Check your backups work

Who this is for: owners and office managers. This is the article on this site most likely to save your business.

The short answer

"The backup ran" and "we can get our data back" are different claims, and only the second one matters. Test a restore quarterly. It takes about ten minutes and doesn't require any technical skill.

Why a green checkmark isn't enough

Backups fail quietly in ways the dashboard reports as success:

• A new folder or a new server was never added to the job, so it's backing up the same shrinking set of data perfectly.
• The backup files themselves are corrupt, which only surfaces on restore.
• Everything is backed up to one drive sitting next to the server, which the same fire, flood, or ransomware will take.
• Nobody knows the credentials to the backup system anymore.
• Retention was set to seven days, and the problem started three weeks ago.

Every one of these looks fine right up until the day it matters.

The ten-minute quarterly test

Put it on the calendar. Any non-technical person can do this.

1. Pick a real file at random — last quarter's spreadsheet, a client document. Not a test file you created for the purpose.
2. Restore it from backup to a new location, not over the original.
3. Open it and read it. A restored file that won't open is not a restored file.
4. Write down the date, the file, and how long it took. Keep the log; it's the evidence your insurer or auditor will ask for.

If you can't complete these four steps yourself, that's the finding. It means restores depend on one person being available during a crisis.

The five questions to ask annually

1. What exactly is backed up? Get a list. Compare it against where your data actually lives now, not where it lived when the system was installed.
2. Where do the copies sit? You want at least one off-site copy and one that ransomware can't reach from your network — offline or immutable.
3. How far back can we go? Ransomware often sits dormant for weeks. Thirty days of retention is a floor, not a target.
4. How long would a full recovery take? Not the file restore — the whole thing. If the honest answer is five days, decide now whether the business can absorb five days.
5. Who can perform a restore? If the answer is one name, you have a single point of failure with a vacation schedule.

About Microsoft 365

Microsoft keeps your service running; they don't keep a long-term backup of your content for you. The recycle bins and retention windows described in our file recovery article cover accidents, not a deletion discovered four months later or a compromised account that emptied a mailbox. If Microsoft 365 holds data your business can't operate without, it needs its own backup.

The one-sentence version

An untested backup is a hope, not a plan.