Tools
The Microsoft 365 backup tools worth paying for
Native retention is not backup. What that actually means, what separates the products, and the seat count below which none of them are worth buying.
Microsoft
Veeam
Acronis
Hornetsecurity
Rubrik
Why native retention is not backup
Microsoft operates a shared responsibility model. Microsoft is responsible for the availability of the service. You are responsible for the data inside it. Retention policies, litigation hold and the recycle bin are compliance and availability features, and none of them were designed to bring a tenant back after a destructive event.
Three failure modes are not covered by anything native. A privileged account is compromised and deletes at scale. A retention policy is misconfigured and quietly discards mail for months before anyone notices. An employee leaves, the licence is reclaimed, and the mailbox goes with it. In each case support cannot return the data, because from the platform's point of view nothing went wrong.
That is the entire case for buying a backup product. It is not that Microsoft is unreliable. It is that the recycle bin is not a recovery plan.
What separates these products
Every vendor in this category will tell you it backs up Exchange, SharePoint, OneDrive and Teams. That is table stakes and it tells you nothing. The differences that matter only appear when you try to restore under pressure.
The five criteria we score
Point-in-time restore
Whether you can return a mailbox or site to a specific moment, or whether you get the most recent copy and lose everything since. This is the difference between a two-hour incident and a two-week one.
Teams chat coverage
The gap most organisations discover during an investigation rather than before it. Teams chat lives in a hidden folder in the user's mailbox, and coverage varies far more than the marketing suggests. Ask specifically about private channels.
Immutability
Whether a backup copy can be altered or deleted by someone who already holds tenant admin. If the answer is no, the product survives the scenario you actually bought it for. If yes, you have bought convenience, not resilience.
Restore without escalation
Whether a first-line agent can perform a restore from a role-scoped console, or whether every request escalates to the one engineer who knows the tool. This is the criterion that decides whether the product gets used.
Cost at renewal
First-year pricing is a discount. We compare year two at 500 seats, including storage growth and per-user creep, because that is the number you will actually be defending to finance.
How a backup product is scored
Weights published before testing so a score cannot be justified after the fact.
- Restore and recovery30%
- Coverage gaps25%
- Cost at renewal25%
- Admin overhead20%
Commission rate is not an input and never will be.
| Native M365 | |
|---|---|
| Restore a deleted item within retention | |
| Restore a mailbox after licence removal | |
| Recover from a misconfigured retention policy | |
| Point-in-time restore of a whole site | |
| Copy an attacker with tenant admin cannot delete | |
| Teams private channel messages |
This table is about the platform's own capability and is not a vendor comparison. Source: Microsoft's published shared responsibility guidance.
Scores are not published yet
The criteria, weights and shortlist above are final. The per-product scores are not, because each product is still being run against a live tenant with hybrid identity and delegated administration. We would rather publish the method now than numbers we have not earned.
The shortlist
These are the products being tested. Ordering here is alphabetical and carries no ranking, because scoring is not finished.
Backup plus endpoint protection in one console
- Best for
- Teams who want one agent covering backup and endpoint rather than two contracts
- Watch out for
- The bundling is the selling point and also the lock-in. Price the pieces separately before you commit
Microsoft 365 backup with email security attached
- Best for
- Organisations whose real problem is email and who want backup alongside it
- Watch out for
- Sold heavily through partners, so your experience depends on which partner you buy from
Links above go to the vendor. Where a link is marked as an affiliate link, a purchase may earn this site a commission at no cost to you, and it played no part in the ranking.
Who should not buy any of these
Below roughly 200 seats the economics usually do not work. At that size the annual licence cost of a dedicated backup product is frequently higher than the realistic cost of the disruption it prevents, and a documented export routine plus correctly configured retention covers the failure modes you are actually exposed to.
Buy one anyway if you are regulated, if you hold data you cannot reconstruct from anywhere else, or if you have already had one destructive incident. Those three cases change the maths regardless of headcount.
How we test
Each product is installed against a live tenant with hybrid identity, delegated administration and a populated Teams workspace including private channels. We then delete things and try to get them back under time pressure, using the console as supplied rather than one we have practised on for a week.
The restore attempts are performed by someone who has not used that product before, because that is who performs restores at three in the morning.
Disclosure. Some links on this site are affiliate links. Scoring weights are published before any programme is joined, and commission is never a ranking input. Full policy, and the method behind this guide.