Your provider’s report says the backups ran. What should you ask next?
A green check on a weekly report is the normal sign that backups are running, and most weeks it is accurate. The report tells you a job finished. It does not tell you what the job copied, where the copy lives, or who can erase it.
These are questions for a meeting, not an accusation. A provider who has set this up carefully can answer each one in a sentence, and you will have the answers in writing.
What is copied
Start with scope. A backup job covers what someone pointed it at on the day it was set up, and companies add computers, shared folders, and cloud accounts after that.
Ask for the answer as a list: computer or account on the left, schedule and retention on the right. A list is something you can compare against your own inventory a year from now.
- Which computers, servers, and Microsoft 365 data are on the job, and which are not?
- What system configurations are copied along with the files? CISA’s advisory for customers of managed service providers asks for backups of critical data and system configurations.
- How often does each job run, and what is the longest gap between copies?
- When a new computer or server is added to your company, who adds it to the backup, and how would you hear about it?
Where the copies live
CISA’s ransomware guide advises keeping offline, encrypted backups of critical data. Its reasoning is that many ransomware variants look for backups they can reach and erase or encrypt them. The same advisory for customers of providers says backups should be stored where they are easy to retrieve, such as a cloud location or an air-gapped one.
The word to listen for is ‘reachable.’ A backup that any administrator account on your network can open is a backup an attacker with that account can open too. Ask the provider to point to the copy that is not.
- Where is each copy stored, and which copy sits somewhere a sign-in on your office network cannot reach?
- How are the copies encrypted, and who holds the key?
- How many generations are kept, and for how many weeks or months?
Who can reach and delete them
- Which accounts can delete or change a backup? Name each person.
- What second sign-in step does the backup account require, and which account is used for daily administration instead?
- How would you get your data back if the provider’s own systems were unavailable, and where is that written in the agreement?
- Whose name is on the backup account, yours or the provider’s? If the agreement ends, who keeps the copies?
What Microsoft 365 keeps without a backup
Microsoft keeps deleted mailbox items for a limited time. Items a person deletes from Deleted Items go to a hidden folder for 14 days by default, and an administrator can extend that to 30 days at most. When the period ends, the item is removed from the service. That is a recovery window for deleted mail, not a backup of your mail, files, or Teams data, and after that window the item cannot be recovered from the service. Microsoft’s documentation also notes that when a mailbox reaches its Recoverable Items storage limit before the period ends, the oldest items are deleted first.
Ask whether your Microsoft 365 data is on a separate backup job, and if it is not, whether anyone has decided that on purpose. Either answer is acceptable. An unknown answer is the one to write down.
Reading the answers
These questions test what was set up. They do not test whether a restore works. For that, ask for the date of the last restore and what was restored; the page on restoring backups walks through how to read the record. A backup that has never been restored has been measured only by its report.
- A clear answer names a system, a place, a schedule, and a person.
- A vague answer uses ‘we have that covered’ without a place or a date.
- A missing answer is fine to record as ‘to be confirmed by’ and a date.
- A partial answer, such as ‘the servers, yes; the laptops, we will check,’ is useful: it tells you where the next question goes.
Related
Sources
Talk to a person about what you noticed.
Call (•••) •••-••••
Kristina or Anne will answer. Available during US Eastern time.
While you wait: run the Reveal Scan on the computer you use for this.
Run the Reveal Scan on that computerThe Reveal Scan shows every problem it finds, with no charge and no credit card needed. Step-by-step instructions for fixing them are in the detailed report, which is paid, and you’ll see its price before you buy. It reads one Windows computer at a time and can’t see a mailbox.
Or ask for a call back. Tell us which computer or mailbox, and what you noticed.
Request a call back
Written by Craig Peterson, 35+ years successfully running IT and security for businesses. Last reviewed October 27, 2026.