When a US MSP gets the 2 a.m. call — a business-email-compromise, a ransomware detonation, a user who emptied a folder — the first decision is not "restore," it is which restore. There are at least three genuinely different operations behind that word, and the one you pick decides what happens to the data already in the mailbox. That is the part people forget until it is too late.
Side-by-side: the safe default
A side-by-side (staging) restore writes the recovered items into a new, clearly labeled folder next to the live data. Nothing that exists is touched. It is the right default for "a user deleted an email last week," and the mode to reach for whenever you are not certain what the live state should be — because it cannot make anything worse. The only cost is a folder to tidy up afterward.
In-place: back into the original location
An in-place restore writes back into the live mailbox: it re-creates what is missing and leaves alone what is still there, so a message that survived is never overwritten. This is what you want when a folder was emptied and you need its contents back in that folder. Two limits are worth knowing: restoring a folder brings back that folder’s own messages, not its subfolders, and a nested folder that no longer exists is not rebuilt in its place. Files follow the same rule with one difference, because a file can change: one that changed since the backup is kept, and the backed-up version is restored beside it under a “(restored YYYY-MM-DD)” name, unless you choose for that restore to replace changed files — the ransomware case — or skip them. Microsoft does not support an app-only replace of a file protected with a sensitivity label, so Replace cannot overwrite those files. Because an in-place restore writes into live data, it sits behind an approval step rather than running on a whim — the person who runs the recovery is not always the person authorized to change production.
Exact-state: the destructive revert
The third mode is the sharp one. An exact-state restore does not only add what is missing — it also removes what was added after the chosen point. That is precisely what a compromise needs, where the problem is not deleted data but injected data, such as messages an attacker planted. It acts on mail items only, so mailbox rules and forwarding settings have to be checked separately. It is also precisely the mode that can destroy legitimate recent mail if pointed at the wrong target.
So it is fenced: it always requires approval, before it runs it shows how many items it would remove along with a sample of them, and it is blocked outright while a legal hold is in force — you cannot quietly revert away data under preservation, which keeps a recovery from becoming a spoliation problem. Removed items are soft-deleted and recoverable, not shredded. The guardrails are not bureaucracy; they are what make a destructive tool safe to hand an operator mid-incident.
Deleted data → side-by-side or in-place. Injected data, i.e. a compromise → exact-state. Unsure which you are dealing with? Start side-by-side: it is the only one of the three that cannot make the situation worse.
The honest physics of point-in-time
Every mode restores from a point in time, and it is worth being precise, because "any point in time" is usually not true. Backups are snapshots on a cadence — as often as every four hours — and a restore always uses one of them: you pick a restore point, shown with the time it was taken, and that backup is what comes back. A restore point, not a time machine. That is the reality every snapshot-based system lives with; reconstructing the exact millisecond between snapshots needs continuous data protection, a different and far heavier mechanism. The honest version is: you restore from the last backup taken before the moment you care about, and you can see exactly when it was taken.
Why naming the three matters
They fail differently. Side-by-side fails safe — worst case, a duplicate folder. Exact-state, misused, fails loud — it deletes live data. A product that collapses them into one button, or hides which one it is running, is making the most consequential decision in the operation on your behalf, silently. Naming the three, gating the dangerous one, and being honest about the granularity of the point you restore to is the difference between recovery and regret.