Cloud Backup and Disaster Recovery: A Practical Guide for GTA Businesses
What Microsoft 365 and other cloud services keep for you, what they do not, and how to set up and prove a backup that covers the gap. For the wider plan (recovery targets, runbooks, who does what), see our disaster recovery plan guide.
Reviewed by the ITRS security team · Last updated
The assumption that causes the trouble
Moving to Microsoft 365 or Google Workspace protects you from a server dying in your back room. It does not mean every deleted, encrypted or overwritten item can be brought back. Microsoft keeps your service running; keeping your data recoverable for as long as you need it is largely your job.
This page covers cloud data. For on-premise servers, recovery time and recovery point targets, and the full runbook, read the disaster recovery plan guide.
What Microsoft 365 keeps on its own
| Data | Built-in recovery window | Source |
|---|---|---|
Exchange Online mail deleted from Deleted Items | 14 days by default, adjustable up to 30 days | |
SharePoint and OneDrive files | 93 days in the recycle bins from the time of deletion | |
Teams chats and channel files | Channel files live in SharePoint (as above); chat recovery depends on retention policies you set | |
Everything after those windows | Gone, unless a retention policy, litigation hold or separate backup kept it | Blank |
What those windows do not cover
- Data you discover is missing after the window has passed. A leaver's mailbox deleted in March and needed in September is the classic case.
- Ransomware or a malicious insider who encrypts or deletes files through a synced OneDrive. Version history helps, but at scale it is slow to unwind without a proper restore tool.
- An attacker with admin rights who deletes data and purges the recycle bins.
- Mistakes in migration or clean-up scripts that overwrite good data.
- Legal or regulatory retention requirements. Retention policies and holds are compliance tools; they are not a quick way to restore a folder to how it looked last Tuesday.
Options to close the gap
| Option | Good for | Watch for |
|---|---|---|
Microsoft 365 Backup (Microsoft's own service) | Fast restores of Exchange, OneDrive and SharePoint within Microsoft's boundary | Pay-as-you-go billing; Microsoft states backups are immutable unless expressly deleted by the backup admin. Overview. Same vendor and same tenant credentials. |
Third-party cloud-to-cloud backup | A copy outside Microsoft, with separate credentials and longer retention | Where data is stored (Canada?), restore speed, what happens to backups if you stop paying |
Retention policies and holds | Keeping data for legal or regulatory reasons | Not designed for bulk point-in-time restore |
Manual exports (PST, downloads) | One-off archive of a leaver | Not a backup strategy; files end up on laptops |
What a good cloud backup setup looks like
The Canadian Centre for Cyber Security's ransomware playbook points out that online backups connected to your systems are vulnerable to ransomware. For cloud data, the equivalent rule is separation of control.
- Backup admin accounts separate from your Microsoft 365 admins, with their own MFA, ideally a passkey or security key.
- Immutable or retention-locked copies, so a compromised admin cannot delete them early.
- Retention that matches your business: at least as long as your longest gap between 'deleted' and 'someone notices'. For many offices that means a year or more.
- Leavers' mailboxes and OneDrives kept under backup or retention before the licence is removed.
- Alerts when a backup job fails, sent to someone who will act on them.
Prove it: a restore-test log
A backup you have not restored from is a hope. Test quarterly and keep a log like this one. Insurers and auditors increasingly ask for it.
| Date | What was restored | From (system, point in time) | Time taken | Result | Tested by |
|---|---|---|---|---|---|
(date) | One user's mailbox folder | Cloud backup, 7 days ago | Blank | Pass / fail and why | Blank |
(date) | A SharePoint document library | Cloud backup, 30 days ago | Blank | Blank | Blank |
(date) | A leaver's OneDrive | Backup or retention, 6 months ago | Blank | Blank | Blank |
(date) | Line-of-business database (if any) | Server backup | Blank | Blank | Blank |
From our work
In a same-morning ERP database recovery, the data was intact and the cause was a firewall profile change. The follow-up was a proposal for a designed and validated backup of that database, because the next outage may not be so forgiving. In a Microsoft 365 clean-up, an 18-month retention cutoff approved by management let us remove 51,422 old messages safely, which only works when you know what is kept and where.
Our Microsoft 365 backup guide has configuration steps. For help designing backup and recovery, see business continuity and disaster recovery.
Related reading.
- ArticleDisaster Recovery and Business Continuity for Ontario Small Businesses: How to Build the PlanA backup is not a plan. Disaster recovery and business continuity for Ontario small businesses, step by step: set recovery objectives, map critical systems, write a…
- GuideBacking up Microsoft 365: what Microsoft does and doesn't doMicrosoft keeps Microsoft 365 running. Getting your data back after a bad deletion, a departed employee or a ransomware attack is mostly your job.
- ServiceBackup and Disaster Recovery Services in Toronto, North York and the GTABackup and disaster recovery services protect a Toronto business by copying its data automatically to local and cloud backups, checking those backups every day…
- ArticleRansomware Protection for Ontario Businesses: 2026 Defence GuideTwo halves: the controls that make ransomware survivable, with a concrete backup isolation spec, and the first hour if it happens, including who in Canada and Ontario…
Under attack right now?
Call before you reset passwords, wipe a laptop or pay anyone. A responder will help you contain the incident without destroying the evidence you will need later.