storage and infrastructure, while customers (organizations) remain responsible for their own data.

Ultimately, your organization bears full responsibility for its SharePoint Online site data, including content, pages, lists, and files.

See what Microsoft documentation says about Shared Responsibility

Why Retention Policies Are Not SharePoint Backup

Retention Policies in Microsoft 365 act like a legal order to preserve documents. While files in the Preservation Hold library cannot be deleted, this is not a true backup and recovery strategy for the following reasons:

• No Isolation: There is no separation between production data and the Preservation Hold library. A ransomware attack or loss of account access can compromise both.
• No Point-in-Time Recovery: There is no option to restore data to a specific point in time before an incident.
• Manual Recovery Process: Restoring an entire site collection is a tedious, manual process rather than a one-click recovery solution.
• Configuration Risks: A simple user error, such as deleting a policy, can lead to permanent data loss.

Litigation Hold: A Legal Tool, Not a Backup Strategy

Litigation Hold is designed for regulatory compliance, not for a backup and recovery process. It shares the same limitations as Retention Policies. 

Furthermore, it counts against the organization’s storage quota. If you block the deletion of SharePoint sites (which may consume gigabytes of space), you can soon reach storage limits. Also, buying additional space from Microsoft is usually not cost-effective.

See what Microsoft says about using Litigation Hold for data backup. Learn more

Version History: Protection Against Errors, But Not Disasters

Version History is useful for undoing minor mistakes during daily work. However, it fails if the source file is deleted, as all versions are lost with it. Additionally, it cannot counter modern ransomware that may encrypt files while creating thousands of new versions, overwriting valid history. 

Microsoft itself advises against relying solely on Version History for data protection. Learn more

SharePoint Backup Best Practices: Ensuring Complete Protection

Since Microsoft’s native tools offer limited backup functionality, organizations must implement robust SharePoint backup best practices to maintain business continuity.

Choose High-Fidelity Backup for Full Post-Recovery Functionality

Architecturally, SharePoint Online is a large database with a graphical interface. A robust SharePoint backup solution must support diverse data types to ensure that restored data is accurate and fully functional.

An effective backup should include:

• SharePoint Content: Unstructured data (documents, images), structured data (lists), and site pages (text, graphics).
• Metadata: System metadata (creation date, author, version history), custom taxonomy (statuses, tags), and permissions for granular control.

Ad-hoc backups or scripted exports are not SharePoint backup because you lose:

• Context: For example, an important contract file without the ‘Approved’ status assigned by a director or manager.
• Data relationships: Such as linked SharePoint lists.
• Searchability: Since the SharePoint search engine operates based on metadata, employees will be unable to find recovered data.

To conclude, when choosing a SharePoint Online backup solution, pay special attention to the scope of data covered by protection.

Store Data Outside the Microsoft Azure Cloud

To maintain high data resilience, production data and backup files should not share the same location. Furthermore, a sound backup strategy follows the 3-2-1 rule by keeping copies in multiple repositories—for example, in the cloud and on-premises. This is critical because cyber criminals often aim to destroy backups before launching a primary attack.

Comprehensive backup solutions typically offer the ability to replicate backups to selected data storage repositories as a standard feature. Relying on the same ecosystem—even with a choice of a different geolocation—creates a single point of failure. A notable case is the UniSuper incident. Total data loss was averted solely because the organization maintained an independent backup copy outside of Google Cloud Platform. More information about this incident can be found in this GitProtect blog article.

Utilizing offsite backups or independent cloud storage ensures that your organization remains operational even if the primary cloud environment is compromised.

Extra-Secure SharePoint Data with Immutable Backup

Although data immutability technology (aka Object Lock, Write Once Read Many) has been available for at least several years, immutable backup has only recently become a standard and best practice among organizations.

An immutable backup contains data in a read-only format. It cannot be altered, deleted, or even modified until the digital lock expires. Most backup solutions on the market support immutability, including the native Microsoft 365 Backup service.

Immutable copies serve as an effective defense mechanism against attacks targeting backup systems, including sophisticated ransomware campaigns. In the context of SharePoint backup, which may contain an organization’s critical data, such a data security mechanism is vital for maintaining business continuity.

Set Up Long-Term Retention to Protect Against Hidden Threats and Ensure Regulatory Compliance

A long backup retention period (the duration for which data is stored before being deleted) is a critical part of a comprehensive backup plan for the following reasons:

• It enables data protection against threats that may remain undetected for extended periods:
  • Malicious deletions: unauthorized removal of files or SharePoint list items by a departing employee.
  • Long-infiltration ransomware attacks: sophisticated campaigns where attackers slowly and imperceptibly encrypt or corrupt data over time.
• It ensures that compliance requirements (e.g., GDPR, DORA, HIPAA) for long-term storage of specific documentation are met. SharePoint often serves as a repository for document libraries, including contracts, invoices, or project documentation.

Microsoft’s native tools offer relatively short retention periods. For instance, the site collection recycle bin stores data for 93 days, and Microsoft 365 Backup has a maximum limit of 365 days.

To ensure a retention of several years, use independent backup solutions that support a wide range of data storage options (e.g., non-Azure-hosted S3 cloud storage, NAS devices, or local disks). These solutions are often significantly more cost-effective than purchasing additional storage from Microsoft.

Have Flexible Data Recovery Options at Your Disposal

It is essential to have diverse data recovery options available. Those that enable the fastest possible restoration of data depending on an incident, helping to achieve optimal RTO and RPO values. Or those that support specific data migration scenarios.

Ensure that your backup and recovery plan includes:

• Not only full disaster recovery, but also granular recovery: The former is indispensable in the event of a global catastrophe, such as the encryption of all SharePoint data. The latter is required when you need to quickly restore data, e.g. a file on one of the SharePoint sites lost due to accidental data deletion or malicious intent.
• Restoring SharePoint sites beyond the original location: The ability to recover data to an alternative location or create an entirely new site from backup files is critical when:
  • a decision is made to reorganize the organization’s SharePoint environment following a cyberattack,
  • the organizational structure changes, or
  • or new teams are being established.

Choose the Right Approach for Your Needs: Microsoft 365 Backup vs. Third Party Solutions

When approaching SharePoint backup strategically, you must ask: Is the native tool from Microsoft sufficient, or is it better to turn to an independent backup software provider?

Microsoft 365 Backup has its advantages:

• Near-instant recovery, as data does not leave Microsoft’s infrastructure. It avoids issues with throttling when transferring large volumes of data.
• Frequent recovery points (every 10 minutes for SharePoint), which significantly optimizes the Recovery Point Objective (RPO).
• Generally simple configuration via the Microsoft 365 Admin Center.

However, at present, disadvantages still prevail:

• Backup limited to Microsoft 365 only: Third party backup tools allow organizations to manage the backup of all or most of their environments (endpoints, servers, NAS devices, Microsoft 365, virtual machines, etc.) through a single pane of glass.
• Lack of storage cost-saving mechanisms: Features such as data deduplication and backup compression, typically offered by backup software from third parties, are unavailable.
• No isolation / Single Point of Failure: Production data and backup files reside within the same ecosystem (even if in a different geolocation). With third-party backup tools, you can choose where to store data (various cloud services or on-premises storage).
• Retention limited to 1 year: Whereas independent backup solutions offer flexible and even unlimited storage options.
• The offboarding risk: There is a risk of service deactivation and subsequent deletion of copies by any authorized Microsoft 365 admin. External backup tools often provide their own granular control through dedicated Role-Based Access Control (RBAC). An administrator can create an account independent of Entra ID, with credentials unknown to the organization’s SharePoint Administrator or even a Global Admin. Furthermore, they offer Dual Authorization, requiring two administrators to confirm critical operations, such as the deletion of a backup.
• Pay-as-you-go model: Charging for every gigabyte can become costly for large organizations. Third party solutions usually base their licensing on a per-user model.

In summary, while Microsoft’s native tool allows for a functional SharePoint backup and efficient restoration, it does not offer the advanced features and independence provided by external backup solutions.

More Backup Best Practices for SharePoint (and Beyond)

We’ve discussed the SharePoint backup best practices specifically applicable to the SharePoint Online ecosystem. However, in the context of data protection, there are more general guidelines regarding:

• backup scheduling (automated backups),
• archiving legacy copies,
• backup process monitoring,
• employee education on data security, 
• and more.

To explore these topics further from a high‑level perspective, read our article on backup strategy. For concrete, practical guidance, we invite you to have a look at the article on creating a backup plan.

Xopero: Your Partner in Microsoft SharePoint Backup

If you require the flexibility, advanced technologies, and complete protection (extending beyond SharePoint), explore backup software from Xopero Software.

By choosing the well-established backup provider, you gain additional benefits such as:

• The ability to store data in a compliant geolocation/region for your Microsoft 365 tenant.
• Technical support from Xopero’s internal team of experienced technicians who work closely with the R&D department responsible for product development.
• Secure products developed in compliance with the highest industry standards, such as ISO 27001 and SOC 2 Type II.

You can start testing Xopero ONE right now for free for 14 days (no credit card required). Protect multiple workloads with business critical data, controlling everything from a centralized management console.

Try for free