How do you back up Microsoft 365 emails?

Settings that matter

• Frequency. Once a day is the minimum. Every few hours if email is your ordering channel. The interval is the RPO: an incident at 17:00 with a copy from 22:00 the previous evening loses the whole day. Cybermalveillance.gouv.fr, the French government’s cyber-assistance platform, advises setting this frequency by asking what the loss of a day, a week or a month would cost.
• Retention. 30 to 90 days covers human error and a compromise discovered late. Beyond that, you need a specific reason (ongoing litigation, sector-specific obligation). Microsoft retention within the tenant can coexist: it does not replace these dated copies held by a third party.
• Tool permissions. An application registered in Entra ID, permissions limited to reading mailboxes, admin consent, a protected secret, multi-factor authentication on admins. Not a “Global Administrator” account whose password sits in a file. More broadly, the ANSSI, France’s national cybersecurity agency, recommends that the backup infrastructure does not use production authentication.
• Immutability of the copy during the anti-ransomware window, so that a compromised admin cannot empty the backup as well.
• Test restore to another mailbox, twice a year: a folder, an opened attachment, a calendar. Measure the time taken. The ANSSI requires backups to be tested regularly and a restore procedure to be written down.