I’m looking into different ways to back up Microsoft 365 mailbox data and would like to hear how others handle this. Many of us use Outlook and Microsoft 365 for important personal and business communications. Although Microsoft provides data protection and retention features, I’d like to understand […]
Hi alexmorgan03. For a single personal mailbox, a properly stored PST export can be an adequate low-cost safety copy. For business mail, I would use an
automated Microsoft 365-aware backup service with isolated or immutable storage, while keeping Microsoft retention policies enabled as an additional layer.
The available approaches
| Method | Best use | Main limitation |
|---|
| Outlook PST export | Personal mailboxes, occasional snapshots and offboarding | Manual, easy to leave incomplete, awkward to restore at scale |
| Purview retention/holds | Compliance and protection against deletion | Not an independent backup or conventional point-in-time restore |
| Microsoft 365 Backup | Fast tenant-integrated recovery | Paid, currently one-year retention, still within Microsoft's platform |
| Third-party cloud backup | Automated business backup and granular recovery | Subscription cost and broad tenant permissions |
| Self-hosted/NAS backup | Organisations wanting storage control | You maintain, secure and monitor the backup infrastructure |
The base Exchange Online service has redundancy and recovery features, but Microsoft still distinguishes these from a traditional mailbox backup. Its own Exchange Online guidance also discourages routine PST-based organisational backups because they reduce central control and discoverability. Microsoft 365 Backup is a separate paid backup product rather than a feature of ordinary mailbox retention.
Is PST export sufficient?
As the only business backup: no. As an additional personal snapshot: possibly.
A PST normally contains messages and embedded attachments, and it can include calendar and contact data. However:
- It is a manual snapshot, not a reliable incremental backup.
- Outlook may export only what the profile has fully synchronized.
- The primary mailbox, shared mailboxes and Online Archive may need to be selected or exported separately.
- One large file is vulnerable to corruption, theft and accidental overwriting.
- A PST left on the same computer is merely a copy awaiting the same disk failure or ransomware.
- Restoring individual items or several users becomes laborious.
- PST passwords should not be treated as strong encryption.
If using the free PST route:
- Confirm that Outlook has synchronized the entire required date range, not merely the last few months.
- Export to a new, dated PST, including all subfolders.
- Export any shared mailbox and Online Archive separately and verify the oldest expected messages are present.
- Close Outlook before copying the PST.
- Keep at least two additional copies, such as an encrypted external drive and an encrypted off-site location.
- Retain several generations instead of replacing the previous export.
- Periodically open a copied PST and test an old message and attachment.
PST handling differs between classic and new Outlook, and administrators can restrict it; Microsoft documents those controls in its current PST policy guidance. Classic Outlook generally remains the more predictable choice for manual export workflows.
Shared mailboxes, archives and attachments
A proper backup policy should explicitly discover and protect:
- User mailboxes
- Shared mailboxes
- Online Archive mailboxes
- Former or inactive users that must be retained
- Microsoft 365 Group mailboxes, if used
- Contacts, calendars and mailbox folder structures
Embedded attachments are normally stored with the message. However, many “attachments” are now only
OneDrive or SharePoint links. Backing up Exchange alone preserves the email and link, not necessarily the linked file. Businesses should therefore protect Exchange, OneDrive and SharePoint together.
Microsoft Purview retention can cover messages and attachments in user and shared mailboxes, as described in Microsoft's Exchange retention documentation. That is valuable, but its purpose is lifecycle and compliance management; it is not a separate failure domain.
Dedicated tools
A reasonable shortlist to trial would include:
- Microsoft 365 Backup
- Cloud services such as Keepit, Afi.ai, Barracuda Cloud-to-Cloud Backup or Veeam Data Cloud
- Self-managed Veeam Backup for Microsoft 365
- Synology Active Backup for Microsoft 365, particularly if a compatible NAS is already owned
These are categories and trial candidates, not a universal ranking. Microsoft 365 Backup currently offers one-year retention and frequent Exchange recovery points; its overview and FAQ describe a ten-minute cadence for mailbox item versions and protection of deletions. It is attractive when recovery speed is the priority, but one year may not meet longer retention requirements, and it does not provide vendor independence.
Also establish where a third-party product stores the data. Some partner interfaces use Microsoft 365 Backup Storage underneath, while others maintain their own storage platform. “Third-party console” does not automatically mean “independent copy.”
One particularly current technical check is API support. Exchange Web Services retirement is underway: Veeam currently documents tenant-by-tenant EWS blocking beginning on 1 October 2026 and full shutdown planned for 1 April 2027. Anyone evaluating a product should ask for its Microsoft Graph/Backup Storage migration plan rather than accepting “supports Microsoft 365” as the entire technical explanation.
What to examine before buying
I would require the following:
- Coverage: shared and archive mailboxes, linked OneDrive/SharePoint files and departed users.
- Recovery options: item, folder and complete mailbox recovery; restore to an alternate mailbox; export to standard formats.
- RPO and RTO: maximum acceptable data loss and maximum acceptable restore time.
- Isolation: immutable storage, deletion protection and backup credentials separate from normal Microsoft 365 administration.
- Security: modern OAuth authentication, least-privilege permissions, MFA, role-based restore access and audit logs.
- Retention: whether multi-year retention is supported and how deleted users are billed.
- Data location: residency, encryption, storage provider and any restore/egress charges.
- Monitoring: failed-job alerts, automatic discovery of new mailboxes and reports showing unprotected accounts.
- Restore testing: a backup job marked green is encouraging, but an actual restore is evidence.
How often?
Frequency should follow the amount of mail you can afford to lose:
- Active business mail: at least daily; every few hours or better is preferable.
- Critical operational mail: use a service with frequent or continuous recovery points.
- Personal/manual PST: weekly or monthly only if losing that much recent mail is acceptable; also export after especially important activity.
- Restore tests: quarterly, and after major product or configuration changes.
- Offboarding: verify protection before deleting an account or removing its licence.
My default for a small business would be a reputable cloud-to-cloud service running several times per day, with immutable retention and quarterly restore tests. A PST can still be kept as a supplementary portable copy, but making it the whole backup strategy gives one rather fragile file far too much responsibility.
Sources
