A real restore drill shows whether Microsoft 365 Backup actually works

I've seen this too many times. Backup feels like a box you've ticked, right up to the day you actually have to restore something. Only a hands-on Microsoft 365 Backup recovery drill tells you whether your setup works outside of theory. Over the past month I've helped several customers run their first restores with the native Microsoft 365 Backup for OneDrive, SharePoint and Exchange, and it reminded me that a product demo is no substitute for a real test. Small things like permissions, quirks in the UI or the time a restore takes suddenly matter, and you have to have them under control.

Restores start in the admin center and require the Backup Administrator role

You begin in the Microsoft 365 admin center → Settings → Microsoft 365 Backup. Only admins who hold the Backup Administrator role (assigned in Entra ID role management) can start a restore. Without that role you can look at backup status, but restore functions aren't available. I like this much better than the older third-party tools, which often needed broad and risky permissions.

OneDrive, SharePoint and Exchange each have their own restore points, based on regular snapshots. With the timeline view you can find the version you need quickly. In drills I always recommend testing granular restores, such as one SharePoint site, one mailbox or one user's OneDrive. Don't restore a whole tenant. Real incidents rarely call for a rollback that wide.

The restore method decides whether you overwrite live data

For a Microsoft 365 Backup recovery, you pick either Express Restore (to a new location) or in-place restore (which overwrites the current state). Express Restore places the recovered content, whether that's a mailbox, a OneDrive or a SharePoint site, in a separate location. That works well when you want to compare data, pull back individual files or run a test without touching active content. In-place restore replaces the target with the backup snapshot. That's reasonable in a genuine emergency, but for an exercise it's usually too risky. In drills I use Express Restore every time.

Practical tip: As soon as Express Restore finishes, check the permissions on the new location and fix them. Otherwise the wrong users or groups may end up with access.

Restore times vary. A mid-sized Exchange mailbox often comes back in a few minutes, while a large SharePoint site can take half an hour or more. If you time your drills, you get a realistic idea of how long incident response will take, and you can adjust your documented procedures accordingly.

A recovery drill follows five practical steps

Before you start a drill, write down the target objects, the restore points and what you expect to see. This is how I usually do it:

• Select a test user or site
• Identify a suitable restore point (e.g., from last week)
• Run Express Restore to a new location
• Verify data integrity and permissions
• Measure recovery time and fully document the steps

The exact screens in the admin center may change over time, but Microsoft has kept the process pleasantly simple. Take screenshots as you go and note every role you assigned. You'll be glad of it during audits and the next drill.

The diagram below shows the flow of a Microsoft 365 Backup recovery drill:

flowchart TD
  start["Backup admin starts drill"] --> select["Select restore point"]
  select --> express["Choose Express Restore"]
  express --> target["Set new location"]
  target --> execute["Start restore"]
  execute --> verify["Check data & permissions"]
  verify --> doc["Document process"]

Figure: Recovery drill flow using Microsoft 365 Backup

Pay-as-you-go billing and auditing belong in your runbook

Microsoft 365 Backup recovery is billed pay-as-you-go. Restores and storage consumption are charged monthly and appear in the admin center dashboard. You get flexibility and no upfront commitment, but I've noticed that regular drills can push costs up if nobody keeps an eye on them. The backup dashboard records successful and failed restores alike, so you can always trace who did what and when.

A complete recovery runbook should cover assigning admin roles in Entra ID, finding restore points, the difference between express and in-place restore, reviewing permissions after the restore, and measuring and documenting the time accurately. From what I've seen, quarterly drills are the minimum. Only real exercises expose the gaps you miss on paper, such as missing permissions, access bottlenecks or sudden cost spikes.

If you want a step-by-step setup and a first recovery walkthrough, have a look at my guide Microsoft 365 Backup GA: Native recovery finally arrives, plus Microsoft's backup overview and documentation on restoring data.

A backup is only as good as its last test

A written procedure doesn't mean much if nobody has ever followed it for real. In every tenant where I've run a Microsoft 365 Backup recovery drill, we've hit practical obstacles, whether missing permissions, slow handoffs between admins, unexpected access or surprises on the bill. If you've set up Microsoft 365 Backup, don't rely on the green checkmarks. Run a restore drill, improve your runbook and keep testing. When you really need to recover data, practice is what gets you through.