Does Your Nonprofit Need Microsoft 365 Backup? A Buyer’s Checklist

Your nonprofit’s Microsoft 365 account may hold grant applications, board documents, donor correspondence, and program schedules. If those records disappeared or were overwritten, how would your team recover them?

Dedicated backup is worth considering when your recovery needs exceed the tools you already have. The decision depends on what you need to protect, how far back you must recover, and how quickly staff need access again. Microsoft offers its own dedicated backup service, and third-party options are also available.

Use this checklist to compare proposals and decide what fits your nonprofit’s mission and budget.

Start With the Recovery Tools You Already Have

Microsoft 365 includes useful recovery features, but their limits differ by workload and configuration:

• SharePoint and OneDrive: Deleted items generally remain in the SharePoint recycle-bin system for 93 days from their original deletion. Moving an item between its two stages does not restart that clock. See Microsoft’s recycle-bin guidance for exceptions and additional recovery options.
• Exchange Online: Items removed from Deleted Items are normally recoverable for 14 days, configurable up to 30 days. Holds and retention settings can change what remains available. See Microsoft’s deleted-item retention documentation.
• Retention policies: Microsoft Purview can preserve covered content after edits or deletion. Confirm licensing, scope, and configuration. Microsoft’s retention overview explains how policies and labels work.

Keeping a record for a required period and restoring an operational workspace are different goals. A retention policy may preserve the information you need, but you still need a workable recovery process.

1. Which Information Must the Backup Protect?

Ask each provider for a written coverage list. Include staff and shared mailboxes, OneDrive accounts, SharePoint sites, and the specific Teams content your organization relies on. “Microsoft 365 backup” does not automatically mean every application, message, setting, and permission is protected.

Check whether new users and sites are added automatically. Ask what happens when a volunteer leaves or an employee account is deleted. Donor databases and accounting platforms outside Microsoft 365 need their own review.

2. How Much Lost Work and Downtime Can You Accept?

Choose practical targets for two questions:

• Recovery point objective: How much recent work could you afford to lose?
• Recovery time objective: How long could the team function without the affected information?

A grant deadline may require faster recovery than an archived committee folder. Ask providers to explain recovery-point spacing for both recent and older data, plus realistic restoration times for your data volume. A frequent backup schedule alone does not establish how quickly staff can resume work.

3. Does the Recovery Window Match Your Needs?

A missing document might go unnoticed until a quarterly report or annual review. Compare that discovery delay with each option’s recovery window. Have your organization’s responsible staff confirm applicable grant, contractual, and recordkeeping requirements separately.

Include Microsoft 365 Backup in your evaluation. It provides dedicated protection for Exchange Online, SharePoint, and OneDrive. Compare its current capabilities with third-party products rather than assuming an outside vendor is always required. Request written confirmation of supported recovery windows and restoration details before purchasing.

4. Who Can Change or Delete the Backups?

Ask how the service limits administrator access, protects recovery points from alteration, and handles deletion requests. Find out where backups are stored, which account controls them, and what recovery remains possible if your normal administrator account is compromised.

For any claim of “immutable backup,” request the specific protections, exceptions, and deletion safeguards. Include backup access in your broader nonprofit cybersecurity checklist.

5. Can the Provider Demonstrate a Restore?

Before relying on a service, arrange a controlled test using approved, non-sensitive sample data. Recover an email and a document, then walk through a larger recovery scenario. Check content, access permissions, destination, and the effect on newer work.

Record the results, the person responsible, and the escalation contact. Ask who monitors backup failures and how your organization learns about unresolved problems.

6. What Will the Full Service Cost?

Request a quote that explains user-based or storage-based charges, retention, setup, monitoring, restore assistance, and cancellation or export costs. Ask how departed staff and growing data volumes affect the bill. Compare this with your existing agreement and nonprofit IT budget.

Make the Decision With Evidence

If your current configuration meets documented recovery targets and passes testing, you have a sound basis for your decision. If coverage, recovery time, or accountability remains unclear, resolve those gaps before an incident.