7 questions to ask your IT provider about Microsoft 365 backup

1. Is Microsoft 365 backed up, and what exactly is covered?

Ask for the list: Exchange mail, OneDrive, SharePoint, Teams files and the Entra ID directory (users, groups and policies). Do not accept a general yes. Backups of servers and PCs do not cover your cloud data.

2. How often does it run, and how long is history kept?

Daily is a sensible minimum. Ask how far back you can restore from, such as 30 days, 1 year or 3 years, and whether you can restore a single item without rolling back everything.

3. Where is the backup stored?

Ask for the country and region. If you want your data kept in Canada, get the region in writing. If a contract or regulator sets residency rules for you, confirm them with your advisor.

4. Who can delete or change the backup?

Compromised admin accounts and ransomware go after backups first. Ask whether anyone, including your own admins and the provider, can delete a backup or shorten its retention, and whether the copies are locked. A locked copy that the application cannot delete is a strong answer, and the provider should be able to say exactly who can override it.

5. When did you last test a restore?

Ask for the date and the result. A backup nobody has restored from is a guess. Insurers and auditors often ask for the same information, so keep the answer.

6. How do I get my data if we part ways?

Ask who owns the backup account, what happens to the data if you cancel, and how long you have to export or restore it. You should never be locked out of your own history.

7. What will I see, and how often?

Ask for a regular report showing the last successful backup, any failures and the last restore test. You should not have to ask in an emergency to find out whether backups were working.

Where storiv fits

storiv is built for small IT teams and MSPs who want clear answers to these questions. It backs up Entra ID, Exchange mail, OneDrive and SharePoint to encrypted storage in Canada, with a change log and risk alerts. On the Business plan, backups are locked for 3 years with S3 Object Lock in governance mode, where only a separate break-glass role held by storiv can override the lock. Restore covers users and groups today. A regular report for insurers is planned, not built yet.

Common questions

Does my IT provider back up Microsoft 365 by default?

Not necessarily. Many managed IT plans back up servers and PCs but not Microsoft 365 cloud data. Ask for a written list of what is covered.

How do I know a backup actually works?

Ask when a restore was last tested and what the result was. Test restores are the only real proof.

Who should own the backup account?

Ideally your organization, or at least with a clear written agreement on how you get access to your data if you change providers.