Microsoft 365 protects your data in several ways, but that does not mean every Microsoft 365 subscription automatically includes a complete, separately managed backup. Built-in recovery, retention and versioning features can help in many situations, while an additional backup service may be needed for longer retention, faster restoration and stronger protection against widespread deletion or compromise.
The right approach depends on the information your business stores, how long it must be retained and how quickly it would need to be restored following an incident.
Does Microsoft 365 include backup?
The most accurate answer is: Microsoft 365 includes several data-protection and recovery features, but these are not always equivalent to a dedicated backup service.
Microsoft protects the availability and resilience of its cloud infrastructure. Microsoft 365 also provides features such as:
- Deleted-item recovery for Exchange Online
- Recycle bins for SharePoint and OneDrive
- File version history
- Retention policies and retention labels
- Deleted-user and deleted-site recovery windows
- Service-level data resilience
Microsoft also offers a separate service called Microsoft 365 Backup, which provides backup and restore capabilities for Exchange Online, OneDrive and SharePoint.
Whether your business needs Microsoft 365 Backup or another separate backup platform depends on whether the standard recovery and retention features satisfy your operational, contractual and regulatory requirements.
Recovery, retention and backup are not the same thing
These terms are often used interchangeably, but they serve different purposes.
Recovery features
Recovery features allow users or administrators to restore recently deleted emails, files, accounts or sites within the limits provided by Microsoft 365.
Retention policies
Retention policies and labels are primarily used to preserve or delete information according to business, legal or compliance rules. They can retain content even after users delete it, but they are not necessarily designed to provide the simplest or fastest operational restore experience.
Backup
A backup service creates protected recovery points and provides a defined method for restoring information following deletion, corruption, ransomware or another disruptive event.
A well-designed backup arrangement should make clear:
- Which users, mailboxes, sites and files are protected
- How frequently recovery points are created
- How long backups are retained
- Who can delete or alter backup policies
- How quickly information can be restored
- Whether individual items and complete accounts can both be recovered
- How restoration is tested
What happens when an Exchange Online email is deleted?
When a user deletes an email, it normally moves into the Deleted Items folder. If it is deleted again, it may remain temporarily available through the Recoverable Items area.
The default deleted-item retention period in Exchange Online is 14 days. An administrator can increase this to a maximum of 30 days.
Retention policies, litigation holds and other Microsoft Purview controls can preserve information for longer where they have been configured appropriately.
However, businesses should not assume every deleted email remains recoverable indefinitely. Once the relevant recovery and retention periods have expired, standard restoration options may no longer be available.
Microsoft explains the process in its documentation on the Recoverable Items folder in Exchange Online.
What happens when a SharePoint or OneDrive file is deleted?
SharePoint and OneDrive provide recycle-bin and version-history functionality that can help recover recently deleted or altered files.
Version history may allow an earlier version of a document to be restored after accidental editing, corruption or unwanted changes.
Recycle-bin recovery is useful, but it remains time-limited. It can also become less practical when thousands of files have been changed or deleted across several sites.
Deleted SharePoint sites are retained for 93 days before permanent deletion. User OneDrive retention follows a separate process when a user account is removed, and the organisation should confirm how long former employees’ data will remain available.
Microsoft documents the lifecycle of deleted content in its guidance on SharePoint data deletion and OneDrive retention and deletion.
Why built-in recovery may not be enough
Microsoft 365 recovery features are valuable, but businesses should consider how they would cope with incidents that affect large amounts of information rather than one recently deleted item.
Accidental mass deletion
An employee may delete or move an entire folder structure, SharePoint library or mailbox collection rather than one document. Recovering each item manually can become slow and disruptive.
Ransomware and synchronised file changes
If ransomware encrypts files on a connected computer, those changes may synchronise into OneDrive or SharePoint. Version history can help, but the organisation still needs a practical way to identify the affected recovery point and restore large quantities of information.
Compromised administrator access
An attacker with powerful administrator permissions may be able to alter retention settings, delete accounts or interfere with ordinary recovery options.
Backup administration should therefore be protected carefully, with strong authentication, restricted permissions and clear monitoring.
Malicious or deliberate deletion
A departing employee or compromised account may intentionally remove files, email or other business records. The deletion may not be discovered until after an ordinary recovery window has expired.
Incorrect retention configuration
Retention policies are powerful but can be complicated. An incorrect rule may preserve information for less time than expected or delete it according to a schedule the business did not intend.
A deleted employee account
When an employee leaves, their mailbox and OneDrive data need to be transferred, retained or backed up according to a documented process.
Removing the licence or deleting the user without first reviewing their data can create unnecessary recovery pressure later.
What is Microsoft 365 Backup?
Microsoft 365 Backup is Microsoft’s dedicated backup and recovery service for Exchange Online, OneDrive and SharePoint.
It allows organisations to configure backup policies and restore protected data from available recovery points.
Supported restoration options include:
- Exchange mailbox restoration
- Full OneDrive account restoration
- Full SharePoint site restoration
- Selected file and folder restoration
- Restoration from defined recovery points
Microsoft states that backup data remains within the protected Microsoft 365 services’ data boundaries, supporting fast recovery without moving the information into a separate external platform.
Microsoft provides further details in its Microsoft 365 Backup overview.
Microsoft 365 Backup or a third-party backup service?
Microsoft 365 Backup is not the only option. Several third-party services also provide Microsoft 365 backup and recovery.
When comparing solutions, consider:
- Which Microsoft 365 workloads are supported
- Backup frequency and available recovery points
- Retention options
- Granular and full-account restoration
- Restore speed
- Data location and contractual requirements
- Administrative security and role separation
- Monitoring and failed-backup alerts
- Search and eDiscovery capabilities
- Pricing structure
- Support during a large-scale recovery
The best product is not necessarily the one with the longest feature list. It is the one that matches the organisation’s recovery objectives and can be managed reliably.
What Microsoft 365 data should be protected?
A business should begin by identifying the Microsoft 365 information it could not operate without.
This may include:
- Employee and shared mailboxes
- OneDrive accounts
- SharePoint document libraries
- Files used through Microsoft Teams
- Customer and project records
- Financial information
- Contracts and legal documents
- Operational procedures
- Management and board information
- Departed employees’ business records
Teams content can be stored across several underlying Microsoft 365 services, including SharePoint, OneDrive and Exchange. Backup coverage should therefore be confirmed at the workload and data-type level rather than assuming “Teams is backed up” as one single item.
How long should Microsoft 365 backups be retained?
There is no single retention period suitable for every business.
The decision should consider:
- How quickly accidental deletion is normally noticed
- Legal and regulatory obligations
- Customer and supplier contracts
- How long former employees’ information is required
- The organisation’s tolerance for data loss
- The cost of longer retention
- Whether historical versions may be needed during disputes or investigations
Long retention is not automatically better. Retaining information indefinitely can increase cost, complexity and legal exposure. Backup and retention periods should follow an approved business policy.
How often should Microsoft 365 backups run?
Backup frequency should reflect how often the information changes and how much recent work the organisation could afford to lose.
For example, a mailbox or SharePoint library that changes throughout the working day may require more frequent recovery points than an archive that changes only occasionally.
Businesses should define two practical objectives:
- Recovery point objective: how much recent data the business could afford to lose
- Recovery time objective: how quickly the information needs to be available again
These requirements should guide the backup service, frequency and restoration process.
Microsoft 365 backup checklist
Use the following questions to review your current arrangements:
- Which mailboxes, OneDrive accounts and SharePoint sites are protected?
- Are new users and sites added automatically?
- How often are recovery points created?
- How long are backups retained?
- Who receives failed-backup alerts?
- Can individual emails and files be restored?
- Can an entire mailbox, OneDrive or SharePoint site be restored?
- How quickly could a large-scale restore be completed?
- Who has permission to change or delete backup policies?
- Is backup access protected by MFA?
- When was restoration last tested?
- Is the backup arrangement documented in the business continuity plan?
Backup should form part of business continuity
Backup is only one part of recovery.
The business must also consider:
- How employees will work while information is unavailable
- Who will declare and manage an incident
- How compromised accounts will be secured
- Which information should be restored first
- How customers and suppliers will be informed
- Whether legal, insurance or regulatory support is required
- How restored information will be checked before normal work resumes
A successful technical restore may still leave the business unable to operate if priorities, responsibilities and communication arrangements have not been agreed.
How Secure IT can help
Secure IT helps businesses review Microsoft 365 protection, configure backup services, monitor backup status and plan how essential information would be recovered.
The review should cover the Microsoft 365 licence, retention settings, user lifecycle, backup platform, recovery objectives and wider business continuity requirements.
For related guidance, read our article on Microsoft 365 security settings every business should review.
Contact the Secure IT team to discuss Microsoft 365 backup, recovery and business continuity.
Frequently asked questions
Does Microsoft automatically back up Microsoft 365?
Microsoft provides infrastructure resilience and built-in recovery and retention capabilities. It also offers Microsoft 365 Backup as a separate service. Businesses still need to configure and manage the protection that meets their own recovery requirements.
Is OneDrive the same as backup?
No. OneDrive stores and synchronises files and includes versioning and recycle-bin functionality. Synchronisation can also copy unwanted changes, deletion or encrypted files between the computer and cloud service. A separate backup provides an additional recovery mechanism.
Does Microsoft 365 Backup protect Teams?
Microsoft 365 Backup protects supported Exchange Online, SharePoint and OneDrive data. Because Teams stores different content types across underlying Microsoft 365 services, the exact coverage should be reviewed carefully.
Can deleted Microsoft 365 emails be recovered?
Recently deleted Exchange Online messages may be recoverable through Deleted Items or Recoverable Items. The standard deleted-item retention period is 14 days and can be increased to 30 days, unless another retention or hold configuration applies.
How often should Microsoft 365 backup restores be tested?
Restoration should be tested regularly and after significant changes to the backup service, Microsoft 365 environment or business continuity plan. The frequency should reflect the importance of the information and the organisation’s recovery requirements.
Microsoft 365 recovery should be planned before it is needed
Microsoft 365 provides useful resilience and recovery capabilities, but businesses should not rely on assumptions about what is protected or how long deleted information remains available.
Document what must be protected, select an appropriate backup and retention approach, restrict administrative access and test that important information can actually be restored.
