Fabrikam Inc. recently enabled Microsoft 365 Backup for their tenant. A user reports that they accidentally deleted important project files from their OneDrive three weeks ago and needs them restored. The admin has confirmed the files are not in the user's OneDrive recycle bin. Which Microsoft admin portal section should the admin use to initiate a point-in-time restore of the user's OneDrive?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Microsoft 365 Backup is a paid add-on feature managed from one specific spot: Settings > Microsoft 365 Backup in the Microsoft 365 admin center. Think of it as the 'backup control room' — that's where you pick the workload (OneDrive, SharePoint, or Exchange), find the user, pick a restore point, and kick off the recovery. The user's OneDrive admin page and recycle bin are totally separate tools.
Full explanation below image
![Portrait infographic (2048x1536) with a clean white background and Microsoft blue/green color scheme. Title at top: 'Microsoft 365 Backup — Point-in-Time Restore Workflow' in bold dark blue text (#002050). Top section (25% of height): Microsoft 365 admin center navigation breadcrumb path shown as a horizontal sequence of rounded rectangles connected by '>' arrows: 'M365 Admin Center' → 'Settings' → 'Microsoft 365 Backup' with the last box highlighted in green with a bold green border labeled '✓ START HERE'. Middle section (50% of height): Three large tile boxes side by side representing the three protected workloads: (1) Exchange Online tile with envelope/mail icon in blue; (2) SharePoint tile with building/grid icon in teal; (3) OneDrive tile with cloud icon in blue, this tile highlighted with a bright border labeled 'Selected'. Below the tiles, a horizontal timeline bar showing backup restore points as calendar markers: 'Today ←——— 3 weeks ago [RESTORE POINT ★] ←——— 6 months ago (max retention)'. A large curved arrow labeled 'Point-in-Time Restore' sweeps from today back to the '3 weeks ago' restore point marker. Bottom section (25% of height): Three comparison boxes with X marks showing what NOT to use: (1) Red X — 'OneDrive Admin Center: manages ownership, not backup restores'; (2) Red X — 'Purview Content Search: for eDiscovery/compliance, not restores'; (3) Red X — 'Active Users OneDrive panel: browse live files only'. Clock icon and calendar icon used as decorative elements near the timeline. Microsoft blue #0078D4 and green #107C10 as primary colors.](/media/microsoft/ab-650/AB-650-e1-q004-infographic.webp)
Full Explanation
Correct Answer — C: Microsoft 365 admin center > Settings > Microsoft 365 Backup
Microsoft 365 Backup is a first-party Microsoft backup solution (generally available as of late 2024) that provides point-in-time restore capability for Exchange Online mailboxes, SharePoint sites, and OneDrive accounts. It is managed exclusively from Microsoft 365 admin center > Settings > Microsoft 365 Backup. Once there, the admin selects the workload (OneDrive in this scenario), searches for the affected user account, and can view all available restore points — typically going back up to 180 days depending on the backup policy configured. The admin selects the desired point-in-time (in this case, a date before the deletion three weeks ago) and initiates the restore. The restore creates a copy of the data at that point, returning the deleted files to the user's OneDrive. This feature requires a Microsoft 365 Backup license (purchased separately or as part of a bundle) and must have been enabled before the deletion occurred — which the scenario confirms.
Why A is wrong — OneDrive admin center > Classic features > Restore a user's OneDrive: The OneDrive admin center's 'Restore a user's OneDrive' feature under Classic features is specifically designed for restoring access to a OneDrive when its owner account has been deleted (a deleted employee's OneDrive is preserved for 30 days). It is used to assign a new owner or secondary admin to access a former employee's OneDrive. This feature does not perform point-in-time restores of file content — it only manages ownership and access of the OneDrive container itself.
Why B is wrong — Microsoft Purview > Content Search > Restore deleted items: Microsoft Purview Content Search is an eDiscovery and compliance tool used to search for and export content across Exchange, SharePoint, OneDrive, and Teams for legal holds, investigations, and audits. While Content Search can locate deleted or retained content that has been preserved by a retention policy, it does not function as a backup restore tool. It exports content for review or legal purposes — not for returning files to their original location for normal business use. This would be the right tool if the scenario involved a legal hold or compliance investigation, not a simple accidental deletion recovery.
Why D is wrong — Microsoft 365 admin center > Users > Active users > [user] > OneDrive > Restore: The OneDrive section accessible via the Active users panel allows admins to access or share a user's OneDrive files directly (useful for accessing content of an active user's OneDrive in a support context). However, this section does not provide Microsoft 365 Backup restore functionality. You can browse and download files from the live OneDrive from here, but since the files were deleted three weeks ago and are no longer in the recycle bin, this path will not recover them. Microsoft 365 Backup point-in-time restores are only accessible through the dedicated Backup management section.
Exam Tip: Microsoft 365 Backup is a relatively new and frequently tested topic on the AB-650 exam. Know these key facts: (1) It covers three workloads: Exchange Online, SharePoint Online, and OneDrive for Business; (2) Management is in M365 admin center > Settings > Microsoft 365 Backup; (3) It offers point-in-time restore — not just 'restore the latest version'; (4) The recycle bin (standard, 93-day retention) is separate from M365 Backup — admins should check the recycle bin first for recent deletions before initiating a Backup restore; (5) M365 Backup requires the backup policy to have been active at the time of deletion — it cannot retroactively protect content from before it was enabled.