Does Microsoft back up my Microsoft 365 data?
Not in the way most companies assume. Microsoft keeps its service resilient and retains deleted items for limited periods, but under the shared responsibility model your data remains your responsibility, and Microsoft's Services Agreement recommends you regularly back up your content. For protection against ransomware, mass deletion or long-delayed discovery, you need a backup: Microsoft 365 Backup or a third-party product.
What Microsoft does and does not do
Microsoft runs a resilient service with replicated copies of data, so a hardware failure in a Microsoft datacenter should not lose your email. That is availability, not backup of your own mistakes or an attacker's actions.
Microsoft's shared responsibility guidance states that for every cloud deployment type, including SaaS such as Microsoft 365, you own your data and identities and are responsible for protecting them. The Microsoft Services Agreement says Microsoft recommends that you regularly back up your content and data.
The built-in safety nets, and their limits
- Exchange Online: deleted items are kept in the Recoverable Items folder for 14 days by default, configurable up to 30 days
- SharePoint: deleted sites are retained for 93 days, then permanently deleted
- OneDrive: when a user account is deleted, the default OneDrive retention period is 30 days, configurable in the SharePoint admin center
- Retention policies and holds in Microsoft Purview can preserve content for compliance, but they are designed for retention and discovery, not fast bulk restore
Why that is not enough
Those windows are short. If ransomware encrypts a SharePoint library, a departing employee deletes files, or a misconfigured sync overwrites data and nobody notices for months, the native recovery options may have expired or may be too slow at scale.
A real backup gives you point-in-time copies kept for a period you choose, protected from the same admin accounts an attacker might compromise, and a tested way to restore them.
Options: Microsoft 365 Backup or a third party
Microsoft 365 Backup is Microsoft's own product for SharePoint sites, OneDrive accounts and Exchange mailboxes. Microsoft documents a recovery window configurable at 3 months, 6 months, 1 year or 2 years, append-only backup storage, and pay-as-you-go billing based on the data protected rather than per user. Partner applications built on the same storage platform are also available.
Third-party backup products remain common and may cover additional workloads or keep copies outside Microsoft's environment. Whichever you choose, confirm what is covered, especially Teams, and test a restore at least periodically.
What a sound Microsoft 365 backup plan includes
- Coverage of Exchange mailboxes, OneDrive accounts, SharePoint sites and the content behind Teams
- A retention period matched to how long problems might go unnoticed and to legal requirements
- Separation of backup administration from day-to-day admin accounts, with MFA
- Alerts on deletion of backups or changes to backup policies
- Regular, documented test restores with timings
- A written restore procedure your team or provider can follow during an incident
Common follow-up questions
Is the recycle bin a backup?
No. The recycle bins in SharePoint, OneDrive and Exchange are short-term undo features with fixed retention periods. They do not protect against an attacker with admin rights, long-undetected deletions, or the need to restore many sites or mailboxes to a specific point in time.
Do retention policies replace backup?
Not fully. Microsoft Purview retention policies preserve content for compliance and eDiscovery, which helps prevent permanent loss. They are not designed for fast, bulk restoration of sites and mailboxes to an earlier state after ransomware or mass deletion.
How often should we test Microsoft 365 restores?
Test on a regular schedule, such as quarterly, and after major changes. Restore a sample mailbox, a OneDrive and a SharePoint site, record how long it took, and confirm permissions and metadata came back correctly. An untested backup is an assumption, not a control.
LAN Service Group administers and secures Microsoft 365 for small and mid-size businesses as part of its managed IT services, including backup operations and restore testing.
Talk to LAN Service Group (888) 281-7243