Is your Microsoft 365 backed up?

Probably not the way you think. Microsoft keeps the service running. Getting your data back after someone deletes it, overwrites it, or a compromised account encrypts it is your problem, and Microsoft says so in its own documentation.

I have some version of this conversation with almost every business I sit down with in New Hampshire and southern Maine. The owner assumes that because email and files live "in the cloud," a copy exists somewhere. A copy does exist, for a while. Then it's gone.

What Microsoft is responsible for

Microsoft runs redundant data centers. If a disk or a whole server fails on their side, you never find out. That protects you from Microsoft's hardware.

It doesn't protect you from your own users, a phished password, or a OneDrive sync client that copies ransomware-encrypted files straight up to the cloud. Microsoft's shared responsibility model lists your data, your accounts, and your devices as things the customer always owns, whatever the service. Their consumer Services Agreement is blunter still: "We recommend that you regularly backup Your Content and Data."

What you get out of the box, and for how long

Microsoft 365 does have safety nets. They're time-limited, and they were built to undo mistakes, not to recover from a disaster.

• Deleted email. Once someone empties Deleted Items, messages sit in a Recoverable Items folder for 14 days by default. An admin can raise that to 30 days. That's the ceiling.
• SharePoint and OneDrive files. Deleted files go to a two-stage recycle bin and are kept for 93 days from the original deletion. After that they're purged.
• Deleted users. Remove an employee's account and their OneDrive is kept for 30 days by default (an admin can set anywhere from 30 to 3,650 days). Their mailbox is recoverable for 30 days.
• Microsoft's own backups of SharePoint. Microsoft keeps them for 14 more days past permanent deletion, but a restore means opening a support case, and it rolls back a whole site, not the one folder you need.

Read those numbers again with a real situation in mind. Say a bookkeeper at a 12-person accounting firm in Exeter leaves in March. Someone removes her account to free the license. In June, a client asks for a document only she had. Under the default settings, her OneDrive was cleaned up long ago.

Or the version I worry about more: a partner's password gets phished, the attacker quietly deletes a few hundred messages to hide their tracks, and nobody notices for six weeks. The 30-day window has already closed.

Retention policies help, but they aren't backup

Several Microsoft 365 plans, including Business Premium, include retention policies and litigation hold. They keep copies of content for compliance, and they're worth turning on. But getting a folder structure back the way it was, at scale, from a retention policy is slow and awkward. It's an eDiscovery tool, not a restore button.

Version history in OneDrive and SharePoint is also useful. It saved more than one client of mine after a bad edit. It won't help if the file or the whole library is deleted and purged.

What a real Microsoft 365 backup looks like

A proper backup copies your mailboxes, OneDrive, SharePoint, and Teams data to storage that lives outside your tenant's normal permissions, keeps it on a schedule you set, and lets you restore one email or an entire mailbox to a specific date.

Your options fall into two camps:

1. Third-party backup. Products in the Veeam, Datto, Acronis, and Dropsuite family back up Microsoft 365 to their own cloud. Most are priced per user. Look for unlimited or long retention, granular restore (a single file, a single message), and separate credentials so a compromised Microsoft 365 admin can't delete the backups.
2. Microsoft 365 Backup. Microsoft now sells its own backup service for Exchange, OneDrive, and SharePoint, billed by storage through an Azure subscription. It restores fast and stays inside Microsoft's world. That's a plus for speed and a minus if the thing you're worried about is someone taking over your Microsoft admin account.

For most small offices I lean toward a third-party product with its own separate login and multi-factor authentication. The point of a backup is that it survives the worst day, and the worst day usually involves a compromised Microsoft account.

Questions to ask whoever handles your IT

• Which Microsoft 365 data do we back up today: Exchange, OneDrive, SharePoint, Teams?
• How long do we keep it? Does that match how long we might need it, or what our industry requires?
• When did we last test a restore, and what did we restore?
• If our global admin account were taken over, could the attacker delete the backups?
• What happens to a departing employee's mailbox and OneDrive, step by step?

If the answers are vague, you don't have a backup. You have an assumption.

What about Google Workspace?

Same story, different recycle bins. Google keeps deleted Drive and Gmail items for a limited window, and Google Vault is a retention tool, not a backup tool. If your office runs on Workspace, the same rules apply: a separate backup with its own retention and its own credentials.

Questions people ask

Brady McNeill is the founder and CEO of Dreamline Technology. He has spent 12+ years running IT and security for small and mid-sized businesses across New England.