We want our M365 data stored outside Microsoft, how do we set up cloud-to-cloud backup?

An independent 3rd-party copy outside Microsoft is sensible: against ransomware, an ex-admin with valid rights, or a serious tenant incident. Veeam Backup for Microsoft 365 with a Backblaze B2 target is a common combo.

Try this first

1. 1Install Veeam Backup for M365 on its own VM (Windows Server, dedicated, not on a domain controller). Wire it to the tenant via Azure app registration.
2. 2Create a separate Backblaze B2 bucket with Object Lock. Generate an Application Key with rights only on that bucket. Keep it in a password manager, not in Veeam config.
3. 3Set up a Veeam repository pointing to B2 with Object Lock immutability for, say, 30 or 60 days.
4. 4Create backup jobs for Exchange, SharePoint, OneDrive and Teams. First run is heavy, plan a week or more depending on data volume and bandwidth. Throttle if it eats daytime production.
5. 5Test restore concretely: a mail back, a OneDrive file, a Teams channel message, a full SharePoint site. Untested means broken.
6. 6Plan retention strategy: how long in B2, and which legal duration belongs in M365 retention separately. Backup and retention are two separate questions.

None of the above fits?

Describe your situation below. We pass your input plus the steps you already saw to our AI and return tailored next-step advice. If it's too risky to DIY, we'll say so.