Acronis Backup for Microsoft 365 India — Why Microsoft's Built-in Retention Isn't Enough

Microsoft 365 Retention Policies Are Not Backup

This is the single most important thing to understand before evaluating any Microsoft 365 backup product: Microsoft's built-in retention features and backup are not the same thing.

Many Indian IT managers and business owners assume that because they are paying for Microsoft 365 — a cloud service from Microsoft — their data is protected. In a limited sense, this is true. Microsoft operates a redundant, highly available infrastructure that ensures the M365 service itself stays running. But high availability is not backup. Redundancy protects against infrastructure failures (a data center losing power, a storage array failing). It does not protect you against:

• An employee accidentally deleting three years of emails
• A ransomware variant that corrupts OneDrive files synced across the tenant
• A malicious insider wiping a SharePoint document library
• An ex-employee whose account is deleted, causing their OneDrive files to be permanently removed
• A data corruption that replicates across Microsoft's infrastructure before anyone notices

Backup protects against these scenarios by maintaining an independent, point-in-time copy of your data that can be recovered regardless of what happens in the primary system. Microsoft does not provide this for M365 — and Microsoft says so explicitly in its shared responsibility model.

This guide explains what Microsoft 365 retention actually covers, what it leaves exposed, and how Acronis Cyber Protect's Microsoft 365 backup module addresses those gaps for Indian businesses.

What Microsoft 365 Does Not Include by Default

Understanding the boundaries of Microsoft's built-in data protection is essential before you can evaluate what a third-party backup adds.

Deleted Item Retention — Time-Limited, Not Permanent

When a user deletes an email in Exchange Online, it moves to the Deleted Items folder. When the Deleted Items folder is emptied, the item moves to a Recoverable Items folder — this is the "soft delete" stage. By default, items remain in the Recoverable Items folder for 14 days (and up to 30 days with configuration). After that, the item is permanently deleted.

If a user deleted emails six weeks ago and needs to recover them today, the standard retention window has closed. Those emails are gone unless additional retention policies were explicitly configured.

Retention Policies — Compliance, Not Recovery

Microsoft 365 does support more sophisticated retention policies through the Microsoft Purview Compliance Center (formerly Compliance Center). These allow administrators to define how long certain types of data must be retained for regulatory compliance.

However, these policies are designed for compliance and legal hold, not operational recovery. The distinction matters in practice:

• Compliance retention preserves items for regulatory purposes — you cannot easily browse to a specific version of a document from six months ago and restore it to an active folder
• Operational backup provides granular, point-in-time recovery — you find the exact version of the file or email you need and restore it directly to the user's live mailbox or OneDrive

A compliance retention policy that preserves emails for seven years is not equivalent to a backup that lets you restore any email from any point in those seven years to a user's mailbox in minutes.

No Point-in-Time Restore for OneDrive and SharePoint

OneDrive for Business includes a "Version history" feature that keeps previous versions of files. SharePoint has similar versioning. These are useful for reverting individual file changes but have important limitations:

• Version history does not protect against bulk deletion — if a user or a ransomware attack deletes files rather than modifying them, version history cannot recover them after the retention period
• Version history depth is limited by configuration and storage quotas
• There is no tenant-wide point-in-time recovery — you cannot say "restore my entire OneDrive to its state as of last Tuesday" using Microsoft's built-in tools

Microsoft Teams Data Protection

Teams data is distributed across multiple M365 services: chat messages are stored in Exchange Online, files shared in Teams are stored in SharePoint document libraries, and meeting recordings go to OneDrive or SharePoint. Teams itself does not have native backup controls — you are dependent on the underlying Exchange and SharePoint retention settings, which have the limitations described above.

What Acronis Backs Up in Microsoft 365

Acronis Cyber Protect's Microsoft 365 backup module provides independent, agent-based backup of all primary M365 data types.

Exchange Online Mailboxes

Acronis backs up the complete mailbox for each licensed M365 user, including:

• All email folders (Inbox, Sent, Drafts, custom folders)
• Calendar events and recurring appointments
• Contacts
• Tasks
• Public folders (with appropriate licensing)

Backup runs on a configurable schedule — daily at minimum, multiple times per day for environments with strict RPO requirements. Each backup is a point-in-time snapshot of the mailbox state.

OneDrive for Business

Acronis backs up the complete OneDrive for Business file store for each protected user, including:

• All files and folders
• All versions of files that were present at the time of backup
• Shared items (files shared from this user's OneDrive)

This provides independent protection against ransomware that targets OneDrive sync (a ransomware variant that encrypts local files and then syncs the encrypted versions to the cloud is a real and documented threat), accidental deletion by users, and account deletion.

SharePoint Online

Acronis backs up SharePoint Online sites and document libraries, including:

• Site collections and subsites
• Document libraries with all files
• Lists and list items
• Site pages

SharePoint is often the most critical collaborative data store in an M365 deployment — contracts, project files, policies, and operational documents. Protecting it with independent backup rather than relying on SharePoint's built-in versioning is essential for organizations where SharePoint holds business-critical content.

Microsoft Teams

Acronis backs up Teams data through the underlying Exchange Online (for chat messages stored as Exchange items) and SharePoint (for Teams channel files and tab content). Teams channel messages are captured to the extent they are stored in Exchange Online mailboxes.

How Acronis M365 Backup Works

Acronis uses Microsoft's official Graph API and Exchange Web Services APIs to connect to your M365 tenant. There is no software agent installed on individual users' machines — the backup is performed at the cloud-to-cloud level, with Acronis's infrastructure pulling data from Microsoft's infrastructure on your defined schedule.

Deployment process:

1. An administrator grants Acronis the necessary API permissions in your Azure Active Directory tenant
2. Acronis connects to your M365 tenant and discovers all licensed users and sites
3. You configure which users and data types to protect (individual users, all users, specific groups)
4. Backup schedules are defined — daily incremental is the standard starting point
5. Backup data is stored in Acronis Cloud storage (or your own storage target)

The entire setup process for a typical Indian SMB M365 tenant takes less than an hour. There is no on-premises infrastructure required — the backup runs cloud-to-cloud, and you manage it through the Acronis Cyber Protect console.

Granular Restore Options

The practical value of backup is measured by what you can restore, how fast, and with how much granularity. Acronis M365 backup provides recovery at multiple levels.

Individual Email Recovery

An administrator (or a delegated IT staff member) can search the Acronis backup catalog for a specific email — by sender, recipient, subject, date range, or content. The recovered email can be restored directly to the user's live mailbox, to a different mailbox, or exported as a PST file.

This scenario occurs more often than most IT managers expect: a user reports an important email from several months ago has been deleted, or an email was part of a legal matter and needs to be retrieved for evidence. Without independent backup, this recovery is either impossible or requires an expensive Microsoft support engagement.

Full Mailbox Recovery

If a user account is deleted (when an employee leaves, for example) and the account's mailbox is deprovisioned before data is archived, Acronis can restore the full mailbox contents from the last backup. This addresses one of the most common accidental data loss scenarios in Indian SMBs — where offboarding procedures do not include a step to archive or transfer the departing employee's mailbox before the account is deleted.

OneDrive and SharePoint File Recovery

Individual files, folders, or entire OneDrive libraries can be recovered from any available backup point. Bulk recovery (recovering an entire user's OneDrive to a specific point in time) is possible through the Acronis console without requiring Microsoft support intervention.

For SharePoint, site collections and document libraries can be restored in whole or in part. If a document library is accidentally deleted by a site administrator, Acronis can recover it from the backup without depending on SharePoint's relatively short-window recycle bin.

Point-in-Time Recovery

Every backup creates a recoverable snapshot. If today you discover that a OneDrive folder was corrupted or deleted two weeks ago, you can restore from the backup that was taken before the incident occurred. This is the capability that Microsoft's built-in tools cannot reliably provide for all scenarios.

Compliance Benefits for Indian Businesses

Indian businesses across several sectors have data retention and audit obligations that go beyond what Microsoft 365 provides by default.

SEBI-regulated companies and BFSI sector: The Securities and Exchange Board of India and RBI guidelines require certain electronic records to be retained for defined periods. Exchange Online's default retention limits are insufficient to meet these requirements without additional configuration — and Microsoft's compliance tools are not designed to make production-system recovery easy in an audit scenario. Acronis provides an independent retention layer with searchable, recoverable archives.

Legal and professional services: Law firms, CA firms, and consulting firms in India frequently have client confidentiality obligations and contractual data retention requirements. Losing client communications due to accidental deletion or account misconfiguration is both a business risk and a potential liability. Independent backup of Exchange Online provides a recovery net that Microsoft's tools alone do not.

GST compliance records: For Indian businesses, GST-related communications, purchase orders, vendor correspondence, and financial records stored in email or OneDrive may be required for GST audit purposes. A backup solution with point-in-time recovery ensures these records are recoverable even years after the original transaction.

General DPDP Act readiness: India's Digital Personal Data Protection Act imposes obligations on how businesses handle personal data. While the primary DPDP obligations are about processing and consent, being able to demonstrate control over your data — including knowing where it is, being able to retrieve it, and being able to delete it — is supported by having a proper backup and archive system rather than relying on platform defaults.

Anti-Ransomware Protection for M365 Data

One of the less-discussed threats to Microsoft 365 data is ransomware that attacks through OneDrive synchronization.

Modern ransomware variants frequently target OneDrive and SharePoint by exploiting the sync client. The attack workflow is: ransomware encrypts files on the local Windows machine, the OneDrive sync client sees the changes and syncs the encrypted (now unreadable) versions to the cloud, and within hours the cloud copy of your OneDrive reflects the encrypted state.

Microsoft's version history can sometimes recover individual files from this scenario, but the recovery is manual, file-by-file, and depends on version history depth that may not cover the full scope of the encrypted files.

Acronis addresses this at two levels:

1. Active Protection on the endpoint: Acronis Active Protection monitors local process behavior. When a ransomware process begins mass-encrypting files, Active Protection stops it before the full encryption completes — and before the sync client uploads the encrypted versions to OneDrive. The attack is halted at the source.

2. Independent cloud backup: Even if ransomware succeeds in modifying OneDrive content before Active Protection stops it, the Acronis backup maintains an independent copy of OneDrive data from before the attack. A point-in-time restore recovers the clean files.

This two-layer protection — behavioral detection on the endpoint plus independent cloud backup — is significantly stronger than relying on either layer alone.

Comparison: Acronis vs Veeam Backup for M365 vs NAKIVO M365

The most significant practical difference is the management integration. With Acronis, your M365 backup and your device/VM backup are managed from a single console, with a single backup policy framework and a single alert dashboard. With Veeam, M365 backup is a completely separate product (Veeam Backup for Microsoft 365) with its own management interface, its own storage requirements (Veeam B365 requires on-premises storage infrastructure), and its own licensing. For Indian SMBs that want simplicity, Acronis's integrated approach is meaningfully less operationally complex.

How to Buy and Set Up Acronis M365 Backup in India

Acronis M365 backup is licensed per active Microsoft 365 user per year. You do not need to purchase device licenses to use the M365 backup module — it is available as a standalone add-on or bundled with device protection in an Acronis Cyber Protect plan.

Procurement through Cloudfy Systems:

As an authorised Acronis reseller in India, Cloudfy Systems provides:

• Official INR pricing for Acronis M365 backup licenses
• GST invoice (valid for company IT procurement and input tax credit)
• Technical setup assistance — tenant API authorization, backup configuration, schedule setup
• Ongoing support for recovery requests and license renewals

Initial setup steps:

1. Purchase Acronis M365 backup licenses (per user, annual subscription) through Cloudfy Systems
2. Log into the Acronis Cyber Protect console
3. Use the Microsoft 365 wizard to authorize Acronis's API access to your Azure AD tenant
4. Select users and data types to protect
5. Configure the backup schedule
6. Verify the first backup completes successfully and perform a test restore

The initial setup typically takes one to two hours for a standard SMB M365 tenant. No on-premises infrastructure is required for cloud-to-cloud backup using Acronis Cloud storage.

For assistance with procurement, pricing, or technical setup, contact Cloudfy Systems — we handle the full Acronis M365 backup implementation for Indian businesses and provide post-deployment support.

As an authorised Acronis partner in India, Cloudfy provides Acronis Cyber Protect services including M365 backup, device protection, and disaster recovery.

Frequently Asked Questions

Does Microsoft 365 have built-in backup?

No. Microsoft 365 includes retention policies and versioning features, but these are not equivalent to backup. Retention policies are designed for compliance — they preserve data for regulatory purposes. Backup is designed for operational recovery — point-in-time recovery of specific items on demand. Microsoft explicitly documents that customers are responsible for protecting their own M365 data against accidental deletion, ransomware, and other data loss scenarios.

How long does Acronis retain Microsoft 365 backup data?

Retention periods in Acronis are configurable based on your requirements and the storage plan you select. Common configurations for Indian businesses range from 90 days to multiple years depending on compliance requirements. Longer retention periods require more storage, which is reflected in the storage component of the Acronis subscription cost.

Can Acronis restore a deleted Microsoft 365 user's mailbox?

Yes. When an M365 user account and mailbox are deleted, the Acronis backup retains the backup data for that user according to your configured retention policy. If the account was deleted and the mailbox deprovisioned, Acronis can restore the mailbox contents to a new or existing mailbox without requiring Microsoft support. This is one of the most common recovery scenarios for Indian businesses managing employee offboarding.

Is Acronis M365 backup compliant with Indian data protection requirements?

Acronis's cloud storage infrastructure is designed to meet international data protection standards, and Acronis provides documentation supporting compliance with major regulatory frameworks. For Indian businesses with specific compliance requirements under SEBI, RBI, or the DPDP Act, Cloudfy Systems can provide guidance on how Acronis's architecture supports those requirements and whether on-premises or regional storage options are appropriate for your use case.

How does Acronis M365 backup pricing compare to Microsoft's own backup features?

Microsoft does not offer a paid M365 backup product that provides operational point-in-time recovery. Microsoft 365 Backup (announced as a limited preview feature) provides some basic restore capabilities but is not a replacement for a third-party solution with granular recovery, independent storage, and ransomware protection. Acronis M365 backup is priced per user per year — contact Cloudfy Systems for current INR pricing applicable to your Microsoft 365 user count.

Can I use Acronis to back up only specific users in my M365 tenant?

Yes. Acronis allows you to select which users, SharePoint sites, and data types are included in backup. You can protect all users, a subset of users, or specific users by license type. This flexibility allows Indian businesses to prioritize backup for users with business-critical data (executives, finance, operations) while managing costs for lower-priority accounts.

Cloudfy Systems is an authorised Acronis partner in India. For Acronis Microsoft 365 backup setup and pricing in India: +91 97600 50555 | connect@cloudfysystems.com