Microsoft 365 Backup Services for Australian Businesses

Office 365 backup (now Microsoft 365 backup) for Australian businesses

Office 365 backup is the familiar name for Microsoft 365 backup: independent, restorable copies of your Exchange Online, SharePoint, OneDrive and Teams content. The names O365 backup and M365 backup describe the same data-protection need, separate from native retention and recycle bins. Mycelium 365 manages this protection for Australian businesses, with daily backups and tested recovery.

Microsoft 365 backup vs Microsoft 365 retention — what's the difference?

Native Microsoft 365 retention features — deleted item recovery, recycle bins, and litigation hold — are not backup. They cannot restore your data to a specific point in time before a corruption or ransomware event. They have limited retention windows that vary by feature and licence. And they cannot recover data that has been permanently deleted or overwritten across the tenant.

True backup means an independent, immutable copy of your data that can be restored to any point in time — regardless of what happens inside the Microsoft 365 tenant. That distinction matters most in the moments you need it: a ransomware event, a departing employee deleting their mailbox, or a synchronisation error that corrupts thousands of files across SharePoint.

Mycelium 365's Microsoft 365 backup stores your data in independently managed storage outside the Microsoft 365 tenant — so tenant-level events cannot touch it.

Does Microsoft back up your Microsoft 365 data?

Microsoft 365's native retention is not a substitute for independent backup. Microsoft operates on a shared responsibility model: they maintain the uptime and availability of the Microsoft 365 platform, but the responsibility for backing up your data within that platform sits with you. Microsoft 365 includes retention policies, litigation hold, and a limited recycle bin — but these are compliance and recovery tools, not backup. They don't protect against accidental deletion beyond 30–93 days, ransomware that encrypts your data in place, a disgruntled employee deleting files permanently, or a misconfigured retention policy. A third-party Microsoft 365 backup solution — deployed and managed by Mycelium 365 — creates independent, immutable copies of your Exchange, SharePoint, OneDrive, and Teams data that are recoverable regardless of what happens in your Microsoft 365 tenant.

How does Microsoft 365 backup work with third-party tools?

Mycelium 365 uses enterprise-grade third-party backup tools that connect to Microsoft 365 via API and take independent copies of your data on a daily or more frequent schedule. These backups are stored in Australian data centres, separate from your Microsoft 365 tenant. In the event of a ransomware attack, accidental deletion, or tenant misconfiguration, we restore directly from the backup copy — not from Microsoft's recycle bin or retention hold. This approach is required to meet APRA CPS 234, ACNC governance obligations, and the Australian Privacy Act's data integrity requirements.

Choosing a Microsoft 365 backup solution

Microsoft protects its infrastructure with replication and maintains service availability; that is different from recovering your own content. Native versioning, mailbox recoverable items, retention policies and litigation hold are useful within their limits, but their recovery is item-focused and time-bounded, making bulk recovery after an incident difficult.

Third-party backup products and Microsoft's own backup offering address this gap. Assess workload coverage, including Teams chat and channel content, restore granularity and speed, immutability, data residency, and whether backups use a separate security boundary with separate credentials from the production tenant.

Start by agreeing recovery time and recovery point objectives for the content that matters. Choose a recovery mechanism that meets those objectives, and test a restore against a real scenario rather than relying only on successful backup reports.

Ransomware targeting Microsoft 365 typically encrypts files across SharePoint and OneDrive using legitimate Microsoft APIs — meaning Microsoft's own retention cannot distinguish between a user intentionally modifying files and ransomware encrypting them. From the platform's perspective, both look like normal user activity.

An independent Microsoft 365 backup solution with immutable storage and point-in-time restore can recover your data to the moment before the ransomware event — without paying the ransom and without losing data. Recovery becomes a restore operation, not a negotiation.

Mycelium 365's Microsoft 365 backup is stored in independently managed storage outside the Microsoft 365 tenant — unaffected by tenant-level events including ransomware, admin errors, and accidental mass deletion.

What's included in Mycelium 365's Microsoft 365 backup service

• Daily backup of all four Microsoft 365 workloads — Exchange, SharePoint, OneDrive, and Teams
• Automated backup verification with failure alerting, so a failed backup never goes unnoticed
• Monthly restore testing with documented results — proof your backups actually work
• Point-in-time restore to any day within the retention period
• Granular item-level restore — individual emails, files, or folders without a full tenant restore
• Quarterly backup review reporting for management and audit purposes

Backup retention: minimum 30 days, with extended retention available on request for organisations with longer regulatory or contractual obligations.

Microsoft 365 backup is separate from Azure Backup

Mycelium 365 provides two distinct backup services covering different layers of the Microsoft stack. Microsoft 365 backup (this page) protects SaaS data inside Exchange Online, SharePoint, OneDrive, and Teams. Managed Azure Backup protects infrastructure — virtual machines, Azure SQL databases, Azure File Shares, and on-premises servers connected to Azure.

Both services are managed by Mycelium 365 but operate independently. Most organisations need both: Microsoft 365 backup for their cloud data, and Azure Backup for their cloud infrastructure.

Microsoft 365 backup and ACNC / APRA obligations

For Australian not-for-profit organisations, ACNC record retention requirements — seven years for financial records — mean Microsoft 365 email and document backup is not optional. It is a compliance obligation, and Microsoft's native retention windows do not meet it.

For APRA-regulated entities, APRA CPS 230 operational risk management requirements include the maintenance of business continuity capability and data recovery. Microsoft 365 backup with extended retention directly satisfies both requirements.

Mycelium 365 manages backup retention configuration and provides evidence documentation suitable for ACNC and APRA audit purposes.

How much does Microsoft 365 backup cost?

Microsoft 365 backup pricing depends on your backup scope and user count. We agree the workloads, retention and recovery requirements before providing a fixed-price proposal. Backup is not included in Secure Essentials, which covers unlimited helpdesk support and cyber awareness training for frontline workers.

Mycelium 365 Modern Workplace managed IT support starts from $147/user/month — covering helpdesk, device management, Microsoft 365 administration, Security as a Service (SOC), and cyber awareness training. No per-incident charges. Licensing is not included. View our packages →

Mycelium 365 supports mixed workforce plans — Modern Workplace from $147/user/month for office staff, and Secure Essentials from $32/user/month for frontline workers — under a single managed services agreement. View our packages →

Microsoft 365 licensing is charged separately on top of the management fee. Contact Mycelium 365 for a fixed-price proposal.