Does Microsoft 365 Back Up Your Data? Not Quite

Many businesses assume that because their email, files and Teams chats live in Microsoft 365, they are automatically backed up. It is an understandable belief. The data is in the cloud, Microsoft runs enormous data centres, and nothing has gone wrong yet.

The reality is more nuanced. Microsoft is responsible for keeping the service available. You are responsible for your data. Understanding that difference is one of the cheapest risk reductions a business can make.

Availability is not the same as backup

Microsoft builds in redundancy so that a hardware failure in one data centre does not take your mailbox offline. That protects you from Microsoft's problems.

It does not protect you from yours. If someone deletes a SharePoint library, a departing employee wipes their OneDrive, or ransomware encrypts synced files, Microsoft's infrastructure will faithfully replicate the damage. A copy of a mistake is still a mistake.

This is what the shared responsibility model means in practice. Microsoft secures and operates the platform. You own the content, the access to it, and the ability to recover it.

Where the built-in protection runs out

Microsoft 365 does include useful recovery features, and you should know their limits before you rely on them.

• Recycle bins and retention windows. SharePoint and OneDrive deleted items sit in recycle bins for a limited period, commonly 93 days across both stages. After that, they are gone.
• Exchange recoverable items. Deleted email can usually be recovered for a short window, 14 days by default and configurable to a maximum of 30. That is not long when a deletion goes unnoticed.
• Version history. Helpful for rolling back a single document, but slow and manual across thousands of files.
• Retention policies and litigation hold. These are compliance tools, not backup. They preserve data for legal purposes, but they are not designed for fast, granular restore.

Check the current figures for your own licences and settings, as these defaults can differ by plan and by configuration.

The scenarios that catch businesses out

The failures we see discussed most often are rarely dramatic. They are quiet and slow to surface.

Accidental or malicious deletion

A site owner removes a team site that "nobody uses". An unhappy leaver deletes a shared folder on their last day. Nobody notices for three months. The retention window has closed.

Ransomware in synced files

Ransomware does not need to attack Microsoft. It encrypts files on a laptop, OneDrive syncs the encrypted versions to the cloud, and the clean copies are overwritten. Version history can help, but restoring at scale is painful. Our piece on why ransomware defence is a stack, not a single product explains why recovery has to be part of the plan, not an afterthought.

Compromised accounts

An attacker who takes over an account can delete mail, empty folders and purge items on the way out. If you have not tightened your tenant, that risk is higher than it needs to be. We cover the basics in Microsoft 365 security beyond the defaults.

Licence changes and leavers

When a user licence is removed, their mailbox and OneDrive can be deleted after a grace period. Offboarding without a data plan quietly destroys business records.

What a sensible Microsoft 365 backup looks like

You do not need a complicated programme. You need a few properties that are easy to state and surprisingly easy to miss.

1. Independent of your tenant. Backups should be stored outside the Microsoft 365 account an attacker or a mistaken admin could reach, ideally with separate credentials and immutable storage.
2. Covers the workloads you actually use. Exchange mailboxes, OneDrive, SharePoint and Teams data. Check what is in scope rather than assuming.
3. Frequent enough for your tolerance. Decide how much recent work you can afford to lose, then match the backup frequency to it. This is the same thinking behind RTO and RPO.
4. Granular restore. Getting one mailbox, one folder or one site back should take minutes, not a support ticket and a weekend.
5. Tested. A backup you have never restored is a hope, not a control. Run a restore test on a schedule and record the result.

Questions worth asking this week

You can learn a lot in an hour with a few honest questions:

• Who in the business can delete a SharePoint site or a shared mailbox, and would we notice if they did?
• How long is our retention window, and have we confirmed that against our own tenant settings?
• If our entire OneDrive were encrypted tonight, what would we restore from, and how long would it take?
• When did we last test a restore, and who signed it off?

If the answers are vague, that is useful information. It is far better to find the gap on a quiet Monday than during an incident.

A quiet takeaway

Microsoft 365 is a dependable platform, and nothing here is a reason to doubt it. The point is simply that "in the cloud" and "backed up" are different statements. Independent backup for your 365 data is a modest cost compared with the time lost rebuilding records, and it supports the wider continuity thinking in our backup and disaster recovery work.

If you would like a second pair of eyes on how your Microsoft 365 data would be recovered today, that is a conversation we are always glad to have.