Cloud — Backup
Microsoft 365 and SaaS backup for New York businesses
Microsoft keeps the service running. Keeping your data restorable is your job — the shared responsibility model says so in writing. Stedholm maintains an independent, immutable copy of your tenant data and tests that it restores.
Why native retention is not backup
Retention policies, recycle bins, and litigation hold are recovery conveniences inside the platform. They were designed to preserve content for compliance and to undo the occasional accident — not to restore a business after something goes seriously wrong. The difference shows up in exactly the scenarios where you need backup most:
- Admin compromise. An attacker with tenant admin credentials can delete data and empty the recycle bins behind it. Protection that lives inside the thing being attacked is not protection.
- Departed users. When an account is deleted, its mailbox and OneDrive survive on a short clock — measured in days, not years — unless someone intervenes deliberately, every time.
- Ransomware over sync. The OneDrive client faithfully syncs encrypted files upward. Version history helps for a handful of files; restoring fifty users to a known-good point in time is a different problem.
- Retention windows lapse. Recycle bins and deleted-item retention run out quietly. The deletion you discover in month four is unrecoverable natively.
- Misconfigured retention. A retention policy is itself configuration — one bad edit applies to the whole tenant at once.
Microsoft’s own services agreement recommends regularly backing up your content using third-party services. We agree with Microsoft. This service is part of our cloud practice and pairs naturally with Microsoft 365 administration.
What independent backup adds
A separate control plane
Backups live outside the tenant, under separate credentials — a compromised tenant admin cannot reach them.
Immutability
Backup copies cannot be altered or deleted during their retention period, by an attacker or by us.
Point-in-time restore
Exchange, OneDrive, SharePoint, and Teams data restored to a chosen moment — the answer to sync-propagated ransomware.
Granular recovery
A single mailbox item, one user’s OneDrive, or an entire SharePoint site — restored to place or to a new location, without over-restoring.
Retention you choose
Retention set to your obligations — HIPAA documentation timelines, NYDFS expectations, client contracts — not to a platform default.
Tested restores, with evidence
Restore tests run on a schedule and produce reports you can hand to an auditor or insurer. An untested backup is a hope, not a control.
Backup is a compliance artifact too
Cyber-insurance applications ask how your data is backed up, whether copies are immutable, and when you last tested a restore. Security questionnaires from clients ask the same. A truthful, boring answer to those questions is worth real money at renewal time.
SaaS backup is one layer of a larger discipline — server images, endpoint data, and rehearsed recovery plans live under business continuity. If the question is “could the firm operate on Monday?”, start there; this page is the cloud-data piece of that answer.
What we cover
Exchange Online mailboxes
OneDrive for Business
SharePoint sites
Teams chats, channels, and files
Entra ID configuration objects
Other SaaS platforms by scoped request
Common questions
Doesn't Microsoft back up our data?
Microsoft engineers the service for availability — their responsibility is keeping Microsoft 365 running. Restoring your data after deletion, compromise, or corruption is explicitly your side of the shared responsibility model, and their services agreement recommends third-party backup for exactly that reason.
We already have litigation hold and retention policies. Isn't that enough?
Hold and retention preserve content for discovery. They are weak at restoring quickly and at scale, they cannot recover what a compromised admin purges, and they are themselves tenant configuration — one bad edit changes them everywhere at once. They complement backup; they do not replace it.
How fast can you restore?
A single item or mailbox comes back quickly; full-site and multi-user restores are governed by Microsoft’s API throttling, which no vendor honestly escapes. We set expectations during onboarding and validate them in scheduled restore tests rather than quoting numbers we have not measured in your tenant.
What happens if we leave Stedholm?
The backup data and its documentation are yours. We hand over or export on the way out — reversible by design is a standing commitment, not a slogan.
Know your data restores before you need it to.
Ask us what your current retention settings would actually recover — the answer usually surprises people.