Microsoft 365 Backup Compared: Microsoft, Veeam and Keepit

It's Friday afternoon at a 25-person architecture firm in Montréal's Mile End. The office manager opens the shared projects folder and finds every drawing renamed and encrypted, OneDrive sync included. The recycle bin and version history help with a handful of files. For tens of thousands of documents, you need a real backup.

Microsoft protects its infrastructure, but restoring your data to a specific point in time is still your job. That's the shared responsibility model, and Microsoft says its position hasn't changed. We cover the basics in Microsoft 365 backup: do you need it?. Now that Microsoft sells its own backup tool, the question isn't just "should we back up?" but "with what?"

This comparison puts the native tool, Microsoft 365 Backup, up against two established cloud services: Veeam Data Cloud for Microsoft 365 and Keepit.

Microsoft 365 Backup: speed, without leaving Microsoft

You turn it on from the Microsoft 365 admin centre and pay as you go through an Azure subscription. The list price is US$0.15 per GB of protected content per month, and restores are free. Read the fine print on what counts: Microsoft also bills for the second-stage recycle bin, deleted and versioned mailbox items it retains, and online archives.

The strengths are real. Restore points are created every 10 minutes (for the past two weeks on OneDrive and SharePoint, then weekly up to 52 weeks; for 52 weeks on Exchange), and Microsoft advertises fast bulk restores, which is exactly what you want after ransomware. You can now restore specific files and folders, and search for individual mailbox items.

The limits are just as clear. Coverage is Exchange (user and shared mailboxes, not group or room mailboxes), OneDrive and SharePoint. Retention maxes out at two years. Most importantly, Microsoft says the data never leaves the Microsoft 365 trust boundary. That's why it's fast, but it isn't a copy held by someone else.

Veeam Data Cloud for Microsoft 365: two copies if you want them

Veeam offers this as a managed service: no servers to deploy, with unlimited storage and 24/7 support in every plan. Foundation is listed at US$3.50 per user per month for 10 to 50 users; Advanced adds Entra ID protection, and Premium adds fast, large-scale recovery.

The architecture is the main draw. "Flex" backups are stored in a Veeam-hosted Azure environment, isolated from Microsoft 365 and from your own systems, in the region you choose, including Canada Central. The Premium plan also lets you run "Express" backups on Microsoft 365 Backup storage. The result is an external copy and a fast-restore copy, managed from one console.

On the downside, Google Workspace isn't listed among the workloads Veeam Data Cloud protects, the prices are US-dollar MSRP that resellers may adjust, and the documentation we reviewed covers Teams channels rather than private chats.

Keepit: independent infrastructure, in Canada

Keepit runs its own storage infrastructure instead of reselling a hyperscaler's. It opened two Canadian data centres in 2022 and states that customer data never leaves the chosen region. It keeps four copies across at least two sites per region; its data centres are ISO 27001 certified and its controls are covered by a SOC 2 Type II report.

The service covers Exchange, OneDrive, SharePoint, groups and teams, and a separate Keepit service protects Google Workspace, which is handy if your organization runs both. Retention is 5 years on the entry plan and 10 years on the higher tiers, with an unlimited add-on. The trade-offs: no published pricing, Entra ID requires a separate service, and entry-plan support runs during business hours.

One copy or two?

The 3-2-1-1-0 backup rule calls for at least one off-site copy and one immutable or offline copy. Microsoft 365 Backup ticks the immutability box with a caveat: storage is append-only, but an administrator can still delete backups by offboarding the service, with a 90-day grace period.

In a ransomware attack, a stolen admin account is exactly what attackers go after. Microsoft itself flags deleting backups and pausing billing as "potentially harmful" events that trigger email alerts. Turn those alerts on, whichever tool you choose.

How to choose

Start with these questions:

• Does your insurer or a key client require a copy outside Microsoft? If so, the native tool won't do it alone; Veeam or Keepit fill that gap.
• Do you also use Google Workspace? Of these three, only Keepit covers both.
• How long must you keep records? Two years at most with Microsoft; longer with Veeam Flex or Keepit.
• Where must your data live? A "Canada" region isn't necessarily in your province. If backups hold personal information, check with your privacy officer and legal counsel.
• Should cost follow headcount or data volume? A 10-person firm with heavy drawings and photos will pay very differently under each model.

Whatever you pick, run a real test restore at least once a quarter. A backup you've never restored is just a theory.

Our Microsoft 365 and Google Workspace audit checks what your backups actually cover, who can delete them and which alerts are in place.