Many organizations assume Microsoft backs up everything in Microsoft 365. Microsoft does keep the service running and replicates data, but it does not give you full point-in-time backup under your control. If a user deletes a site, ransomware encrypts OneDrive or an admin removes a mailbox, recovery options are limited and time-bound.
This guide explains what Microsoft 365 protects by default, where the gaps are and how to build a Microsoft 365 backup strategy that actually works.
The Shared Responsibility Model
| Microsoft is responsible for | You are responsible for |
|---|---|
| Data centre and infrastructure availability | Protecting data from deletion and corruption |
| Replication and hardware failure | Recovering from ransomware and malicious insiders |
| Service uptime | Meeting your own retention and recovery targets |
| Platform security | Identity, access and configuration security |
What Microsoft 365 Keeps by Default
| Workload | Default recovery window | Notes |
|---|---|---|
| SharePoint and OneDrive files | Up to 93 days in recycle bins | Version history helps with recent edits |
| Exchange deleted items | 14 days (extendable to 30) | In Recoverable Items folder |
| Deleted users and mailboxes | 30 days soft delete | Then permanently removed |
| Teams chats and files | Depends on Exchange and SharePoint | Channel files live in SharePoint |
These windows are useful but short. Problems are often noticed months later.
Why Retention Policies Are Not Backup
Microsoft Purview retention policies keep content for compliance. They help with legal and audit needs, but restoring a whole site or thousands of mailboxes from retention is slow and manual. Use retention for compliance and backup for recovery. Learn more about data classification and retention policies.
Top Risks That Need Real Backup
- Ransomware encrypting synced OneDrive files.
- Accidental or malicious deletion by users or admins.
- Departed employees whose mailboxes and OneDrive were deleted too early.
- Sync or migration errors overwriting good data.
- Compromised admin accounts deleting data at scale.
Microsoft 365 Backup Options
| Option | Strengths | Consider |
|---|---|---|
| Microsoft 365 Backup (native) | Data stays in Microsoft cloud, fast restores | Consumption-based billing, check workload coverage |
| Third-party SaaS backup | Separate copy, broad features | Data location and vendor due diligence |
| Retention policies only | Included in many licences | Not designed for bulk recovery |
A 6-Step Microsoft 365 Backup Strategy
- Define RPO and RTO for mail, files and Teams.
- Choose a backup tool that meets them and your data residency needs.
- Protect backup admin accounts with MFA and least privilege.
- Back up all users, including shared mailboxes and sites.
- Test restores every quarter.
- Document the recovery runbook and owners.
For server and Azure workloads, see Azure backup and disaster recovery explained.
Prevention Still Matters
Backup is your last line of defence. Strong identity controls, DLP and Defender reduce the chance you need it. Track progress with Microsoft Secure Score and protect sensitive data with Purview DLP.
Protect Your Microsoft 365 Data
M365 Enterprise Hub designs backup and recovery for Microsoft 365 and Azure across the UAE and Saudi Arabia. Explore our cloud backup and disaster recovery services, or compare support models in in-house vs managed Microsoft 365 administration. Book a free backup review.
Frequently Asked Questions
Does Microsoft back up Microsoft 365 data?
Microsoft keeps the service available and replicates data across data centres, but that is not the same as point-in-time backup you control. Under the shared responsibility model, protecting against deletion, ransomware and long-term loss is mainly your job.
How long can I recover deleted files in SharePoint and OneDrive?
Deleted items stay in the recycle bins for up to 93 days in total. After that they are permanently removed unless a retention policy keeps them.
How long can I recover deleted emails?
By default, items in Recoverable Items are kept for 14 days, which admins can extend to 30 days. Retention policies or litigation hold can keep them longer.
Are retention policies the same as backup?
No. Retention policies preserve content for compliance, but restoring large amounts of data from them is slow and limited. Backup is designed for fast, point-in-time recovery.
What is Microsoft 365 Backup?
Microsoft 365 Backup is a Microsoft service that backs up Exchange Online, SharePoint and OneDrive within the Microsoft cloud, billed on consumption. Third-party backup tools are also widely used.
Do we need backup if we have Microsoft 365 E5?
Usually yes. E5 adds strong security and compliance, but it does not replace a tested backup and restore process for ransomware or mass deletion.
How often should we test restores?
At least quarterly for critical mailboxes and sites, and after any major change to your backup setup.