How the calculation works

Each question is worth up to the points in the table; the maximums add up to 100. A full answer earns all the points, a partial answer fewer, and “Not sure” earns none. Two answers say a question doesn’t apply, “We don’t use Teams” and “No such requirement”, and take that question out of the total, so the score is points earned out of the points that apply. “We don’t have a backup” scores zero on the questions about backup access, testing and copies, because those protections are missing too.

Answers about a backup have to agree with question 1: with no backup, the check won’t accept a restore from backup, backed-up Teams messages, separate backup admins, a restore test or a copy outside the tenant; with a backup, it won’t accept “We don’t have a backup”. “Not sure” is always accepted.

Score = 100 × points earned ÷ points that apply, rounded to a whole number.

Band:

  • Low exposure: 80 or more, and both critical questions at full points.
  • Some exposure: 50 to 79, or 80 or more with a critical question not at full points.
  • High exposure: below 50.

Exposures are every question below full points, listed by points lost (most first), then critical first, then question order.

These weights are ITBroker.com’s own, not Microsoft’s:

Question Points Critical Partial answer
Backup coverage (Exchange, OneDrive, SharePoint, Teams) 20 Yes 10 (some workloads)
Point-in-time restore beyond 30 days 15 Yes 4 (native tools only)
Departed users’ data 12 8 (account kept licensed)
Deleted email recovery 10 2 (Recoverable Items window only)
Retention and legal hold 10 none
Backup access separation 10 3 (same Microsoft 365 admins)
Restore testing 10 4 (more than a year ago)
Teams messages 8 5 (Teams retention policy)
Copy outside the tenant 5 2 (backup inside Microsoft 365)

What the native features cover, from Microsoft’s documentation:

  • Deleted email: soft-deleted items stay in the Recoverable Items folder for 14 days by default, adjustable to a maximum of 30, unless a hold or retention policy applies.
  • Deleted users: a removed account’s mailbox data is kept for 30 days, then permanently removed unless a hold or retention policy made it an inactive mailbox first. The user’s OneDrive is kept for the OneDrive retention period (30 days by default, adjustable), then sits in the site collection recycle bin for 93 days.
  • Files: SharePoint and OneDrive keep deleted items for 93 days across both recycle bin stages. Restore your OneDrive rolls a whole OneDrive back to any point in the last 30 days.
  • Teams: chats and channel messages are kept for compliance in hidden Exchange mailbox folders, and need a retention policy for the Teams locations; Exchange mailbox policies don’t cover them. Files shared in Teams live in SharePoint and OneDrive.
  • Microsoft 365 Backup (a separate, pay-as-you-go product): backs up OneDrive, SharePoint and Exchange with a recovery window of 3 months to 2 years; its backups stay inside the Microsoft 365 boundary.

Settings, defaults and products change; check the linked pages for your tenant before relying on a number.

Worked example

A company that relies on native features only answers:

Question Answer Points
Backup coverage None: native features 0 of 20
Point-in-time restore Native tools only 4 of 15
Deleted email recovery Recoverable Items window only 2 of 10
Departed users’ data Account kept licensed 8 of 12
Teams messages Neither 0 of 8
Retention and legal hold Required, nothing enforces it 0 of 10
Backup access separation We don’t have a backup 0 of 10
Restore testing We don’t have a backup 0 of 10
Copy outside the tenant We don’t have a backup 0 of 5

Every question applies, so the total is 100. Points earned: 0 + 4 + 2 + 8 + 0 + 0 + 0 + 0 + 0 = 14 out of 100, High exposure.

The nine exposures, by points lost: backup coverage (20), point-in-time restore (11), then retention and legal hold, backup access separation and restore testing (10 each, in question order), deleted email recovery and Teams messages (8 each), copy outside the tenant (5) and departed users’ data (4). Most of the list is one fix: a backup with retention longer than 30 days, its own admin accounts and a yearly restore test. The retention requirement needs retention policies or holds as well.

Sources