Question 1

Does Microsoft 365 automatically back up your data?

Accepted Answer

No. Microsoft 365 provides availability and some native retention tools — recycle bins, versioning, and litigation hold — but these are not designed for fast, large-scale data recovery. Recycle bins expire, versioning has limits, and litigation hold is a legal discovery mechanism, not a restore solution. Organizations that need to recover from ransomware, accidental deletion, or admin error at scale require a dedicated third-party backup solution.

Question 2

What happens to Microsoft 365 data after a ransomware attack?

Accepted Answer

If an attacker gains admin credentials, they can tamper with or delete Microsoft's native retention policies before launching the main attack — eliminating your ability to recover from within the platform. Without a dedicated, air-gapped backup, organizations are left with limited options and face days or weeks of manual recovery effort. In environments with 1,000 or more users, that manual effort alone can take 14 days without a dedicated solution.

Question 3

What is an air-gapped backup and why does it matter for M365?

Accepted Answer

An air-gapped backup is isolated from your live environment — in this case, your Microsoft 365 tenant — so that an attacker who compromises your tenant cannot reach or destroy the backup. This isolation is the critical protection gap that native M365 tools cannot provide: if an attacker modifies retention policies or deletes data with compromised admin credentials, an air-gapped backup remains intact and recoverable.

Question 4

What is immutable backup storage?

Accepted Answer

Immutable backup storage uses WORM (Write Once, Read Many) locking to ensure that backup data cannot be altered, encrypted, or deleted after it is written — regardless of what credentials an attacker holds. Technologies such as SLA Retention Lock and Intelligent Data Lock enforce this at the storage level, providing a reliable recovery point even after a full admin account compromise.

Question 5

Is litigation hold the same as a backup?

Accepted Answer

No. Litigation hold is designed to preserve data for legal discovery — it prevents deletion for eDiscovery purposes but is not built for fast, granular data restoration at scale. It does not protect against ransomware, cannot restore a corrupted SharePoint site, and offers no defence against an attacker with admin credentials who modifies or deletes hold policies.

Question 6

What Microsoft 365 workloads are most at risk of data loss?

Accepted Answer

All four core M365 workloads carry data loss risk: Exchange Online mailboxes (email and calendar), OneDrive (files and personal sites), SharePoint (sites, document libraries, and lists), and Microsoft Teams (channel posts, chats, and files). Each has its own recycle bin expiry and retention limits. Without dedicated backup, data loss in any of these workloads — from ransomware, accidental deletion, or misconfiguration — may be unrecoverable once native retention windows close.

Question 7

How long does it take to recover Microsoft 365 data without a dedicated backup solution?

Accepted Answer

Manual recovery of 1,000 users using native Microsoft 365 tools takes approximately 14 days. That estimate covers locating data across workloads, working within Microsoft's API rate limits, and reconstructing mailboxes, sites, and Teams content without bulk restore tooling. A dedicated backup solution reduces this to hours through fast search, point-in-time snapshots, and granular or bulk restore options.

Question 8

Can a malicious insider delete Microsoft 365 backups?

Accepted Answer

With native M365 tools, a privileged insider can modify or delete retention policies, emptying the safety net. A dedicated backup solution that enforces immutability and isolates backup storage from the tenant means that even an insider with full admin access cannot alter or delete protected backup copies. The backup chain remains intact regardless of what happens inside the tenant.

Question 9

What should I look for in a Microsoft 365 backup solution?

Accepted Answer

At minimum, look for: air-gapped, immutable storage that survives admin credential compromise; coverage across all four M365 workloads (Exchange, OneDrive, SharePoint, Teams); granular recovery down to individual emails or files alongside bulk restore for large incidents; automated policy-driven protection that discovers new users and sites without manual scheduling; multi-geo storage for data residency requirements; and predictable, per-user licensing with storage included.

Question 10

How does Sophos Backup and Recovery for M365 protect against ransomware?

Accepted Answer

Sophos M365 Backup and Recovery isolates backups from the M365 tenant with a true air gap. WORM-locked immutability, SLA Retention Lock, and Intelligent Data Lock ensure backup data cannot be destroyed or altered — even by an attacker holding full admin credentials. MFA is enforced independently of M365 credentials, and Bring Your Own Key (BYOK) encryption with Retention Lock Quorum Authorization prevents policy tampering. This combination addresses the most critical gap in a ransomware scenario: the attacker's ability to destroy your recovery options before you know an attack has started.

Question 11

What M365 workloads does Sophos back up?

Accepted Answer

Sophos Backup and Recovery for M365 covers all four core workloads: Exchange Online (mailboxes, shared mailboxes, folders, inactive users), OneDrive (files, folders, personal sites, inactive user data), SharePoint (sites, lists, document libraries, subsites), and Microsoft Teams (channel posts, chats, files, Teams structure). A single per-user license covers all four workloads with software and storage included.

Question 12

How granular is the recovery? Can I restore a single email?

Accepted Answer

Yes. Recovery ranges from a single email, file, or Teams post through to an entire OneDrive or SharePoint site. Search by keyword, email subject, event title, author, or date range, or browse point-in-time snapshots. Restore to the original user or any other user — cross-user recovery is supported across all four workloads. Granular and bulk recovery options allow IT teams to respond at the right scale for the incident.

Question 13

How does Sophos M365 Backup and Recovery handle compliance and long-term retention?

Accepted Answer

The product supports retention policies that extend well beyond Microsoft's defaults, enabling organizations to meet GDPR, HIPAA, and other regulatory requirements. Immutable, tamper-proof copies satisfy regulatory integrity and evidentiary standards. Role-based access controls allow compliance responsibilities to be delegated without granting broad admin rights, and point-in-time recovery enables rapid response to audit and legal inquiry.

Question 14

Does the solution protect against accidental deletion after the recycle bin has expired?

Accepted Answer

Yes. Sophos M365 Backup and Recovery maintains independent backup copies that are not subject to Microsoft's recycle bin expiry windows. Emails, files, and Teams content can be recovered instantly even after native retention periods have closed. This covers individual user errors, bulk deletions from misconfigured scripts or automation, and admin errors applying policies incorrectly.

Question 15

How is Sophos Backup and Recovery for M365 managed?

Accepted Answer

It is accessed through an SSO integration with Sophos Fusion — the cyber defense system used to manage Sophos Endpoint, Email, Firewall, and MDR.

Question 16

How is Sophos M365 Backup and Recovery licensed?

Accepted Answer

Licensing is per-user, with software and storage included at a fixed, predictable cost. A single license covers all four M365 workloads — Exchange Online, OneDrive, SharePoint, and Teams. There is no separate storage tier or infrastructure to manage.

Question 17

Who is Sophos Backup and Recovery for M365 designed for?

Accepted Answer

It is available as a standalone product for new and existing Sophos customers. It is a strong fit for organizations with 200 or more M365 seats, IT teams with limited staff who need automated protection without operational overhead, and any organization with compliance or long-term retention requirements their current M365 configuration cannot meet.

Microsoft 365 Backup, Built for Recovery

One Backup for Every Workload

Exchange Online

OneDrive

SharePoint

Teams

Microsoft Won't Recover Your Data — You Will

Microsoft is responsible for

You are responsible for

Ransomware & malware

Accidental & malicious deletion

Retention gaps

Departing employees

Recover Even When Backups Are the Target

Everything You Need to Recover

Ransomware & malware recovery

Fast, granular restore

Immutable, air-gapped backups

Compliance & long-term retention

Integrated through Sophos Fusion

Complete M365 coverage

Speak to an expert

Frequently asked questions

Does Microsoft 365 automatically back up your data?

What happens to Microsoft 365 data after a ransomware attack?

What is an air-gapped backup and why does it matter for M365?

What is immutable backup storage?

Is litigation hold the same as a backup?

What Microsoft 365 workloads are most at risk of data loss?

How long does it take to recover Microsoft 365 data without a dedicated backup solution?

Can a malicious insider delete Microsoft 365 backups?

What should I look for in a Microsoft 365 backup solution?

How does Sophos Backup and Recovery for M365 protect against ransomware?

What M365 workloads does Sophos back up?

How granular is the recovery? Can I restore a single email?

How does Sophos M365 Backup and Recovery handle compliance and long-term retention?

Does the solution protect against accidental deletion after the recycle bin has expired?

How is Sophos Backup and Recovery for M365 managed?

How is Sophos M365 Backup and Recovery licensed?

Who is Sophos Backup and Recovery for M365 designed for?

Make Microsoft 365 Recoverable

Downloads

Ransomware & malware

Accidental & malicious deletion

Retention gaps

Departing employees

Recover Even When Backups Are the Target

Everything You Need to Recover

Ransomware & malware recovery

Fast, granular restore

Immutable, air-gapped backups

Compliance & long-term retention

Integrated through Sophos Fusion

Complete M365 coverage

Speak to an expert

Frequently asked questions

Does Microsoft 365 automatically back up your data?

What happens to Microsoft 365 data after a ransomware attack?

What is an air-gapped backup and why does it matter for M365?

What is immutable backup storage?

Is litigation hold the same as a backup?

What Microsoft 365 workloads are most at risk of data loss?

How long does it take to recover Microsoft 365 data without a dedicated backup solution?

Can a malicious insider delete Microsoft 365 backups?

What should I look for in a Microsoft 365 backup solution?

How does Sophos Backup and Recovery for M365 protect against ransomware?

What M365 workloads does Sophos back up?

How granular is the recovery? Can I restore a single email?

How does Sophos M365 Backup and Recovery handle compliance and long-term retention?

Does the solution protect against accidental deletion after the recycle bin has expired?

How is Sophos Backup and Recovery for M365 managed?

How is Sophos M365 Backup and Recovery licensed?

Who is Sophos Backup and Recovery for M365 designed for?

Make Microsoft 365 Recoverable

Downloads