“Microsoft 365 backup” says little on its own. A useful agreement names the data and identity information covered, the restore actions available and who does them.
Name the data that matters
Decide which workloads, users and information you need to protect. Confirm coverage explicitly with your provider, including what happens when people join, leave or the environment changes.
Ask: Which workloads and data are included? What is excluded? How is coverage reviewed when the organisation changes?
Be precise about identity
Basic Entra ID backup can protect supported identity information such as users and groups. That does not mean every setting can be recreated or a complete tenant rebuilt.
Ask: Which objects and attributes are included? Which restore actions are possible? Which permissions and dependencies are needed?
Agree retention and the restore process
Choose retention based on the situations you need to recover from. Agree who can request a restore, who approves it and how the result is checked.
Ask: How far back can we go? Where does restored data go? What if the original account or location no longer exists?
Test the working relationship
A focused Microsoft 365 scope lets you see how a managed provider onboards, communicates and handles a restore. Pick a representative test and write down what it shows.
Ask: Can we do a first restore test? Who runs the service day to day? Where is the independent backup stored?
Take these questions to your next review.
Download the plain-text checklist, add your evidence and agree who owns each next step.
Download checklist