Does Microsoft 365 back up your data? What Microsoft actually covers

Most business owners assume that because Microsoft 365 lives in the cloud, Microsoft must be backing it up. Microsoft is certainly protecting the service. It is not, however, protecting your data from the everyday causes of loss: a deleted mailbox, a wiped SharePoint library, an ex-employee's OneDrive, or a ransomware infection that syncs encrypted files to the cloud. This article explains exactly what Microsoft covers, where the gaps are, and what a sensible UK SME does about them.

Shared responsibility: what Microsoft protects and what you protect

Microsoft runs its cloud services on a shared responsibility model, and it publishes that model openly on Microsoft Learn. In short, Microsoft is responsible for the infrastructure: the datacentres, the hardware, the network, and the availability of Exchange Online, SharePoint Online, OneDrive and Teams. You are responsible for your data, your identities, your devices and how your people use the service.

That split matters for backup. Microsoft keeps multiple synchronised copies of your mailbox and files across datacentres so that a disk or server failure does not take the service down. That is resilience, and it is very good. It is not a backup, because every copy is live and every copy changes the moment a user deletes, overwrites or encrypts something.

Microsoft's own Services Agreement is candid about this. It states that all online services suffer occasional disruptions and that Microsoft recommends you regularly back up the content and data you store on its services. That wording applies to Microsoft's consumer terms, and the commercial Product Terms for business subscriptions do not add a backup guarantee either.

What Microsoft 365 does keep, and for how long

The built-in protection is a set of retention windows. They are useful, and for many small mistakes they are enough, but each one has a hard edge. The defaults below are documented in the Microsoft 365 documentation and can be changed by an administrator within the limits shown.

Two things stand out. First, nothing here is held for longer than about three months by default. Second, every one of these windows lives inside the same tenant, controlled by the same administrator accounts. If an administrator account is compromised, or an administrator makes a mistake, the recycle bins go with it.

Version history helps, up to a point

SharePoint and OneDrive keep previous versions of documents, with a default of 500 major versions per file. Version history is excellent for undoing a bad edit. It is weaker against ransomware, because some strains rewrite a file hundreds of times to exhaust the version limit, and it does nothing for a file that has been deleted and then purged from the recycle bins.

Where the retention windows fail in practice

The scenarios below are the ones that generate most of the data-loss calls Dig IT receives from Hertfordshire and London businesses.

• The leaver whose account was deleted properly. A finance assistant leaves in March. Their account is deleted as part of a tidy offboarding. In June, HMRC asks a question about a supplier email chain that only they handled. The mailbox was purged after 30 days. Nobody did anything wrong, and the data is still gone.
• The SharePoint clean-up that went too far. Someone tidies a shared library, deletes a folder that "nobody uses", and empties the recycle bin to free up storage. Four months later a client asks for the original signed contract. Nothing in Microsoft 365 can bring it back.
• Ransomware that syncs. A laptop is infected. The OneDrive sync client does exactly what it is designed to do and uploads the encrypted versions to the cloud, where they replicate to every other synced device. Files Restore can roll back 30 days, but only if you notice in time and only for OneDrive, not for a mapped SharePoint library or Teams files that were also touched.
• The compromised admin. An attacker with global administrator rights can delete users, purge recycle bins, remove retention policies and change the retention settings in the same session. Everything in the table above is under their control.
• The gradual discovery. A spreadsheet was corrupted or overwritten in a way nobody noticed for a year. Version history will not reach that far, and the recycle bin never held it in the first place.

None of these are exotic. They are the ordinary consequences of people using a shared system every day.

Retention policies are not the same as backup

Microsoft Purview retention policies, available on Business Premium and the enterprise plans, let you say "keep all email for seven years" or "keep this SharePoint site's content for the life of the contract". Content under a retention policy cannot be permanently deleted by users during that period, and it can be found through eDiscovery.

That is a compliance tool, and for a law firm or an accountancy practice it is a sensible one. It is still not a backup, for three reasons:

1. The data stays in the same tenant, so a tenant-level problem, a subscription lapse or a compromised administrator still affects it.
2. Restoring from retained content is a search-and-export process, not a "put this user's mailbox back the way it was on Tuesday" operation.
3. Retention protects against deletion, not against corruption, bad sync or a bulk change that rewrites content in place.

For UK firms with regulatory retention duties, the practical answer is usually both: a retention policy for compliance, and a separate backup for recovery. The ICO's guidance on keeping personal data secure expects organisations to be able to restore access to personal data in a timely manner after an incident, which is a recovery question, not a retention question.

What a third-party Microsoft 365 backup adds

A proper backup service for Microsoft 365 connects to your tenant with its own credentials and takes a copy of Exchange, OneDrive, SharePoint and Teams data on a schedule, usually several times a day. That copy is stored outside your tenant, typically in a separate cloud region or with the backup vendor, and is retained for as long as you choose.

The practical differences from the built-in tools are:

• Point-in-time restore. You can bring back a mailbox, a folder, a single file or an entire SharePoint site as it was on a specific date, months or years ago.
• Independence from the tenant. A compromised administrator, a deleted user, an expired licence or a Microsoft outage does not affect the backup copy.
• Ransomware recovery. Because the backup holds historical versions outside the sync path, you can restore clean files from before the infection without hunting through 500 versions of each document.
• Retention on your terms. Seven years for accounts, indefinitely for signed contracts, or whatever your insurer, regulator or client requires.
• Leaver data without keeping a licence. Retire the account, keep the backup, and search it later without paying for a mailbox nobody uses.

Microsoft has itself started selling a consumption-based Microsoft 365 Backup product, separate from the standard licences. Its existence is the clearest possible confirmation that backup is not something you already have. Whether you choose Microsoft's product or an independent vendor, the point is that it must be a deliberate, paid, configured decision.

The 3-2-1 backup rule still applies in the cloud: three copies of your data, on two different platforms, with one held separately from the others. Microsoft's replicas count as one copy on one platform.

How this fits a wider backup strategy

Microsoft 365 is rarely the only place a business keeps data. Accounting software, a practice management system, a CRM, a file server or an on-premise application often sit alongside it, and each needs its own answer.

Mr Plant Hire, the Enfield-based plant and tool hire business Dig IT has supported for over 15 years, is a typical hybrid. Their depots share documents across companies through Microsoft 365 and SharePoint, while Windows servers still run core systems on site. Those servers are protected with both local and cloud backup, and the Microsoft 365 data is backed up separately. The result is that whichever layer fails, there is a copy somewhere that did not.

That layered approach is what Dig IT builds through its backup and disaster recovery service: one plan that covers servers, endpoints and cloud data, with restores tested rather than assumed. The Microsoft 365 backup service is the cloud piece of that plan, and it pairs naturally with the security hardening covered in the Microsoft 365 security settings checklist, because a well-secured tenant is less likely to need the backup in the first place.

A quick self-check for business owners

Ask your current IT provider, or yourself, these five questions. If any answer is "I'm not sure", you have found the gap.

1. If a member of staff deleted an important folder from SharePoint six months ago and emptied the recycle bin, could we get it back today?
2. When someone leaves, what happens to their mailbox and OneDrive after 30 days, and who decided that?
3. If ransomware encrypted a laptop and synced to OneDrive, how far back could we restore, and who would do it?
4. Where is our Microsoft 365 backup stored, and is it outside our tenant?
5. When was a restore last tested, and how long did it take?

What to do next

If you cannot answer those five questions with confidence, the quickest fix is a short review of your tenant's retention settings, your offboarding process and your backup coverage. Dig IT runs this as part of an IT health check for businesses across Hertfordshire, west Essex and London, and it usually takes less than a day to close the gap once you know where it is.