4.2 Configuring & Managing Microsoft 365 Backup

Microsoft 365 Backup is the Microsoft-operated, tenant-level backup and restore solution for Exchange Online, SharePoint Online, and OneDrive for Business. It is a paid add-on that runs inside the Microsoft 365 service itself, so backups and restores happen in place — Microsoft does not ship your data to a separate third-party vault. For MS-102, the most common mistake candidates make is conflating M365 Backup with Purview retention, so we will draw that line explicitly before anything else.

M365 Backup vs. native retention vs. third-party backup

Microsoft 365 already ships several preservation features, and they are not the same thing:

The exam distinction to memorize: retention policies, sensitivity labels, DLP, and Litigation Hold belong to Microsoft Purview and are covered in later chapters. M365 Backup is the operational backup and restore solution you configure as an M365 administrator. Retention preserves data so it can be discovered; backup snapshots data so it can be restored.

Enabling Microsoft 365 Backup

M365 Backup is enabled at the tenant level. The administrative entry points are:

1. Microsoft 365 admin center — under the Backup area (or via the Microsoft 365 Backup app), an admin signs in, accepts the billing terms, and turns the service on for the tenant.
2. Microsoft Graph / PowerShell — the backup and restore APIs under the Graph /solutions/backupRestore endpoint (and the matching Microsoft Graph PowerShell cmdlets) allow programmatic enablement and protection-policy management for tenants that prefer infrastructure-as-code.

Enabling the service provisions the backup storage — the Microsoft-managed container that holds the backup copies of your Exchange, SharePoint, and OneDrive data. You do not bring your own storage; the storage is operated by Microsoft as part of the service.

Prerequisites

• An eligible Microsoft 365 plan (the service is sold as an add-on to most business and enterprise plans).
• An Azure subscription linked to the tenant. Because Microsoft 365 Backup is billed pay-as-you-go on consumed capacity rather than per user, you must attach an Azure subscription and accept the billing terms before the service can be turned on. This catches candidates out — there is no per-user license to assign.
• Global Administrator or a role with the Backup management permission (delegated administration is supported).
• The tenant must not be blocked from the Microsoft 365 Backup service enrollment.

Configuring protection policies

After the service is enabled, the core administrative object is the protection policy (also referred to as a backup policy). A protection policy defines:

• Workload scope — Exchange Online, SharePoint Online, OneDrive for Business, or any combination.
• Site / mailbox / user scope — select all of a workload or a scoped subset (specific sites, specific mailboxes, specific OneDrive accounts).
• Backup frequency / schedule — how often new restore points are taken.
• Retention period — how long each restore point is kept before it expires.

A single tenant can have multiple protection policies, which lets you tier protection — for example, daily backups with 30-day retention for most mailboxes, and hourly backups with 90-day retention for executive mailboxes and critical SharePoint sites.

Restore points and restore operations

Each successful backup creates a restore point, a point-in-time snapshot you can restore from. Restore operations can be:

• Granular — restore a single mailbox item, a single SharePoint file, or a single OneDrive file.
• Item-level to original or alternate location — restore the item to where it was or to a new location.
• Bulk — restore an entire mailbox, site, or OneDrive account.

Because the backup storage is operated by Microsoft inside the M365 service, restores do not require an agent on the client, and they do not require a separate restore network. Microsoft performs the restore in place.

Managing and monitoring backup jobs

Once policies are in place, the admin's ongoing job is to monitor that backups are succeeding and to perform restores when needed. The M365 Backup surface provides:

• Job status — success, failure, in-progress, and error detail for each backup job.
• Policy health — whether a policy is meeting its schedule or falling behind.
• Restore history — a log of restore operations, who initiated them, and what was restored.
• Alerts — configurable notifications when a job fails or a policy falls out of compliance.

For programmatic management, the same Microsoft Graph and PowerShell surface lets you query job status, trigger ad-hoc backups, and initiate restores from automation.

Billing model

Microsoft 365 Backup is billed on a capacity / pay-as-you-go basis, charged per protected data size rather than per user. The more Exchange, SharePoint, and OneDrive data you protect, the more you pay; you do not pay a fixed per-user license fee. This is different from most Microsoft 365 workloads, which are per-user licensed, and it is a common exam contrast point. Microsoft updates the exact per-GB pricing on the Microsoft 365 Backup pricing page; the exam will not ask for an exact number, but it will test whether you understand the model is capacity-based, per protected data size.

---

Exam tip: Questions that try to lure you toward retention policies, Litigation Hold, sensitivity labels, or DLP as the answer to a "backup and restore" scenario are testing the Purview vs. M365 Backup boundary. Operational restore of Exchange, SharePoint, or OneDrive content = Microsoft 365 Backup. Long-term preservation, legal hold, and records management = Microsoft Purview. Restore point-in-time = M365 Backup. Per-user licensing = almost everything else in M365; capacity per protected GB = M365 Backup.