Microsoft 365 Backup: Why Microsoft Isn’t Backing Up Your Data
Microsoft 365 backup is one of those things almost every business assumes is already handled. It’s in the cloud, Microsoft is a serious company, the service almost never goes down, so the question feels like it must be taken care of somewhere in the background. Nobody remembers being told otherwise, and nothing in the day-to-day experience of using Microsoft 365 suggests there is a problem to solve.
It isn’t handled. Microsoft’s own Services Agreement recommends that customers regularly back up their own content, and the recycle bins and retention policies people mistake for backup are short-term safety nets that live inside the same tenant they are meant to protect.
Delete something, get hit by ransomware, or remove a leaver’s licence, and the clock starts running on data that most organisations believe is safe indefinitely. The windows are shorter than people expect, they vary by service, and they require somebody to notice within them.
The gap is not hidden. It sits in the shared responsibility model, in plain language, in a contract almost nobody reads. Microsoft owns the platform and its availability. You own the data and its recoverability. That division is entirely reasonable, and it is how every major cloud platform works, but it only protects you if you know it exists.
Knowing where Microsoft’s responsibility ends and yours begins turns a nasty surprise during an incident into a decision you made deliberately, on a quiet Tuesday, with the right protection already in place and tested.
Quick summary
Microsoft keeps the platform running. Protecting and recovering the data your staff create is your responsibility, not theirs.
The question is not whether you need a backup. It is whether you would rather decide that now or during an incident.
What Microsoft actually protects
Microsoft runs the infrastructure: the datacentres, the network, the uptime, the application platform. It replicates your data across sites so the service stays available if hardware fails. That replication is genuinely excellent, and it is the reason Microsoft 365 is almost always up.
But availability and recoverability are different things. Replication protects against a datacentre problem. It does not protect against deletion or corruption, because those replicate too, instantly. If a user deletes a SharePoint library and it copies across every replica in seconds, you have several perfectly available copies of the deletion.
That split is set out in the shared responsibility model, and it is how every major SaaS platform works. Microsoft owns the platform. You own the data.
The safety nets people mistake for backup
Three native features get confused with backup, and each has a hard limit worth knowing.
Recycle bins. SharePoint and OneDrive retain deleted items for 93 days across both stages. Exchange Online holds deleted items for 14 days by default, extendable to 30. Neither is automatic recovery, both require someone to notice and act, and ransomware operators routinely empty them on the way in.
Retention policies. These preserve content for compliance and legal hold. They are not restore points. You can have retention configured correctly and still lose data permanently if the deletion falls outside the window, or if you need to return to a specific moment in time rather than simply prove something existed.
Version history. Useful for recovering an overwritten document. Useless if the file, the library, or the account is gone.
The common thread is that all three live inside the tenant they are supposed to protect. A backup, properly defined, is a separate restorable copy that exists independently of the environment it covers.
Where the data actually goes missing
In practice, the losses that hurt tend to come from a small number of predictable situations.
Leavers. Remove a licence and the associated OneDrive data enters a deletion countdown. Organisations that offboard staff without a deliberate plan for their content lose it quietly, months later, when nobody is looking. This is closely related to how you manage unlicensed OneDrive accounts, and it is one of the most common avoidable data losses we see.
Ransomware and malicious deletion. An attacker with a compromised account can delete at scale and clear the recycle bins behind them. Without an independent copy, there is nothing to restore from.
Teams data. Chat messages, channel posts, and meeting recordings are among the least protected workloads in Microsoft 365. Many organisations back up email and files and overlook Teams entirely.
Entra ID. User accounts, groups, and Conditional Access policies are not backed up. If an admin account is compromised and policies are altered or users deleted, recovery means manual reconstruction.
What about Microsoft’s own backup service?
Microsoft launched a native backup product for Microsoft 365, which is worth understanding rather than dismissing. It is a pay-as-you-go, consumption-based service billed per gigabyte of protected content through an Azure subscription, with restores charged at nothing extra. Because the data never leaves Microsoft’s datacentres, restore speeds are genuinely fast.
It also has specific limits that are published rather than hidden, and which most buyers do not read:
- A one-year retention ceiling, which does not meet many organisations’ compliance obligations
- No coverage of Teams chat or channel messages
- Exchange restores can only land back in the same user’s mailbox
- An in-place site restore overwrites everything written since the chosen restore point
- The backup lives within the same tenant boundary, so there is no true air gap
For a small, data-light tenant it can work out cheaper than per-user third-party licensing. For a data-heavy one it can cost considerably more. Neither answer is knowable without looking at your actual storage figures, which takes minutes to pull.
Common mistakes and pro tips
- Assuming replication and high availability amount to a backup, when they protect against entirely different failures
- Treating the recycle bin as a recovery strategy, when it is a short window that attackers clear first
- Backing up email and files but leaving Teams and Entra ID unprotected
- Buying a backup product and never testing a restore, which is the only thing that proves it works
A backup you have never restored from is a theory. Testing a restore, on a schedule, is what turns it into a plan.
The bottom line on Microsoft 365 backup
Microsoft is not going to lose your data through negligence, and the platform is more reliable than almost anything a business could run itself. But the contract is clear that recovering your own content is your job, and the native safety nets were built for short-term accidents rather than serious loss. The organisations that come unstuck are rarely careless. They simply assumed a question had been answered that nobody had actually asked.
Our Microsoft 365 Support service includes making sure your data is genuinely protected and recoverable, covering the workloads native tools miss and testing that restores actually work. That is the difference between believing you have a backup and knowing you do.
STRAIGHT ANSWERS
Frequently asked questions
Does Microsoft back up Microsoft 365 data automatically?
No. Microsoft replicates data for platform resilience and provides short-term recovery features such as recycle bins and version history, but its Services Agreement recommends that customers back up their own content. Under the shared responsibility model, data protection and recovery sit with you.
How long does Microsoft 365 keep deleted files?
SharePoint and OneDrive retain deleted items in their recycle bins for 93 days across both stages. Exchange Online retains deleted items for 14 days by default, which can be extended to 30. After those windows, the data is permanently purged.
Is a retention policy the same as a backup?
No. Retention policies preserve content in place to meet compliance and legal requirements. A backup is a separate, restorable copy you can recover from at a specific point in time. You can have retention configured perfectly and still lose data permanently.
How much does Microsoft 365 backup cost in the UK?
Third-party backup typically runs between £2 and £8 per user per month in the UK market, depending on the vendor and what is included. Microsoft’s own native service is priced per gigabyte of protected content rather than per user, so which works out cheaper depends entirely on how much data you hold.
Is Office 365 backup the same thing as Microsoft 365 backup?
Yes, in practice. Office 365 was the earlier name for the suite now called Microsoft 365, and the backup considerations are identical: the platform is Microsoft’s responsibility and the data is yours.