Does Microsoft back up your Microsoft 365 data?

Most business owners assume that because their email and files live in Microsoft 365, Microsoft has a copy of everything forever. That assumption causes real pain when a staff member deletes a folder, a mailbox is wiped, or ransomware encrypts a shared library. This article explains what Microsoft actually protects, where the built-in safety nets stop, and what a separate backup adds.

The shared responsibility model

Microsoft publishes a shared responsibility model for its cloud services. Microsoft looks after the physical data centres, the network and the software that runs the service. Some responsibilities never move to Microsoft, whatever kind of cloud service you use. According to Microsoft Learn, you always keep responsibility for:

• Your data, including how it is classified and protected.
• Endpoints, meaning the laptops, desktops and phones that access the service.
• Accounts, including creating, managing and removing user access.
• Access management, such as multifactor authentication and conditional access policies.

In plain terms: Microsoft keeps the service running. Keeping your data recoverable is your job.

What Microsoft does do

Microsoft states that OneDrive, SharePoint and Exchange Online are designed for resiliency, with replicated copies of customer data so the service can fail over if hardware fails. That protects against Microsoft's own outages. It does not protect you from your own users, a compromised account or a malicious insider, because a deletion or encryption made through a valid account is copied faithfully to every replica.

The built-in safety nets and their limits

Microsoft 365 has several recovery features. They are useful, and they all have time limits.

SharePoint and Teams files

Deleted files go to the site recycle bin, then to a second-stage (site collection) recycle bin. Microsoft Learn says items are kept for 93 days in total from the time they were deleted. The two stages share that one 93-day window. Items can be purged earlier if the site collection recycle bin exceeds its quota or an administrator empties it. Beyond that, SharePoint keeps backups for 14 more days, but a restore through Microsoft Support applies to a whole site collection, not individual files or libraries.

OneDrive

For work or school accounts, Microsoft Support says you can restore files deleted within the last 93 days, unless an administrator has changed that setting. The "Restore your OneDrive" feature can roll an entire OneDrive back to a point within the last 30 days, which helps after a mass deletion or ransomware on a single user.

When a user account is deleted, their OneDrive is kept for a default retention period of 30 days, which an administrator can change. After that, the files are on their way out. Many businesses only discover this months after a staff member leaves.

Exchange Online email

Once an item is deleted from the Deleted Items folder, it moves to the Recoverable Items folder. Microsoft Learn states the default deleted item retention period is 14 days, and it can be increased to a maximum of 30 days. After that, the email is gone unless a retention policy or hold is in place.

Why a separate backup matters

Retention windows only help if someone notices the problem in time. Common situations where they fall short:

• A former employee's mailbox or OneDrive is needed after the retention period has expired.
• A file was deleted months ago and the loss is only discovered at tax time or during a dispute.
• An attacker takes over an administrator account and deletes data, empties recycle bins and changes retention settings.
• Ransomware encrypts synced files and the damage is spotted after the 30-day OneDrive restore window.
• Someone overwrites a shared spreadsheet and nobody notices for weeks.

The Australian Signals Directorate (ASD) addresses this directly in its small business cloud guidance on regular backups. It says Microsoft 365's built-in capabilities "are not sufficient to recover from many cyber security incidents", because an attack involving a compromised administrator can bypass versioning, recycle bins and retention policies. ASD recommends a third-party backup solution that creates an offline copy of organisational data, covering Exchange, SharePoint, OneDrive and Teams.

Microsoft also sells its own Microsoft 365 Backup service. Microsoft Learn describes it as a pay-as-you-go offering billed on consumption, separate from user licences, and nothing is protected until an administrator creates backup policies. Whichever tool you use, the point is the same: backup is something you set up deliberately. It does not come with the licence.

What a good Microsoft 365 backup looks like

Use this list to judge your current setup, or to question your I.T. provider:

• Coverage: every mailbox, OneDrive, SharePoint site and Teams site, including shared mailboxes. New staff are added automatically.
• Retention: long enough to match how far back you might realistically need to go, including for departed staff.
• Separation: stored outside your Microsoft 365 tenant, so a compromised admin account cannot delete both the data and the backup. ASD's guidance says unprivileged accounts should not be able to modify or delete backups.
• Testing: restores are tested on a schedule. ASD advises testing the entire backup, not just a spot check of a few files.
• Granular restores: you can bring back one email, one file or one folder without rolling back everything else.
• Configuration: ASD also suggests backing up your tenant configuration, so security settings and policies can be rebuilt after an incident.
• Monitoring: someone checks backup job reports and acts on failures.

On our Advanced Defence and Total Fortress plans, Black Wolf backs up Microsoft 365 with Cove Data Protection, held outside the Microsoft tenant, and test restores are part of the routine.

Quick checklist

1. Confirm in writing whether your Microsoft 365 data is backed up by a separate tool, and where the copies are stored.
2. Check that shared mailboxes, SharePoint and Teams are included, not only user mailboxes.
3. Find out what happens to a departing employee's mailbox and OneDrive, and for how long.
4. Ask when a restore was last tested, and what was restored.
5. Make sure administrator accounts use multifactor authentication and that the backup system has separate credentials.
6. Treat the recycle bin and retention windows as a convenience for quick fixes. Your backup is what you rely on when things go badly wrong.