Many Australian businesses assume Microsoft backs up SharePoint Online automatically. It is an understandable assumption — Microsoft's marketing emphasises reliability, uptime, and geo-redundant data centres, and the platform does retain deleted items in the recycle bin for up to 93 days. But retention is not the same as a true backup, and the distinction matters enormously the day someone permanently deletes a document library, a disgruntled employee purges a project site, or ransomware encrypts files that then synchronise straight into SharePoint.
A genuine SharePoint Online backup strategy covers the scenarios Microsoft's defaults do not: accidental deletion beyond the retention window, ransomware or malicious insider deletion, compliance retention obligations under the Australian Privacy Act 1988, and point-in-time recovery of a specific file, library, or entire site as it existed last Tuesday — not just "whatever is still in the bin." This guide covers the realistic options for backing up SharePoint Online data to Azure, what Microsoft actually includes by default, what it costs in Australian dollars, and what Mycelium 365 recommends for businesses of different sizes and regulatory profiles.
Does Microsoft back up SharePoint Online automatically?
Short answer: not in the way most people mean when they say "backup." Understanding the gap between what Microsoft provides and what a real backup looks like is the single most important step in this decision.
What Microsoft does provide out of the box is genuinely useful. The SharePoint recycle bin retains deleted items for 93 days — first in the user-facing recycle bin, then in the site collection (second-stage) recycle bin accessible to administrators. Version history keeps previous iterations of documents, so a file that was overwritten or badly edited can be rolled back, provided versioning is enabled and configured with sensible limits. And Microsoft's infrastructure is geo-redundant: your data is replicated across multiple data centres within the Australian region, protecting you against hardware failure and data centre outages.
What Microsoft does not provide is equally important. There is no protection against permanent deletion once the 93-day window closes — and an administrator can empty the second-stage recycle bin at any time. There is no defence against malicious deletion by an insider with elevated rights, because that person can simply purge the recycle bin too. Ransomware that encrypts files on a synchronised device will happily sync the encrypted versions into SharePoint, and while version history can sometimes rescue individual files, recovering an entire library of tens of thousands of encrypted documents through the web interface is not a realistic recovery plan. There is no granular, point-in-time restore of a whole site collection to a specific date. And retention policies and litigation holds in Microsoft Purview are compliance tools — they preserve data, but they are not a recovery mechanism and should never be treated as one.
This is the gap between "Microsoft's infrastructure is backed up" and "your data is backed up." Microsoft's shared responsibility model is explicit: Microsoft is responsible for the availability of the service; you are responsible for the recoverability of your data. It is one of the most common misunderstandings we encounter in Australian SMBs, and it usually surfaces only after data has been lost.
Microsoft has acknowledged this gap with Microsoft 365 Backup Storage, a paid add-on product launched in 2024 that provides true backup and rapid restore for SharePoint, OneDrive, and Exchange Online — all within the Microsoft 365 trust boundary. It is a legitimate option, and we cover it in detail below, but it is not included in any standard licence: you must enable it and pay for it separately.
Options for backing up SharePoint Online to Azure
There are three realistic approaches for Australian businesses, and the right choice depends on your size, compliance obligations, and appetite for administrative overhead.
Option 1: Microsoft 365 Backup (native add-on). This is Microsoft's own backup product, launched in 2024 and now generally available. It covers SharePoint Online, OneDrive for Business, and Exchange Online, and it stores backup copies inside Microsoft's own infrastructure rather than in your Azure subscription. Pricing is consumption-based at approximately USD $0.15 per GB per month in 2026, billed through your Azure subscription or CSP. Administration happens directly in the Microsoft 365 admin centre, restore times are the fastest of any option because the data never leaves Microsoft's fabric, and recovery point objectives of 10 minutes are achievable. For most Australian businesses without specific compliance drivers, this is the simplest and most operationally efficient choice — there is no third-party software to license, patch, or monitor.
Option 2: Azure Blob Storage via third-party backup tools. Products such as Veeam Backup for Microsoft 365, Acronis Cyber Protect, and Druva connect to your Microsoft 365 tenant via the Graph API, extract SharePoint, OneDrive, Exchange, and Teams data, and write it to a destination you control — typically an Azure Blob Storage account in Australia East or Australia Southeast. This approach requires more configuration and ongoing administration, but it delivers two things the native option cannot: a logically air-gapped copy of your data outside the Microsoft 365 tenant itself (critical if a tenant-level compromise is part of your threat model), and granular recovery features such as eDiscovery search across backup sets and item-level restore with full audit trails. This is the recommended approach for businesses with compliance requirements — legal practices subject to client file obligations, healthcare providers, financial services firms, and defence contractors working under DISP or Essential Eight uplift programs.
Option 3: Power Automate or custom scripts. It is technically possible to copy SharePoint content to Azure Blob using Power Automate flows, the SharePoint Migration API, or bespoke scripts. We mention this only to discourage it for production backup: these approaches copy files but not versions, permissions, metadata, or site structure in any recoverable form; they are fragile, unmaintained, and fail silently. They are appropriate for one-off archival exports, not for backup. If your recovery plan depends on a flow someone built in 2023 and nobody has touched since, you do not have a recovery plan.
In practice, our recommendations split cleanly: businesses under 50 users without regulatory drivers tend to land on Microsoft 365 Backup for its simplicity; businesses in the 50–300 range with compliance obligations land on Veeam to Azure Blob for its air gap and audit trail.
How to back up SharePoint Online to Azure Blob Storage — step by step
For businesses taking the third-party route, Veeam Backup for Microsoft 365 is the most widely deployed tool in the Australian market, so we use it as the worked example. The overall shape of the process is identical for Acronis or Druva.
Step 1 — Create an Azure storage account and blob container. In the Azure portal, create a new storage account in Australia East or Australia Southeast (choose the region matching your data residency obligations; government suppliers should check contract requirements). Inside it, create a blob container dedicated to backup data. Do not reuse a general-purpose container — isolation matters for both security and cost reporting.
Step 2 — Configure retention and access tiers. Azure Blob offers hot, cool, cold, and archive tiers with dramatically different pricing. A sensible pattern is hot tier for the most recent 7–14 days of restore points (where almost all real restores come from), cool tier for anything older, and archive only if you have long-tail compliance retention with very rare restore needs. Configure a lifecycle management policy to move blobs between tiers automatically rather than paying hot-tier prices for year-old backups.
Step 3 — Install Veeam Backup for Microsoft 365. Deploy it either on an Azure VM in the same region as your storage (lowest latency, no on-premises dependency) or on an on-premises Windows server if you prefer. Size the VM to your data volume — for a 50-user tenant with a few terabytes, a modest D4s VM is ample.
Step 4 — Connect to your Microsoft 365 tenant. In Entra ID, register an application with the required Graph API permissions (Sites.ReadWrite.All and related scopes), authenticate with a certificate rather than a client secret for better security hygiene, and grant admin consent. Add the app registration to Veeam to establish the tenant connection.
Step 5 — Create backup jobs. Build jobs targeting your SharePoint site collections, OneDrive for Business accounts, and Teams channels (Teams files live in SharePoint, so channel content is covered by the SharePoint job). Scope deliberately: backing up everything is simplest, but excluding genuinely ephemeral sites can meaningfully reduce storage cost.
Step 6 — Schedule backups. A standard pattern is daily incremental backups with a weekly full, though Veeam's change-based processing makes frequent incrementals cheap. Retention should match your compliance requirements — seven years is common for Australian businesses with legal or financial obligations.
Step 7 — Test a restore. Before considering the job done, restore a specific file from a specific date to its original location and to an alternate location. Time it. Document it. A backup that has never been test-restored is a hypothesis, not a backup.
Step 8 — Configure alerts and monitoring. Set notifications for job failures, repository capacity thresholds, and missed schedules. If Mycelium 365 manages your environment, this monitoring is part of the service — backup jobs are checked daily and restore tests run quarterly.
How much does backing up SharePoint Online to Azure cost for Australian businesses?
Costs vary by data volume and approach, so here is a realistic breakdown in Australian dollars as of 2026.
Microsoft 365 Backup (native): approximately AUD $0.23 per GB per month at current exchange rates, billed on protected data volume. For a 50-user business with 2TB of SharePoint and OneDrive data, that is roughly $480 per month. There is no additional software licence — you pay only for storage consumed.
Azure Blob Storage for third-party tools: cool-tier blob storage in Australia East runs approximately AUD $0.026 per GB per month, so 2TB of backup data costs around $55–80 per month depending on redundancy settings and transaction costs. This is remarkably cheap — the storage is rarely the expensive part.
Veeam Backup for Microsoft 365 licensing: approximately AUD $4.50 per user per month at 50 users through an Australian distributor, so around $225 per month. Add the Azure VM running Veeam (roughly $80–150 per month for a right-sized instance, or zero if you already have suitable infrastructure) and the total lands near $305–380 per month for the same 2TB environment.
The comparison: for the 50-user, 2TB example, native Microsoft 365 Backup costs roughly $480 per month with near-zero administration; the Veeam-to-Azure route costs roughly $305 per month but requires someone to manage the backup server, monitor jobs, and test restores. Which is "cheaper" depends on whether you price in administration time. For most of our clients, the answer is that Mycelium 365 manages SharePoint backup as part of our managed Microsoft 365 service — the tooling, monitoring, and quarterly restore testing are included, so the decision comes down to data volume and compliance requirements rather than hidden labour.
SharePoint Online backup and the Australian Privacy Act — what businesses need to know
Backup is not just an IT concern in Australia; it sits squarely inside your legal and regulatory obligations.
The Australian Privacy Act 1988 requires organisations handling personal information to take reasonable steps to protect it from misuse, interference, loss, and unauthorised access. "Loss" is doing real work in that sentence: an organisation that cannot recover personal information it has lost — client records, employee files, customer data — has a genuine compliance problem, not just an operational one. A documented, tested backup regime is one of the clearest ways to demonstrate those reasonable steps.
The Notifiable Data Breaches scheme sharpens this further. If personal information is lost or accessed without authorisation and likely to cause serious harm, you must notify the OAIC and affected individuals. A tested backup does not prevent a breach, but it is powerful evidence of due diligence, and in a ransomware scenario it can be the difference between a recoverable incident and an existential one. A backup regime also supports your ability to assess the scope of an incident quickly — knowing exactly what data existed, and being able to restore a clean copy for forensic comparison.
Industry-specific obligations layer on top. Healthcare providers face retention requirements under the My Health Records Act and state health records legislation, commonly seven years or more. Legal practices must retain client files for minimum periods that vary by state — seven years is the typical floor, longer for some matter types. Financial services firms answer to ASIC record-keeping requirements, and APRA-regulated entities must meet CPS 234's information security controls, which explicitly contemplate recoverability.
The Essential Eight — the Australian Cyber Security Centre's baseline framework — includes regular backups as one of its eight mitigation strategies, with specific maturity requirements: backups of important data, software, and configuration settings performed and retained according to business requirements, with restoration tested as part of incident response exercises, and (at higher maturity levels) backups protected from unauthorised modification and deletion — which is where immutable storage and air-gapped copies come in.
One final clarification that trips up many organisations: Microsoft Purview retention labels and holds are not backup. Retention preserves data in place for compliance; it does not give you a clean, point-in-time copy you can restore from after ransomware, and retained data is still vulnerable to malicious deletion in ways that surprise people. Compliance retention and backup solve different problems. You need both, configured deliberately, and working together.
What Mycelium 365 recommends for Australian businesses
Our recommendations follow a tiered pattern based on size and regulatory exposure.
Under 50 users, no specific compliance drivers: Microsoft 365 Backup, the native add-on. It is the simplest option to administer, restores are fast, and the per-GB cost is predictable. When covered under a Mycelium 365 managed service, we configure it, monitor it, and test restores — the per-user economics work out well because there is no third-party licensing stack to maintain.
50–300 users with compliance requirements: Veeam Backup for Microsoft 365 writing to Azure Blob Storage in Australia East or Southeast. This delivers the air-gapped copy outside your production tenant that serious ransomware resilience requires, granular item-level recovery with an audit trail for legal discovery, and storage costs low enough that seven-year retention is affordable. We deploy and manage the whole stack — the Veeam server, the storage account, the lifecycle policies, the monitoring, and quarterly restore tests.
Defence contractors, healthcare providers, and high-assurance environments: Azure Blob with an immutability policy (write-once, so even a compromised admin credential cannot delete or encrypt backup data), Purview retention labels aligned to your record-keeping schedule, and documented restore procedures tested against your incident response plan. At this tier, backup is part of a broader Essential Eight or DISP-aligned control set, and we design it as such.
Whatever tier fits, the important thing is that backup is deliberate — scoped, scheduled, monitored, and tested — rather than assumed. Mycelium 365 manages SharePoint Online backup for Australian businesses as part of our managed Microsoft 365 service from $95 per user per month. If you are not certain what your current backup position actually is, that uncertainty is the finding: contact our team and we will tell you exactly where you stand.