Does Microsoft Back Up Your 365 Data?

It’s one of the most common assumptions we come across: “Our email and files are in Microsoft 365, so Microsoft backs them up.” It’s an understandable belief, and partly true. Microsoft keeps the service extremely reliable. But protecting your data from deletion, mistakes and malicious changes is largely down to you.

This guide explains where Microsoft’s responsibility ends, what its built-in recovery options cover, and when a separate backup makes sense.

What Microsoft looks after

Microsoft works on a shared responsibility model. It is responsible for the service itself: its data centres, hardware, replication between sites and keeping Microsoft 365 available. If a Microsoft server fails, your data is safe, because it’s stored in more than one place.

What Microsoft doesn’t do is keep a separate, long-term copy of your data that you can restore from whenever you need to. If something is deleted, overwritten or encrypted inside your account, those changes are faithfully replicated too.

What the built-in recovery options cover

Microsoft 365 does include some safety nets, and they’re genuinely useful for everyday mistakes:

Deleted emails go to Deleted Items, then to a recoverable items area, kept for 14 days by default. Admins can extend this to 30 days.
Deleted files in OneDrive and SharePoint go to a recycle bin and can be restored for up to 93 days.
Version history lets you roll a file back to an earlier version.
Leavers’ data: when a user is deleted, their mailbox and OneDrive are kept for a limited period, 30 days by default, before being permanently removed.

These features are designed to undo recent mistakes. They aren’t designed to be a backup.

Where the gaps are

The built-in options fall short in a few common situations:

Problems found late. Someone deletes a folder of client files and nobody notices for four months. The recycle bin has long since emptied.
Ransomware or malicious changes. If files are encrypted or altered through a compromised account, the changes sync everywhere, and restoring hundreds of files one version at a time isn’t practical.
Departed staff. A leaver’s mailbox or OneDrive is deleted when their licence is removed, and the data is gone a month later.
Restoring a point in time. There’s no simple way to say “put this SharePoint site back to how it was last Tuesday”.
Contractual or regulatory retention. If you need to keep records for a set number of years, recycle bins aren’t a reliable way to do it.

Your backup options

There are two main approaches:

Microsoft 365 Backup, Microsoft’s own paid backup service, which takes regular restore points of Exchange, OneDrive and SharePoint within Microsoft’s cloud.
A third-party backup service, which copies your Microsoft 365 data to separate storage outside your Microsoft account, with its own retention rules and access controls.

Either is a big step up from relying on recycle bins. Whichever you choose, look for:

Coverage of email, OneDrive, SharePoint and Teams
Retention that matches your needs, often a year or more
Quick restores of a single file or a whole mailbox
Separate credentials, so a compromised Microsoft account can’t delete the backups
Regular test restores, so you know it works before you need it

Backup is only half the job

A backup is only valuable if you can restore from it quickly. That’s why we test restores, not just check that backups ran. It’s also worth thinking beyond Microsoft 365: line-of-business systems, any local servers and laptops with files saved outside OneDrive all need a plan too.

How we can help

We look after backup and disaster recovery for businesses and charities across London and Hertfordshire, including Microsoft 365 backup with regular test restores. If you’d like to know what you could recover today, and what you couldn’t, get in touch or call 0203 8833 444.

See how we look after IT for small and medium businesses.