How to Back Up SharePoint Sites and Files

SharePoint stores documents, lists, pages, and other collaborative content in an organization’s Microsoft 365 environment. A separate backup helps recover from accidental deletion, unwanted changes, ransomware, or a service or configuration problem. The exact process depends on your organization’s licenses, Microsoft 365 setup, and backup product, so confirm what is available with your administrator before starting.

First decide what must be protected: SharePoint sites, document libraries, lists, pages, and associated permissions may have different backup or restore coverage. Microsoft provides recovery features such as recycle bins and version history, but these have limits and are not a substitute for a separately managed backup. Microsoft 365 backup options and third-party products also change over time; check current Microsoft documentation and your provider’s instructions.

What You’ll Need

Access: Permission to configure backups, usually through a Microsoft 365 or SharePoint administrator account. Use an authorized account and follow your organization’s security procedures.
Backup method: An available Microsoft 365 backup service or a compatible third-party backup product that explicitly supports SharePoint Online. Confirm whether it covers the sites and content types you use.
Storage and retention plan: A destination and retention settings appropriate to your organization. Check capacity, security, access controls, and how long backups are kept.
Scope list: The sites, libraries, lists, and important content owners expect to recover. Include critical team or communication sites, not just personal files.
Restore test plan: A safe location and an authorized person to test recovery without overwriting live content.

Step-by-Step

Inventory what matters. List the SharePoint sites and content that need protection, their owners, and the business purpose of each. Note any special requirements for lists, pages, metadata, permissions, or attached files. Do not assume that backing up one library automatically includes an entire site or its configuration.
Check your recovery options. Ask your Microsoft 365 administrator what backup services or products your organization has, and review their current SharePoint coverage. Separate backup from Microsoft’s built-in recovery features: the recycle bin and version history can be useful for common mistakes, but they may not meet your retention, isolation, or recovery needs. Menu names and paths may differ slightly by version and product.
Choose an authorized backup method. Use an organization-approved Microsoft 365 backup option or a reputable third-party service that documents SharePoint support. Confirm the service can protect the content you inventoried and can restore it to a useful location. Avoid connecting an unapproved app or granting broad permissions without administrator review.
Configure the protected scope. Sign in to the backup service with the required administrative role, then select the SharePoint sites or other supported content to protect. Review account and site permissions carefully. If the service offers automatic discovery of new sites, decide whether to enable it and how new sites will be checked.
Set backup and retention rules. Configure the schedule and retention period based on how often content changes and how long your organization needs recovery points. Confirm the service’s documented limits for frequency, storage, and retention. Keep backup access restricted, and use separate or protected storage where supported so a compromised SharePoint account cannot easily remove every copy.
Run the initial backup. Start the first backup and monitor its status until it completes. Review warnings and failures rather than assuming that a “completed” message means every item was included. A large site or a service limit can affect processing; follow the provider’s instructions for retries or exclusions.
Verify coverage and recovery points. Check the backup report for the expected sites and recent completion times. Compare a few known files, lists, or pages against the protected inventory. Confirm that the backup has usable versions and that any stated exclusions are acceptable. Save the report or document where administrators can find it.
Test a restore safely. Restore a representative file or item to a separate test location, if your product supports it. Check that the content opens and that important details—such as versions, metadata, or permissions—are present as expected. Do not test by restoring over a live site or overwriting current files. Record the result and correct any gaps.
Monitor and review. Set up notifications for failed or missed backups and assign someone to investigate them. Recheck coverage when sites, owners, or business needs change. Repeat restore tests periodically and after significant backup configuration changes; a backup that has never been restored is not yet proven usable.

Common Mistakes

Relying only on the recycle bin: Deleted items may be recoverable for a limited period, but recycle-bin recovery is not a comprehensive, independent backup strategy.
Protecting only documents: A site may also contain lists, pages, metadata, and permissions. Check coverage by content type instead of assuming all site components are included.
Ignoring failures: A scheduled job can fail because of permissions, service limits, or configuration changes. Review status and alerts and resolve errors promptly.
Keeping no separate recovery copy: If backup data is reachable with the same compromised credentials as the source, an incident could affect both. Use the strongest isolation and access controls your service supports.
Never testing recovery: A successful backup report does not prove that the right version can be found and restored. Perform a controlled test before an emergency.
Assuming everything is retained forever: Backup products have specific retention, storage, and restore limits. Read the product documentation and document what those limits mean for your organization.

Tips

Use clear site names and maintain a simple inventory with an owner for each important site.
Protect administrative accounts with strong authentication and grant backup tools only the permissions they need.
Keep backup configuration, recovery instructions, and escalation contacts somewhere accessible if SharePoint is unavailable.
Ask site owners to report major changes or newly created sites, especially if automatic discovery is not enabled.
For important recoveries, restore to a separate location first and compare the result before replacing or republishing live content.

Troubleshooting

A site does not appear: Check that the account has the required permissions, that the site is within the product’s supported scope, and that discovery or selection is configured. Ask the administrator or vendor to review connector and access errors.
The backup fails or stalls: Read the job details for permission, connection, capacity, or service-limit messages. Confirm the service is available, check storage, and retry according to the provider’s guidance. Avoid repeatedly rerunning a job without addressing its reported cause.
Some items are missing: Check exclusions, unsupported content types, site selection, and the last successful recovery point. Compare the product’s coverage documentation with the missing items and open a support request if the reason is unclear.
A restore is incomplete: Confirm you selected the correct recovery point and destination. Check whether the product restores permissions, metadata, versions, and related content separately. Test in a new location and consult the provider before replacing live data.
You cannot access the backup console: Use your organization’s account recovery and administrator escalation process. Keep an authorized backup administrator available so recovery does not depend on one person’s account.

Frequently Asked Questions

Does Microsoft automatically back up SharePoint?

Microsoft provides service resilience and built-in recovery features, but these do not necessarily replace a backup designed around your organization’s retention and restore needs. Confirm the protections and responsibilities that apply to your Microsoft 365 setup.

Is SharePoint version history a backup?

Version history can help recover earlier versions of supported files, depending on configuration and retention. It does not provide the same independent protection or broad recovery scope as a dedicated backup.

Can I back up SharePoint without being an administrator?

You may be able to save or export content you can access, but configuring a full organizational backup usually requires administrator permissions. Ask your Microsoft 365 administrator to arrange authorized coverage.

How often should SharePoint be backed up?

Choose a schedule based on how quickly content changes and how much recent work your organization could tolerate losing. Check the backup product’s available schedules and recovery-point limits, then test that they meet your needs.

Can I restore one file without restoring a whole site?

Many backup products support item-level recovery, but capabilities vary. Check whether your service can restore an individual file or list item and whether it can place the recovered content in a separate location.

What should I do before restoring a site?

Identify the right recovery point, confirm the destination, and tell affected site owners. When possible, restore to a separate site first, verify content and permissions, and only then plan any changes to the live site.

Further reading: Microsoft Support. Details can change, so check the official page for anything that matters to you. Spotted a mistake? Tell us. How we write an answer.