Most businesses assume their email and files are safe once they move to Microsoft 365. Microsoft runs world-class data centers, so it seems reasonable to think everything is backed up. In practice, that assumption causes a lot of painful surprises. Microsoft keeps the service running, but a true Microsoft 365 backup of your business data is something you have to plan for yourself.
This guide explains what Microsoft protects, how long deleted data actually stays recoverable, where the built-in tools fall short, and what a practical backup plan looks like. As a provider of IT services in Glendale, we see these questions come up most often after something has already been deleted.
The Short Answer
Microsoft 365 is highly reliable, but it is not a backup in the traditional sense. Microsoft protects its infrastructure: servers, storage, replication between data centers and service up time. Your data, however, remains your responsibility. If a user deletes a folder, a mailbox is wiped by an attacker, or ransomware encrypts files in OneDrive, Microsoft will generally not restore them for you once the built-in recovery windows have passed.
This is often called the shared responsibility model. Microsoft is responsible for the platform. You are responsible for the content you store in it, who can access it, and how long you can recover it.
What Microsoft Protects and What You Are Responsible For
| Microsoft is responsible for | Your business is responsible for |
|---|---|
| Data center security and hardware | Accidental deletion by users |
| Replication of data across locations | Recovery after ransomware or malware |
| Service availability and up time | Compromised accounts and malicious deletion |
| Platform-level security updates | Data from employees who leave |
| Short built-in recovery windows | Long-term retention and point-in-time restores |
Replication protects against a hardware failure at Microsoft. It does not protect against a change made inside your account. If a file is deleted or encrypted, that change is replicated too, which is why a separate Microsoft 365 backup is needed.
How Long Microsoft 365 Keeps Deleted Data
Microsoft 365 does include recovery features. They are useful, but they are time-limited.
|
What was deleted |
How long it can be recovered (default) |
Source |
|---|---|---|
| Emails permanently deleted in Outlook | 14 days, configurable up to 30 days | Microsoft Learn |
| Files in SharePoint (recycle bin and second-stage recycle bin) | 93 days from deletion | Microsoft Support |
| OneDrive of a deleted user | 30 days, configurable | Microsoft Learn |
After these windows close, the data is permanently removed. Items can also disappear sooner, for example when a recycle bin exceeds its storage quota or an administrator empties it.
Where Built-In Recovery Falls Short
The native tools work well for a file deleted yesterday. They struggle in the situations where a Microsoft 365 backup matters most.
The Problem Is Noticed Too Late
An employee deletes a project folder in June. Nobody needs it until October. By then the 93-day window has passed and the folder is gone.
Ransomware Reaches the Cloud
When ransomware encrypts files on a computer that syncs with OneDrive or SharePoint, the encrypted versions sync to the cloud as well. Version history and OneDrive restore can help, but large-scale recovery is slow and depends on how quickly the attack is discovered. Our guide to the signs your business has been hacked covers what to look for.
A Compromised Account Deletes Data on Purpose
If an attacker gains access to an admin or user account, they can delete mail, files and even recycle bin contents. A backup stored outside the same tenant, with separate credentials, is what protects you in this case.
An Employee Leaves
When a user account is deleted, the person’s OneDrive is kept for 30 days by default. If no one has transferred the files, they are lost after that. This is one reason a written employee IT offboarding checklist matters.
You Need a Point-in-Time Restore
Restoring an entire mailbox, site or set of folders to how it looked on a specific date is difficult with native tools alone. A backup service makes this a routine task.
Retention Policies Are Not a Backup
Microsoft Purview retention policies and litigation holds can keep copies of data for compliance. They are designed to preserve content for legal or regulatory reasons, not to restore your business quickly. Retained items are found through eDiscovery searches, not restored to their original location with a click. Retention is a valuable compliance tool, but it should not replace a Microsoft 365 backup.
Your Microsoft 365 Backup Options
There are two main ways to back up Microsoft 365.
Microsoft 365 Backup
Microsoft now offers its own backup product, sold separately from the standard licenses. It covers Exchange mailboxes, SharePoint sites and OneDrive accounts and is billed by the amount of protected data. Microsoft lists the price at $0.15 per GB per month (Microsoft pricing page). It integrates directly with the admin center and offers fast restores, but the backups stay within the Microsoft ecosystem.
Third-Party Cloud-to-Cloud Backup
Independent backup services copy your Microsoft 365 data to separate cloud storage. They usually offer per-user pricing, long or unlimited retention, granular restores and coverage for additional data such as Teams. Keeping the backup outside Microsoft also protects you if your tenant itself is compromised.
| Microsoft 365 Backup | Third-party backup | |
|---|---|---|
| Where backups are stored | Inside Microsoft’s service | Separate provider storage |
| Typical pricing | Per GB of protected data | Usually per user |
| Coverage | Exchange, SharePoint, OneDrive | Varies; often includes Teams |
| Best fit | Fast restores, simple setup | Independent copy, longer retention |
The right choice depends on your data volume, compliance needs and how much independence you want from a single vendor.
What a Good Microsoft 365 Backup Plan Includes
- Full coverage. Email, OneDrive, SharePoint and, where needed, Teams.
- Separate access. Backup administration uses different credentials from your everyday Microsoft 365 admin accounts.
- Enough retention. At least one year for most businesses, longer if regulations require it.
- Automatic schedule. Backups run several times a day without anyone remembering to start them.
- Tested restores. Someone restores a file, a mailbox and a folder on a schedule to confirm it works.
- Strong account security. Multi-factor authentication on every admin account reduces the chance of malicious deletion.
- A clear owner. One person or IT partner is responsible for monitoring backup reports and alerts.
Quick Microsoft 365 Backup Checklist
- We know how long our deleted email and files can be recovered
- Microsoft 365 data is backed up by a dedicated backup service
- Backups are stored with separate credentials
- Retention covers at least one year
- A restore was tested in the last 90 days
- Departing employees’ data is transferred before accounts are deleted
- Admin accounts use multi-factor authentication
How Techbleed Helps
Techbleed helps businesses set up and monitor Microsoft 365 backup as part of a broader recovery plan. Our backup and disaster recovery service covers cloud platforms as well as servers and computers, and our cloud computing services cover day-to-day Microsoft 365 administration.
For ongoing protection, backups, security and support are included in our managed IT services, so someone is always checking that your data can actually be restored. If you are planning for larger disruptions, our business continuity services connect backup with the rest of your recovery plan.
Not sure whether your Microsoft 365 data is protected? Contact Techbleed for a quick review.
Is Microsoft 365 Backed Up? FAQs
Does Microsoft back up Microsoft 365 data?
Microsoft replicates data to keep the service available, but it does not provide a traditional backup of your content by default. Deleted items can be recovered only within limited windows.
How long does Microsoft 365 keep deleted emails?
Permanently deleted emails are kept for 14 days by default. Administrators can extend this to a maximum of 30 days.
Is OneDrive a backup?
OneDrive syncs files, which is different from backing them up. If a file is deleted or encrypted on a synced computer, the change reaches OneDrive too.
Do small businesses need Microsoft 365 backup?
Yes. Small businesses are often hit hardest by data loss because they have fewer people to rebuild lost work. A backup service costs far less than recreating client files or mailboxes.
