How to Back Up Your Business Data Properly (Not Just OneDrive)
17 March 2026
"We use OneDrive" is the most common answer we hear when we ask small businesses about their backup strategy. It's also, on its own, not a backup strategy.
OneDrive is a file sync service. It's excellent at keeping files in sync across devices and making them accessible from anywhere. But sync is not backup, and the difference matters enormously when something goes wrong.
Why Sync Is Not Backup
Sync propagates mistakes. If someone accidentally deletes a folder on their laptop, OneDrive helpfully syncs that deletion everywhere. If ransomware encrypts files on a device, the encrypted versions sync to the cloud, replacing the clean ones. Sync mirrors the state of your files — including the bad states.
OneDrive has retention limits. OneDrive keeps deleted files in the recycle bin for 93 days. Version history keeps previous versions for a limited time. After that, they're gone. If you discover a problem after the retention window, there's nothing to recover.
It doesn't cover everything. OneDrive syncs the files you put in it. It doesn't back up your email, your SharePoint sites, your Teams data, your contacts, your calendar, or your Microsoft 365 configuration. If your tenant is compromised or accidentally deleted, OneDrive files are just one piece of what you'd lose.
The 3-2-1 Rule
The gold standard for backup is the 3-2-1 rule: three copies of your data, on two different types of storage, with one copy off-site. For a small business using Microsoft 365, this means:
- Copy 1: Your live data in Microsoft 365 (email, OneDrive, SharePoint, Teams).
- Copy 2: A third-party backup of your Microsoft 365 data to a separate cloud service.
- Copy 3: An additional backup to a different location or provider — or a local backup for critical data.
At minimum, you need copies 1 and 2. Copy 3 is ideal for businesses with regulatory requirements or data they absolutely cannot afford to lose.
What to Back Up
A complete Microsoft 365 backup should cover:
- Exchange Online: Emails, contacts, calendars, and attachments for every user.
- OneDrive: All files in every user's OneDrive.
- SharePoint: All sites, document libraries, and lists.
- Teams: Channel conversations, files, and configuration.
Backups should run automatically (at least daily), retain data for a meaningful period (minimum 1 year, ideally longer), and support granular restore (recover a single email, a single file, or an entire mailbox).
Recommended Tools
Acronis Cyber Protect offers cloud-to-cloud backup for Microsoft 365 with ransomware protection built in. It backs up email, OneDrive, SharePoint, and Teams to Acronis Cloud, with point-in-time recovery and flexible retention policies.
Veeam Backup for Microsoft 365 is another strong option, widely used by IT providers. It can back up to local storage, cloud storage, or both.
Both options cost a few pounds per user per month — trivial compared to the cost of data loss.
Test Your Restores
A backup you've never tested is a backup you can't trust. Schedule a restore test at least quarterly: pick a random file, a random email, and try to recover them. If the restore works, great. If it doesn't, you've found the problem before it mattered.
Key takeaway
The businesses that recover quickly from data loss, ransomware, or accidental deletion are the ones that had proper backups running and tested before the incident. OneDrive sync alone is not enough — you need a dedicated third-party backup solution.
Want to talk about this?
Book a free 15-minute call and we'll discuss how this applies to your business.
Book a Free CallGet IT tips in your inbox
Practical advice for small businesses. No spam.