Microsoft 365 Backup for Law Firms: What Actually Needs Protection

A client asks for the final version of a contract, but the file in your firm’s shared workspace was overwritten three weeks ago. Another matter’s correspondence lives in a shared mailbox. A paralegal has left, and the only working copy of certain exhibits may still be in that person’s OneDrive. Would your firm know which information it can recover—and how?

For small and midsize law firms, Microsoft 365 backup is not a single checkbox. The right protection depends on where matter-related information actually lives, how long a mistake could go unnoticed, and whether your team can restore usable data without exposing client information. This guide provides a practical coverage map for managing partners, firm administrators, and the IT professionals who support them.

Start with the matters, not the Microsoft 365 licenses

Think of a recently closed matter and an active one. Trace the documents and communications from intake to completion: the initial client email, engagement letter, drafts, supporting evidence, internal messages, filings, calendars, and any final deliverables. Some may be inside Microsoft 365; others may be in your legal practice management system, a client portal, or an employee’s computer.

The first task is to create a data-location inventory: where each critical category is stored, who owns it, whether it is backed up, and how it would be recovered. A Microsoft 365 subscription alone cannot answer those questions.

The six data areas a law firm should review

1. Exchange Online: individual and shared mailboxes

Email may contain engagement terms, instructions, evidence, approvals, and a timeline of client communications. Review each attorney and staff mailbox, plus shared addresses such as intake@, billing@, or a practice-group inbox. Include archived mailbox content where it is relevant and supported by your selected backup product.

Do not assume a shared mailbox is protected merely because an individual user’s mailbox is. Microsoft 365 Backup supports eligible user and shared mailboxes, but coverage still depends on the backup policy. The same assumption should not be extended to every type of Exchange recipient.

2. SharePoint: matter files and central document libraries

SharePoint often holds team document libraries, standard Teams-channel files, templates, policies, and shared matter folders. Ask for an actual list of protected sites—not simply the statement “SharePoint is backed up.” If your firm uses separate sites for practice groups or matters, confirm each important site is in scope.

Pay particular attention to restricted areas and external sharing arrangements. Recovery must preserve appropriate access controls, not make sensitive client folders broadly available after a restore.

3. OneDrive: the files that never made it into the shared workspace

OneDrive is useful for individual work, but business-critical content can become stranded there: drafts awaiting review, exported evidence, spreadsheets, scanned documents, and material shared from a departing employee’s account. Identify those accounts and decide which files should move to a firm-controlled SharePoint or document management location.

Also document the offboarding process. Microsoft has configurable retention behavior for a deleted user’s OneDrive; it is not a substitute for deciding who will take ownership of active matter files or verifying their backup coverage.

4. Teams: files are not the same as conversations

Teams requires a closer look because the storage location changes with the content. Files in standard channels typically reside in a team’s SharePoint site. Files shared in chats generally reside in the uploader’s OneDrive. Private and shared channels may have their own SharePoint sites, which need to be included in coverage reviews.

Chats, channel messages, and Teams-specific data are a separate question. Microsoft’s first-party Microsoft 365 Backup should not be assumed to restore Teams conversations simply because SharePoint and Exchange are protected. Ask your provider exactly which Teams items its product can back up, export, retain, and restore—and test the required workflow.

5. Calendars, contacts, tasks, and operational records

Calendar entries can carry hearing dates, client appointments, and commitments. Contacts and tasks may also be operationally important. Microsoft 365 Backup documents item-level recovery for supported Exchange mailbox items, including calendar, contacts, and tasks. Confirm the relevant mailbox is protected and that the firm knows how to restore the items it actually relies on.

If deadlines or workflow items are managed in Microsoft Planner, a legal case management platform, or another application, evaluate those systems separately. An Exchange mailbox backup does not automatically mean every Microsoft 365 or third-party application is protected.

6. Outside Microsoft 365: legal applications and configuration

Your document management system, e-signature platform, billing database, matter management application, local case files, and client portals may each need their own backup or export plan. The same applies to important configuration information: administrator recovery methods, application settings, permissions, and documented procedures for rebuilding access after an incident.

Ask each vendor for its written backup and recovery scope. “Hosted in the cloud” is not an answer to “Can we restore the case as it stood last Tuesday?”

A working Microsoft 365 backup coverage map

Use this table as a meeting agenda with your IT provider. The goal is not to back up everything indiscriminately; it is to identify what the firm would genuinely need to recover to serve clients and meet its obligations.

Why retention and recycle bins do not answer the backup question

Microsoft 365 has valuable native recovery and retention features. For example, Exchange Online keeps permanently deleted items for 14 days by default, with a configurable maximum of 30 days under the standard deleted-item retention setting. SharePoint and OneDrive commonly use a 93-day recycle-bin deletion window, subject to service rules and exceptions. Appropriate retention policies or holds may change how content is preserved.

These mechanisms help with particular deletion and preservation scenarios. They do not, by themselves, establish a complete, separately managed backup and restoration plan. Likewise, an eDiscovery hold is designed to preserve discoverable information for legal and compliance purposes; it is not a general-purpose bulk recovery workflow.

If you want the broader distinction between resilience, syncing, retention, and backup, see our earlier explanation of cloud storage versus true backups.

What Microsoft 365 Backup can—and cannot—do

Microsoft now offers a separate product called Microsoft 365 Backup. Its documented first-party protection scope includes eligible Exchange Online mailboxes, OneDrive accounts, and SharePoint sites. Recovery points and restore granularity vary by workload, and administrators can select which supported resources to protect.

That means the product may be a useful component of a firm’s recovery strategy, but it is not an automatic backup of every service bearing the Microsoft 365 name. For example, a Teams channel’s SharePoint files may be in scope while Teams conversations are not. Restoring an entire SharePoint site or OneDrive account to a prior state can also affect changes made since that point, so the restore method matters.

Microsoft 365 Backup is a paid, consumption-based service rather than a feature silently included with every Microsoft 365 subscription. Confirm current eligibility, billing, data volume, restore options, and any third-party product differences before selecting a solution.

Three recovery scenarios your provider should be able to demonstrate

Scenario A: An important matter folder is overwritten

Pick a non-sensitive test matter or approved sample document. Have the IT team recover an earlier version to a controlled location, then check whether the correct files, naming, and permissions are present. Record how long the exercise took and whether normal work was interrupted.

Scenario B: A shared mailbox loses critical correspondence

Verify that the shared mailbox is included in the protection policy. Reproduce an authorized test deletion, restore the specific item, and confirm who can authorize the recovery. A broad mailbox restore may be unnecessary when a precise item restore can solve the problem.

Scenario C: A compromised account damages multiple workspaces

This is where recovery planning becomes more than restoring one file. The firm should know how to stop further damage, secure administrator access, identify a safe recovery point, prioritize affected matters, and restore without reintroducing the original problem. Test the decision process in a tabletop exercise before attempting a production-wide rollback.

A backup should be considered demonstrated only after the restored data has been opened, checked for completeness, and approved by an authorized owner. A green dashboard status is useful monitoring, not proof of recoverability.

Security, confidentiality, and ownership are part of the backup design

Backups contain the same sensitive client material as the live environment. Protect backup administration with strong authentication, appropriate role separation, logging, and clear access approvals. Review encryption, storage location, deletion protection, vendor contracts, and how access is revoked when a provider or employee leaves.

ABA Model Rule 1.6(c) addresses reasonable efforts to prevent unauthorized access to information relating to representation. It does not prescribe one specific Microsoft 365 backup product. State-adopted professional conduct rules and case-specific legal duties may differ, so the firm should obtain legal or ethics guidance where needed.

For IT operations, document who owns the backup subscription and tenant, who receives failure alerts, who authorizes restores, and how the firm would regain access if its usual administrator were unavailable. NIST cybersecurity guidance also emphasizes protecting, maintaining, and testing backups rather than only creating them.

Questions to send your IT provider this week

1. Which exact mailboxes, OneDrive accounts, and SharePoint sites are protected? Please supply an inventory—not a product brochure.
2. How are private-channel files, shared-channel files, and Teams messages handled? Show where their data lives and what is actually recoverable.
3. What is outside the Microsoft 365 backup scope? Include legal practice software, local devices, third-party portals, and essential configuration.
4. How far back can we restore, and what is the anticipated recovery time? Explain different answers for one file, one mailbox, and a widespread incident.
5. Who can delete or alter backup policies? What protections, alerts, and administrator separation are enabled?
6. When was the last successful test restore? Provide the date, the type of data restored, and the outcome.
7. What happens when an employee or IT provider leaves? Confirm ownership, delegated access, and handover procedures.

If the provider cannot answer these questions clearly, you have identified a governance gap even before you have identified a technical one.

A practical next step for the managing partner

Start with an inventory of your highest-impact matters, shared mailboxes, and document libraries. Choose a recovery objective for each critical workflow, review the existing backup coverage against that list, and schedule a controlled restore test. Then record the results in the firm’s continuity plan.

You can begin with the IT-Emergencies Business Continuity Assessment to identify broader recovery-readiness gaps. If your firm needs a second look at Microsoft 365 coverage, contact IT-Emergencies about a remote backup-readiness review. Our focus is on clarifying what is protected, what is missing, and what restoring the firm’s work would actually involve.

Sources & Further Reading

• Microsoft Learn — Overview of Microsoft 365 Backup
• Microsoft Learn — Microsoft 365 Backup FAQ
• Microsoft Learn — Microsoft 365 Backup pricing model
• Microsoft Learn — Exchange Online deleted-item retention
• Microsoft Learn — SharePoint recycle bin retention
• Microsoft Learn — Teams and SharePoint integration
• Microsoft Learn — Teams retention
• American Bar Association — Model Rule 1.6
• NIST Cybersecurity Framework — backup and recovery practices

This article is general technology information, not legal advice. Firm-specific preservation, confidentiality, and retention requirements should be evaluated under the applicable jurisdiction’s rules and client obligations.