Every provider backs things up and almost none of them is asked to prove a restore. That gap is where the entire value of the service sits, because a backup is a cost until the day it is a recovery, and on that day the only things that matter are how far back you can go, how long it takes to come back, and whether anybody has ever actually done it. All three are answerable in advance, in writing, and rarely are.
The two numbers a contract should carry
How much work you can afford to lose, and how long you can afford to be down. The first sets how often backups run; the second sets how they are stored and therefore what they cost, because restoring from cold storage is cheap to keep and slow to use. Write both numbers down before asking for quotes, then ask each provider what design meets them and what it costs. Without those two numbers every backup quote is comparable only on price.
What a retention policy has to decide
How far back you can go and how granular it is at each distance: daily for a few weeks, weekly for some months, monthly for some years is a common shape. It also has to decide what is deliberately not kept, which matters as much, because retaining everything forever is both expensive and a liability where privacy rules apply. Where a regulator or a contract sets a minimum period, that period is the floor and the policy should name it rather than exceed it by accident.
Cloud services are not backed up by being in the cloud
A hosted mailbox or file store protects you against the provider losing your data, which is not the thing that happens. What happens is somebody deletes a folder, an account is compromised and files are encrypted, or a leaver's mailbox is removed before somebody needed it. Native retention windows are short and vary by service. Ask specifically whether your cloud tenant is backed up separately, where those backups live and how far back they go.
The test that settles it
Ask to see a restore test report: a named provider restoring real data on a stated date, how long it took, and what did not work first time, because something always does not. A provider that performs this quarterly and writes it down is selling a recovery service. One that reports successful backup jobs is selling a backup job, and the difference between the two is only discovered on the worst day of the year.
Questions people ask about managed backups
How long should backups be kept?
A common shape is daily for weeks, weekly for months, monthly for years. Where a rule sets a minimum, name it in the policy rather than retaining everything by default.
Is cloud email backed up automatically?
Not in the way people assume. Native retention is short and varies by service, and it does not protect against deletion or a compromised account.
How often should a restore be tested?
Quarterly, with a written result naming what was restored, how long it took and what failed first time. Ask to see a redacted example before signing.
What is the difference between backup and disaster recovery?
Backup is having the data. Disaster recovery is being able to work again within a stated time, which usually needs somewhere to run and a plan, not just copies.