Microsoft 365 backup: is your data actually backed up?

Most businesses we talk to assume Microsoft 365 backup is something Microsoft just does. Your email and files are in Microsoft's cloud, so surely they're backed up? Not in the way most people think. Microsoft keeps the service running. Getting back a deleted folder, a leaver's mailbox or a OneDrive full of encrypted files is mostly down to you. Here's what Microsoft actually keeps, where the gaps are, and what to put in place.

The short answer

• Microsoft looks after the service. You look after the data. Microsoft's own shared responsibility guidance puts customer data on your side, for Microsoft 365 as much as anything else.
• The built-in safety nets are short. Deleted email is recoverable for 14 days by default (30 at most). SharePoint and OneDrive recycle bins last 93 days. A whole OneDrive can be rolled back 30 days.
• Leavers are the biggest gap. Remove someone's licence and their mailbox data is deleted for good 30 days later.
• Retention policies help, but they aren't a backup. They're for keeping records, not for putting things back quickly.
• If losing your email or shared files would hurt, back Microsoft 365 up separately, with a copy you can restore from a point in time, tested now and then.

Does Microsoft back up Microsoft 365?

Microsoft protects its own platform very well. Its data centres, servers and networks are its problem, and it keeps several copies of your data so a failed disk or building doesn't lose it.

What it doesn't do is protect you from yourselves. Microsoft's shared responsibility article, updated in August 2026, sets out who does what for each kind of cloud service. For software you use over the internet (Microsoft 365 is its own example), it lists customer data, configuration, and identities and users as the customer's job. It says plainly that, whatever type of service you use, you always keep responsibility for your data.

Microsoft's Services Agreement, which covers its consumer services, says the same thing in fewer words: it strongly advises regular backup copies of your content.

So if someone deletes the wrong folder, a laptop syncs ransomware into SharePoint, or an account is wiped after a leaver goes, Microsoft will have faithfully copied that change everywhere. That's what the service is meant to do.

What Microsoft keeps for you, and for how long

Microsoft 365 does have safety nets. They're useful for everyday slips, and it's worth knowing their limits (all figures from Microsoft's own documentation, as of October 2026):

• Email. Deleted items sit in Deleted Items until someone empties it. After that, Exchange Online keeps them in a hidden Recoverable Items folder for 14 days by default. An admin can raise that to 30 days, but no further. Then they're gone.
• SharePoint and Teams files. Deleted files go to the site recycle bin, then a second-stage bin. Either way, they're kept for 93 days from when they were first deleted, then permanently deleted.
• OneDrive. The recycle bin works the same way. Microsoft also lets you restore a whole OneDrive to how it was at any point in the last 30 days, which is its answer to ransomware. A SharePoint site owner can do the same for a shared document library, again within 30 days.
• Version history. SharePoint and OneDrive keep earlier versions of a file, so you can roll back a bad edit. How many versions, and for how long, depends on the limits set, and versions trimmed by those limits skip the recycle bin altogether.
• Leavers. When you remove a licence, Microsoft holds that person's mailbox data for 30 days, then deletes it and it can't be recovered. Delete the user and their OneDrive is kept for 30 days by default (changeable by an admin), then sits in a recycle bin for 93 days. OneDrive accounts left without a licence are archived on their 93rd unlicensed day, and Microsoft says that archived data may be deleted after a year of unpaid storage.

The pattern is the same everywhere: a few weeks, at most a few months. That covers "I deleted it yesterday". It doesn't cover "we only noticed in the spring".

What can actually go wrong?

These are the situations we see, and none of them is unusual:

• Accidental deletion. Someone tidies up a shared folder, or deletes a mailbox folder with Shift+Delete. Microsoft notes that a folder deleted that way is gone, even though its contents can be recovered for a short time.
• Ransomware. Ransomware on one laptop encrypts the files it can reach. If they're synced with OneDrive or SharePoint, the encrypted versions sync to the cloud too. Version history and OneDrive restore may get you back, if you act within the window and nothing has trimmed the versions.
• A departing or unhappy member of staff. Someone deletes files or email on the way out. If nobody looks for a month, the recycle bins may already have run out.
• A compromised account. An attacker who gets into a mailbox or an admin account can delete data and empty the bins themselves. A backup held separately, with its own sign-in, is out of their reach.
• Leavers' licences removed too soon. A manager cancels a licence to save money, and 30 days later the mailbox, including the client correspondence, is gone.

Retention policies vs backup: what's the difference?

Microsoft 365 has retention policies (part of Microsoft Purview, its compliance tools). They stop content being permanently deleted for a set time, and keep a copy in hidden places such as a site's Preservation Hold library, where it can be found with eDiscovery search tools.

That's useful, especially if you have to keep records for a set number of years. But it's built for compliance, not for getting back to work:

• you search for and recover items one at a time, rather than restoring a mailbox or site as it was last Tuesday;
• retained copies count against your storage;
• the copies still live in the same Microsoft 365 tenancy (your organisation's own Microsoft 365 space), run by the same admin accounts.

Retention is about keeping what you must. A backup is about putting things back quickly. Many businesses need both.

What a proper Microsoft 365 backup gives you

A good backup takes its own copy of your mailboxes, OneDrive accounts, SharePoint sites and Teams files every day (or more often). It keeps them for as long as you choose, usually a year or more, and lets you restore anything from any of those points: one email, one file, a whole mailbox or a whole site.

Whatever backup you use, check what it covers. Teams chat messages, for example, are handled differently from Teams files, and not every backup includes them.

Do I need to back up Microsoft 365? A quick checklist

1. Ask what would hurt to lose. Client emails, shared folders, accounts files, a leaver's correspondence. If the honest answer is "a lot", you need a backup.
2. Find out what you have now. Many businesses think a backup is running and find out otherwise when they need it.
3. Check your deleted email setting. Raise Exchange Online's deleted item retention from 14 days to the 30-day maximum. It costs nothing.
4. Set a leavers routine. Back up or convert a leaver's mailbox to a shared mailbox, and give someone their OneDrive files, before anyone removes the licence.
5. Turn on multi-factor authentication for every account, especially admins, so a stolen password isn't enough to delete your data.
6. Choose a backup that covers mail, OneDrive, SharePoint and Teams, keeps copies outside Microsoft 365, and holds them for long enough (a year is a sensible minimum).
7. Test a restore. Pick a file and a mailbox and bring them back. A backup nobody has ever restored from is a hope, not a plan.
8. Write down who to call. When something goes, you want to know the next step without searching for it.

How we can help

We back up Microsoft 365 mail, OneDrive and SharePoint with our own Acronis backup service, part of our backup and disaster recovery service. Off-site copies are kept in our own data centre, with a further copy at a separate disaster-recovery site. We monitor the backups and run test restores so we know they work. Server and workstation backup starts from £25 +VAT a month. For Microsoft 365 backup, ask us and we'll talk you through what it covers and price it for your setup.

If your Microsoft 365 needs a tidy first, from leavers' licences to sharing settings, we can do that too. Our guide to Copilot for small businesses covers why checking who can see what is worth doing anyway. Get in touch and we'll tell you honestly what you've got and whether it's enough.