Microsoft 365: Five questions to help your firm prepare for data recovery
Which files and emails could your firm recover, how far back and how quickly? Five questions and a practical discussion sheet to review with your IT team or provider.
Published
A file to recover, a deadline to meet
Imagine this: your team is preparing a client file and discovers that a working document has been overwritten with an incomplete version. A deadline is approaching. You need the right content back, while preserving useful changes made since then.
The questions quickly become practical: which version do you need, where should it go and who can help? Working through those questions in advance helps your firm prepare.
Here are five questions to discuss with your IT team or provider. They are written with accounting firms in mind, but are equally useful to professional firms and other organizations that rely on their documents and email.
Understanding Microsoft 365's recovery tools
Microsoft 365 offers several mechanisms that serve different purposes:
- Version history lets you return to an earlier version of a SharePoint or OneDrive file. Microsoft explains how it works.
- SharePoint recycle bins let you recover deleted items that are still available in those bins. Time limits and deletion rules apply. Read Microsoft's explanation.
- Retention settings govern whether content is kept or deleted under the rules configured for it. Microsoft describes these settings.
- Backup configured for recovery provides additional restoration options. Microsoft offers Microsoft 365 Backup for SharePoint, OneDrive and Exchange. The product's availability does not mean it is enabled in your environment. Read the product overview.
For your firm, the useful question is which mechanisms are in place and how they address the situations you might face.
1. What data can we recover?
Start with the information you need to work: engagement files, working documents, material received from clients and email correspondence. Ask your provider to explain where those items live and how their recovery is covered.
A product name alone does not answer that question. Identify the relevant SharePoint sites, OneDrive storage and mailboxes. Also flag files kept on individual computers or in practice software, where coverage needs to be considered separately.
Think about changes, too. When a new team creates a document workspace, who checks that it is included in the intended protection?
What to obtain: a clear list of covered data and items still to review. This lets you compare the planned protection with the places where your team actually works.
2. How far back can we go?
How often backups run and how long their recovery points remain available answer two different questions. You need both answers to understand which earlier state you could recover.
Consider another illustrative example: a folder was deleted, but nobody notices it is missing until several weeks later. The question then is whether a state from before that deletion is still recoverable.
Ask for an explanation using a non-confidential example: which versions or copies are available today, and how long will they remain available? Avoid treating one time limit as a rule for all of Microsoft 365. The mechanisms described above each have their own scope and behaviour.
What to obtain: the recovery history available for your important data. This helps you prepare for recovery; it does not determine how long your firm is legally required to retain its records.
3. How long will it take to get back to work?
Recovering one working file is a different task from making several folders or mailboxes available again. First, identify what needs to be usable earliest: a file awaiting completion, a team's documents or its email.
Then separate your target recovery time from the time observed in a comparable test. Ask what that measurement includes: retrieving the data, putting it in the right place and having the relevant people check it.
Frequent backups do not promise a fast restoration. An initial support response time is also different from the time required to resume your work.
What to obtain: agreed priorities and a recovery time objective, supported by a test where possible. Any estimate needs to be understood in the context of the situation assessed.
4. Who starts the recovery and checks the result?
Make the process clear before a file goes missing. Identify whom to contact, who authorizes the work and who performs the recovery. Include arrangements for when the usual contact is unavailable.
The person responsible for the client file also has a role: checking that the right content has been recovered and that work can continue. Together with IT, they should confirm the destination, the expected version and appropriate access.
Also ask how access to backup and recovery administration is protected.
What to obtain: a clear process from the initial request through to checking the result. The Canadian Centre for Cyber Security recommends documenting recovery roles and responsibilities. Read its guidance.
5. When did we last check that recovery works?
A completed backup is useful information. A test examines a different question: can you retrieve usable content in the scenario you have chosen? The Canadian Centre for Cyber Security recommends testing recovery. Read its backup guidance.
Agree on a controlled test with the authorized people involved. A non-confidential file, an expected version and a suitable destination that preserves current work provide a starting point. Plan the operation with IT, without deleting production data simply to see whether recovery works.
Keep a short record of the date, items tested, outcome, observed time and any corrections needed. Also check that the person who needs the recovered content can open it.
What to obtain: a relevant test record or a test to arrange. Successfully recovering one file does not demonstrate that the entire environment can be restored.
A discussion sheet for your IT team or provider
Bring these five points to your next meeting. For each row, record what you know, what needs clarification and the next action. An unanswered question then becomes a specific item to address.
| Topic | Answer to record |
|---|---|
| Covered data | Relevant locations and data still to review |
| Available recovery history | Recoverable states for important files |
| Getting back to work | Priorities, target time and observed test time |
| Responsibilities | Contact, authorization, recovery and verification |
| Last test and next action | Date, scope, outcome and agreed follow-up |
This sheet is a starting point for discussion, to be adapted to your organization. Keep the answers in your internal documentation; you do not need to share client files to begin the conversation.
Would you like to make this approach part of ongoing IT management? Solution 360 supports accounting and professional firms in Québec with the management and security of their IT environment.
For a specific security or governance need, our expertise is also available through projects in Québec and internationally.