A first Microsoft 365 backup, and a full restore test with measured times for mailboxes, OneDrive and SharePoint
A professional services firm of about 150 people in South Florida, running everything on Microsoft 365.
- Scale
- 150 mailboxes and OneDrives, 4 shared mailboxes, 38 SharePoint sites, about 3.1 TB, copies every 8 hours
- Engagement
- Three weeks to deploy, plus a one-day restore test and a quarterly repeat
The challenge
The firm had assumed that Microsoft 365 was its backup. When we asked how long a deleted OneDrive or a damaged SharePoint site could be recovered, and who had ever tried, nobody knew. The recycle bins and retention settings were there, but they are not a copy made on a schedule, they run out, and an attacker or a sync error that deletes data can reach them too.
Microsoft keeps Microsoft 365 running. It does not promise to give back data that the customer, an administrator, a sync client or an attacker deletes or changes. That split of duties is why backup of a tenant is the customer's job, and why a backup is only worth the restore test that proves it.
We took the order of importance from the business. Mail for partners and finance came first, then the SharePoint sites for active client projects, then OneDrive accounts, then archived sites. Copies were taken every 8 hours, so the most the firm could lose was about 8 hours of changes, and the backup service ran under its own identity with no standing access from the firm's everyday admin accounts, so a compromised admin could not wipe the copies as well.
The test used real data and a stopwatch. A single deleted message was back in the mailbox in 4 minutes. A full 38 GB mailbox of 61,000 items took 52 minutes to restore into a recovery folder. One user's OneDrive of 212 GB and 118,000 files took 2 hours 41 minutes, and a 460 GB SharePoint site took 5 hours 10 minutes. Restoring 25 mailboxes at once took 6 hours 20 minutes, not the 52 minutes that perfect parallelism would suggest.
The reason is throttling. A restore writes through Microsoft Graph, and Microsoft limits how fast any one app can write to a tenant, so adding more backup capacity does not make the data return faster beyond a point. Extrapolating from the measured rates, the whole tenant of 3.1 TB would take about 30 hours to restore, which is a planning figure and not a promise. That figure is why the firm wrote an order of recovery instead of expecting everything back at once.
The finding that mattered most was not speed. Two SharePoint libraries came back without their unique permissions, and the restored files inherited the site's defaults. In a real incident that would have shown the wrong people files they should not see, so the runbook now includes a permissions check after each SharePoint restore. The quarterly repeat uses a different sample each time, so coverage grows and a change in the tenant is caught within three months.
What our team delivered
- A review of what Microsoft 365 already keeps, so the firm knew the limits: the deleted-items window in Exchange Online (14 days by default, up to 30), the recycle bins in OneDrive and SharePoint (93 days), and what retention policies do and do not cover
- A third-party backup of Exchange Online mailboxes including 4 shared mailboxes, OneDrive and SharePoint, taken every 8 hours through Microsoft Graph, with the copies stored outside the tenant under a separate identity and kept in object-locked storage
- A least-privilege backup app registration, an admin account for the backup service protected by phishing-resistant MFA and not used for anything else, and alerts when a backup job fails or the amount of data changes sharply
- A written restore test: one deleted message, one full mailbox, one user's OneDrive, one SharePoint site and 25 mailboxes at once, each timed from the request to the data being usable
- A restore runbook that records the measured times, the order in which things come back, who may start a restore and who approves overwriting live data
- A repeat of the test every quarter with a different sample, and a retention setting for backups that the firm's counsel reviewed
Result
The first test found two problems that would have surfaced only in a real incident: two SharePoint libraries lost their unique permissions on restore and had to be re-applied by hand, and a shared mailbox had been left out of the backup scope. Both were fixed and the test repeated. The firm now has measured restore times instead of an assumption, and knows that restoring the whole tenant would take well over a day, which is why the order of recovery is written down. This is an illustrative engagement that describes the kind of work our team does; details are composite.
Get this for your company
Related services with fixed prices and a written scope.
Emergency package: security engineer in 1 hour
Is your company in a cybersecurity crisis? Purchase this package and a security engineer will call you within 1 hour.
Callback within 1 hour, 24 hours a day, 365 days a year
$1,950 per incident
Insurance-ready bundle
The three things cyber insurers and clients ask for most: an external assessment, a phishing simulation for 25 users and a disaster recovery plan.
Assessment report in 5 business days; plan draft in 15 business days
$5,400 per bundle, phishing simulation for 25 users
Managed IT and security (MSP)
One monthly price per team member: help desk, device management, patching, backup monitoring and security basics.
Onboarding starts within 10 business days
$100 per team member, per month
Show 4 more
Initial assessment of public endpoints
What an attacker can see and reach from the internet: your domains, mail, websites, remote access and cloud exposure.
Report within 5 business days of kickoff
$1,000 per assessment
Managed security monitoring
Endpoint detection and response watched by our analysts, priced per device.
Agents deployed within 7 business days
$18 per endpoint, per month
Cloud security review
A review of one Microsoft 365, Azure, AWS or Google Cloud tenant against recognized benchmarks.
Report within 7 business days of read-only access
$2,800 per tenant
Cloud management
We run your Microsoft 365, Azure, AWS or Google Cloud environment: access, cost, patching, backup and security settings. Priced per month for one tenant.
Onboarding within 15 business days
$1,900 per tenant, per month
After you purchase, we contact you within 1 hour, any time of day or night, to start onboarding.
No payment is taken online. When we call you within the hour we confirm the scope and send an invoice (ACH, card or crypto).
Backup tiers: data lost versus time to recover
Recovery point objective (RPO) is how much recent data a restore loses; recovery time objective (RTO) is how long the restore takes. Faster tiers sit close to the production system and share its fate; slower tiers survive ransomware and site loss. The scale is logarithmic. Illustrative figures.
Email kept as write-once evidence
Each message is copied as a raw .eml with its headers and DKIM signature, hashed with SHA-256 and stored in an Amazon S3 bucket with Versioning and S3 Object Lock in compliance mode. An AWS KMS customer-managed key encrypts it, with key administrators separated from key users, and AWS CloudTrail logs every key use. A hash chain with a Merkle root receives an RFC 3161 timestamp, so a verifier can recompute the hash and check the timestamp and DKIM later. A delete attempt, even by the root user, is refused until the retention period ends.
Facing something similar?
Tell us about your environment. We will tell you plainly what we would do and what it would take.