This post compares leading M365 backup vendors on key criteria, including coverage of M365 data and metadata types, and backup and restore performance.
Microsoft 365 doesn't have a single unified API to access all M365 data. Instead, backup vendors use a combination of new and legacy APIs to protect Microsoft 365 data that can be reached via the API, and ignore the data that is inaccessible.
Aside from M365 API limitations, it is expensive and time-consuming to support every M365 data type, so most M365 backup vendors focus on a narrow subset of data types that is considered to be the most relevant. As a result, the quality and completeness of M365 backups varies greatly among vendors, mostly driven by:
Building M365 backup product ourselves gives us a specific vantage point: we know which capabilities customers actually evaluate, and which ones separate modern platforms from legacy tools. We use the list of nine capabilities internally to benchmark afi.ai against the competition when we plan our product roadmap.
We believe the most critical M365 backup capabilities are:
Below in this blog post we take a look at the backup fidelity and performance of backup solutions, and also indirectly cover the support (by taking a detailed look and products documentation quality).
There are six further key capabilities which although very important (security and audit, licensing and cost, search and accessibility, restore and export, reporting and API, and ransomware and malware detection), are less important are are outside of the scope of this blog post.
All Microsoft 365 backup products can recover basic M365 workloads. Where they differ is fidelity: whether SharePoint returns with its structure and metadata, whether Teams messages be recovered at all, and whether the Exchange Recoverable Items folder and email metadata is protected. This section compares nine products using vendor documentation.
Microsoft Limitations
Microsoft Graph makes
chatMessage.from(the sender identity on a message) writable in exactly one circumstance: "...sender of the chat message. Can only be set during [migration]." (chatMessage resource type)A vendor either drives the Import API in migration mode (a Graph state that lets historical messages be written back), or it re-posts messages as an ordinary user, which produces the fidelity gap below.
Afi provides the highest message fidelity: backup covers public, private and shared channels with reactions, mentions, importance flags, adaptive cards and system messages. Recovery to a new team fully restores the post/reply hierarchy and timeline; messages keep — uniquely — their original authors and sent dates plus attachments and formatting.
One-to-one, group and meeting chats are backed up (deleted chats included) but only available for preview/download-only - a limitation applicable to all vendors.
These vendor recover messages as live posts, but authored by the backup account and stamped with the restore date.
Keepit restores posts and replies; restored messages are posted by the backup service account, the timestamp reflecting restore time, not send time. Reactions and channel permissions are not restored; shared channels come back standard.
AvePoint, Commvault, and NinjaOne use the same repost model and report similar limitations; in AvePoint "the conversation time in the restored HTML file is UTC time", "Reaction: Like — Unsupported", and "The Edited status of a post or reply cannot be kept" (Teams Data Types).
Cove can recover posts, but it restores only into a new "[Restored]" team; private channels come back public (Microsoft 365 Limitations), guests and General-channel/group settings are lost.
Veeam Data Cloud for Microsoft 365 exports posts to a file of the HTML format, creates a separate tab in the original channel and attaches the HTML file to this tab" (Considerations and Limitations). It also omits "One-on-one and group posts" from backup.
Similarly, Druva restores conversations as HTML files under the Files tab of the team. Reactions also are not restored.
Datto: "Conversations cannot be restored. However, you can export and download conversations", plus a hard ceiling of "1000 is the maximum number of replies that can be backed up for a Teams message" (Data restore locations).
Microsoft Limitations
Microsoft keeps Recoverable Items folder in the mailbox's hidden area: "The Recoverable Items folder resides in the non-IPM subtree of each mailbox" (MS). It has seven subfolders — Deletions, Versions, Purges, Audits, DiscoveryHolds, Calendar Logging, SubstrateHolds. Graph's folder list names only one of them,
recoverableitemsdeletions(MS).There is no Graph endpoint for mailbox folder permissions; the Outlook tasks API "stopped returning data in 2022" (MS); Notes and Journal have no first-class resource.
Commvault and Afi offer the deepest mailbox fidelity. Afi preserves metadata and properties including: folder identity, message participants, dates, classifications, MIME when available, file and inline attachments, item attachments, reference-attachment link metadata, historical versions, and read/unread flag. On recovery, new objects receive destination identifiers, existing objects expose only writable properties. Commvault recovers encrypted (S/MIME and Purview) messages, but its documentation gives much less evidence about raw MIME, custom properties, attachment subtypes, and server-controlled fields.
Afi and Druva provide the widest range of data export options (PST, MBOX, EML, VCF, and ICS). However Druva's Recoverable Items coverage is limited to Deletions and Purges, and it does not support item attachments, reference attachments, recurring calendar data, task due-time semantics, task step completion, and task step order.
AvePoint excludes “Deleted Items folder and the Junk Emails folder ... from the backup for better performance.”; customers are required to contact support to include them. The primary-mailbox PersonMetadata folder is excluded; the vendor does not specify preservation of MIME, transport headers, extended properties, source IDs, change keys, created times, or last-modified times.
Veeam offers granular in-place restores with production comparison, and backs up In-Place and Litigation Hold item folders by default (VDC gates preservation-hold restore out of its Foundation and Advanced plans). However, folder and calendar sharing permissions are not collected, and the documentation does not provide evidence of raw MIME preservation, custom extended properties, item-attachment nesting, reference-attachment behavior, source IDs, change keys, or created/modified timestamp behavior.
Cove has the longest exclusion list (no tasks, contact lists/attachments, unaccepted invites, color categories). Datto “does not backup Deleted Items” and is unable to restore in place — mail lands in a timestamped restore folder.
Microsoft Limitations
A SharePoint Online (SPO) item carries system columns (Created/Modified timestamps, Author/Editor identities), custom columns, version history, a content type (a reusable bundle of columns and settings), and permission assignments.
Microsoft Graph API has significant restrictions in its ability to write some of this metadata. E.g. it marks
createdBy,lastModifiedByand their timestamps read-only on list items (listItem), and "updating the ModifiedBy (Editor) or CreatedBy (Author) field for a document in SharePoint using the Microsoft Graph API is not directly possible" (Q&A). Graph also omits column properties resulting invalidation formulas, hyperlink and managed-metadata column types go missing. Graph also offers "Read-only support for site resources (no ability to create new sites)" (SharePoint in Graph), which explains leads to some vendors being unable to rebuild a deleted site.Graph-only products are therefore limited in their ability to reconstruct SPO metadata, as opposed to high-fidelity backup services that use REST/CSOM to restore SPO data, as it allows to overcome many restrictions embedded in Graph API.
Afi and AvePoint provide the strongest explicit coverage. Afi is the only vendor ensuring ID preservation: recovery "preserves the original file/folder structure and metadata, including custom metadata column values, modification dates, and file/folder/item IDs", and it can provision new sites on recovery.
AvePoint has a close scope: per-column matrices mark every standard column type as restorable, plus site columns, content types, permissions and page content. At the same time, Avepoint states that “The content type applied to the list item cannot be kept after restore” AvePoint document data types, and classic publishing recovery changes the site into a communication site AvePoint site data types.
Commvault's matches Afi's and AvePoint's coverage but certain restored list items with attachments can have discrepancies in metadata values such as Modified By and Modified Time.
Keepit has broad backup coverage (sites, subsites, libraries, lists, pages, permissions, site columns, content types, settings) but has real restore gaps: managed-metadata columns, and Created by/Modified by list columns are not restored. Veeam has similar limitations: on restore, Created By becomes the restoring account, site owners/group members are not restored, and full-site restore needs a pre-existing target site.
Druva restores site permissions/people-groups, content types, site columns, and content-associated labels, but item-level column fidelity unstated, classic sites cannot be restored to a new site, purged classic sites cannot return to the same site, and deleted sites of either template cannot be restored in place, leaving several common disaster scenarios with no supported path.
NinjaOne cannot restore directly to site pages NinjaOne restore documentation, and site/wiki/web-part pages are skipped on restore download only. Cove excludes lists, pages, metadata values, and previous versions Cove limitations. Datto states, “SharePoint metadata is not backed up” Datto coverage, everything restores out of place into a timestamped "SaaS Protection Restore" folder.
Coverage of other Microsoft 365 backup generally reflects vendors' attention to the core data sources discussed above.
Keepit and Afi offer the broadest support for Power Platform. Afi protects Power BI, Power Apps, Power Automate, DLP policies and tenant settings, with per-object version history and native-format export (PBIX, PBIR, RDL, ZIP). Afi doesn't provide automated restore options and Administrators need to follow manual steps to restor data. Keepit has a slightly narrower Power Platform coverage, but offers partial automated recovery options.
Afi, AvePoint, and Keepit provide the best overall currently documented OneNote recovery, especially when storage metadata and possible in-place object-ID retention matter: they recover native OneNote notebook packages, not just a loose .one files. Several products protect only notebook files or cannot reconstitute a unified notebook. Cove and Veeam explicitly call out OneNote as unsupported.
As part of our competitive analysis we benchmark the performance of the leading M365 backup solutions. We omit benchmark data for some of the solutions, because when the numbers look bad, vendors tend not to like them. Below is what remains.
Test data set. A single SharePoint Online site containing 10,000 files totalling 17 GB, with a deliberately mixed file-size profile: 2,200 files of 125–512 KB, 6,400 files of 1–2 MB, and 1,400 files of 5–10 MB. Every product performed a first full backup of the same site.
| Vendor | Speed (full backup of 17 GB site) | Search & export capabilities |
|---|---|---|
| Afi | ~18 min (≈16 MB/s, ≈9.3 files/sec) | Full-text search across backup contents, global search across the whole tenant, instant export. |
| AvePoint Cloud Backup | ~20 min (≈14.5 MB/s, ≈8.3 files/sec) | Mailbox search is property-based — subject, sender, recipient, date. PST export is a job, limited to 10 mailboxes at a time. |
| Veeam Data Cloud | ~52 min (≈5.6 MB/s, ≈3.2 files/sec) | Basic search matches email subject or file name only. Advanced search mounts restore points. |
| Druva | ~1 h 5 min (≈4.5 MB/s, ≈2.6 files/sec) | Search indexes metadata only. PST download runs as a detached background task. |
These figures come from an earlier round of testing, so treat them as indicative rather than directly comparable.
| Vendor | Speed | Implied time for the 17 GB site | Search & export capabilities |
|---|---|---|---|
| CodeTwo Backup for Office 365 | 2.3 MB/sec | ~2 h 6 min | Has a e Body filter (exact-substring scan scoped to one resource at a time, no tenant-wide index). |
| Synology Active Backup for M365 | 2.2 MB/sec | ~2 h 11 min | Full-text (content) email and SharePoint search. Instant exports to EML/PST, CSV, ICS and HTML. |
| SkyKick Cloud Backup | 1.4 MB/sec | ~3 h 27 min | Only metadata search; no export at all. |
| SysTools | 0.2 MB/sec | ~24 h | Not searchable. |
The spread is close to 4x between the fastest and slowest of the current-generation products, and roughly 80x once the older round is included, as the differences come down to the product architecture and how efficiently each product spends its API budget. The gap between well-engineered and poorly-engineered systems is driven by (among other factors):
Retry-After header, and backup products need to intelligently handle it.In addition to backup speed, search and export is another set of capabilities relevant for scalability and performance. The market splits into two groups:
Data export is expensive and resource-intensive for backup vendors, as they mostly rely on slow, cheap "cold" storage. Most vendors limit or queue export requests. Users usually have to request an export job, and wait for the download link. The delay is <1h for smaller backups, but it adds to complexity, and recovery time. A few vendors (including Afi) avoid this limitation, providing instant immediate exports in native formats, without waiting for a download link.
Veeam's on-premises software is not part of the comparison above, since its performance is a function of the hardware you put underneath it. However, it is worth discussing here, as it offers strong capabilities (e.g. superior tenant-wide full-text content search, compared to VDC) and it is an good case study of the economics of on-prem performance versus SaaS products.
Veeam supports content search, body and content are documented search parameters for Exchange items, SharePoint and OneDrive items and Teams posts, and because the repository is yours, export is limited only by your own hardware.
Veeam Backup for Microsoft 365 is a traditional on-premises software. It needs to be installed on a Windows machine and be connected to a storage repository. To use all features you will need to install additional apps and libraries, including Veeam Explorer for SharePoint, Veeam Explorer for Exchange and Veeam Explorer for Microsoft OneDrive for Business (required for backup preview).
For a storage repository, Veeam supports AWS S3, Azure Blob, Wasabi and other S3-compatible storage; the Azure Archive and the S3 Glacier tiers are not supported as backup storage.
In order to connect Veeam to M365 you will need to manually configure authentication and access permissions - you should create a custom Azure (Entra) app with an access certificate and then assign administrator access roles to the app in M365. Veeam will use this Azure application to connect to your M365 tenant. The easier legacy alternative (typing M365 admin credentials into Veeam) is no longer available.
Veeam licenses can be purchased in packs of 10. The price per one license is $20.40 annually (so the minimal purchase is $204). One Veeam license is required for every M365 user and Shared mailbox. All users who have access to SharePoint Sites must be licensed to back up the Sites - this effectively means that you need to license all users in the domain in order to back up SharePoint Sites.
At $20.40 annual cost Veeam is ~40% cheaper than most M365 cloud backup services ($30-40 annual licence cost). However the total cost of a DIY M365 backup solution based on Veeam also includes infrastructure costs and admin time to monitor and maintain it.
Cost components of a DIY Microsoft 365 backup setup based on software licences, for a 2,000-user domain holding 42 TB of backup data.
| Cost type | Number of units | Cost per unit | Total cost / year | Details |
|---|---|---|---|---|
| Backup software licences | 2,000 M365 users | $16.32 per licence | $32,640 | Assuming a 20% discount off the $20.40 MSRP; sold in packs of 10 |
| Cloud backup storage | 42 terabytes | $0.0208 per GB/month (~$256/TB/yr) | $10,735 | Azure Blob Hot LRS, East US, first-50 TB tier. Erasure coding, ZRS or geo-replication cost 25–125% more |
| Cloud ops & network | 42 terabytes | ~$60 per TB | $2,520 | Planning allowance. Underlying rates: $0.05/10K write ops, $0.004/10K read ops, $0.08/GB egress above 100 GB/month. Assumes limited recoveries; heavy restore activity costs more |
| Backup server compute | 8,760 VM-hours (365×24) | $0.712 per hour | $6,237 | 1× Azure D8as_v5 (8 vCPU / 32 GB) with Windows Server included, matching Veeam's 8-core / 16–32 GB minimum. More users require a cluster |
| Backup server storage | 12 months | $135.17 per month | $1,622 | Azure P30 premium SSD (1 TiB, 5,000 IOPS) for the PostgreSQL configuration and cache database, per Veeam's stated requirement |
| Management & maintenance overhead | 60% of an FTE | $103,680 annual salary | $62,208 | US median for network and computer systems administrators (BLS, May 2025), base pay only. More IT admin time may be required depending on the number of user recovery requests |
| TOTAL | 2,000 protected users | $57.98 implied cost per user | $115,962 per domain | Excludes benefits and employment overhead on the FTE, anti-malware software, and backup testing |
The total do-it-yourself solution based on Veeam would therefore cost $58 per user per year. The reliability of such implementation would likely be somewhat less than many cloud-to-cloud backup services, because the configuration does not account for geo-redundant backup storage, anti-malware protection, or highly-available backup server.
With these economics, the on-premises solution makes most sense for organizations that already have an in-house IT team that is underutilized, where the backup monitoring and management efforts will use the spare capacity.
Microsoft Teams Backup Options
SharePoint Online Backup Options
