Backup and recovery for small nonprofits: what Microsoft 365 covers and what you still own

Microsoft's guidance splits the problem in two. For a service failure, Microsoft says Microsoft 365 has high availability and disaster recovery built into its services. For customer-side problems, such as a ransomware attack or a mistaken deletion, Microsoft says the customer is the controller of the data and needs a fast way to restore it.

In other words, a nonprofit should know where its important data is, who can restore it, and how long that takes, rather than assume someone else is doing it.

• SharePoint and files in OneDrive: Microsoft says deleted items go to the site Recycle Bin, then the site collection Recycle Bin, and are kept for 93 days from the time they are deleted from their original location, unless someone deletes them from the Recycle Bins sooner.
• OneDrive: Microsoft says the Restore your OneDrive feature helps Microsoft 365 subscribers undo actions on files and folders from the last 30 days, including deleted, overwritten, corrupted or malware-infected files. Check Microsoft's page for what applies to your type of account.
• Exchange Online mailboxes: Microsoft says single item recovery is turned on by default when a new mailbox is created, and administrators can search for and recover purged messages in a user's mailbox.
• These are recovery tools for common mistakes. They have time limits, and they are not the same as a separate backup.

Microsoft sells Microsoft 365 Backup as a separate service. Microsoft says it can back up all or selected SharePoint sites, OneDrive accounts and Exchange mailboxes, that you manage it in the Microsoft 365 admin center or through partner applications built on Microsoft 365 Backup Storage, and that it is aimed at fast recovery from ransomware and from accidental or malicious deletion or overwriting.

Microsoft describes it as a pay-as-you-go offering that charges based on consumption, not on user licenses. This page does not state any price. Ask Microsoft or your partner for current terms, and decide whether the built-in tools above are enough for your data.

CISA's ransomware guide recommends keeping offline, encrypted backups of critical data and regularly testing that the backups are available and intact. It explains why offline matters: many ransomware variants look for backups they can reach and delete or encrypt them. CISA also says to keep a hard copy of your incident response plan, plus an offline version.

• List the data you cannot lose: donor records, finance and payroll files, grant documents, case or client files, contracts and board records.
• For each one, write down where it lives and who owns it.
• Decide how long you could manage without it, and what you would do in the meantime.
• Check what Microsoft 365 can restore and for how long, using the time limits above.
• Decide whether any data needs a separate backup, and where that copy will be kept so that a stolen password cannot reach it.
• Do a test restore of one folder and one mailbox item, and write down how long it took.
• Print the plan with the names and phone numbers of the people to call, and keep a copy off the network.
• Put a yearly reminder on the calendar to review the plan and repeat the test.

TRUE.org Cloud is a 501(c)(3) nonprofit. We can walk through your data list with you, tell you which parts Microsoft 365 already protects and for how long, and say whether anything needs more. That help is free for registered nonprofits, charities and faith-based organizations in the United States and Canada, and this page has no prices on it.

If you choose to buy licenses through TRUE.org, they are provided by TRUE.org's for-profit Microsoft Cloud Solution Provider, not by the nonprofit. You can always buy direct from Microsoft or from another partner instead.