Microsoft 365 isn't backing up your data. So what actually does?
"Because it all lives in Microsoft's cloud, most owners assume a safe copy is waiting if something goes wrong. Microsoft's own agreement says otherwise. This is what the platform really covers, and how to fill the gap."
Ask a business owner whether their Microsoft 365 email and files are backed up, and most will say yes, because it all lives in the cloud. It is an easy thing to believe and a costly thing to get wrong. Microsoft keeps the service running. Keeping a copy of your data that you can actually restore is left to you, and most people find that out in the week they suddenly need it.
What Microsoft protects, and what falls to you
Microsoft works on a shared responsibility model. The line runs roughly here:
Microsoft looks after the infrastructure: the datacentres, the uptime, the security of the platform.
You look after the data inside it: who can reach it, how long it is kept, and whether you can bring it back.
This is not our reading of it. Microsoft sets the division out in its shared responsibility documentation[1], and states it plainly in section 6(b) of the Microsoft Services Agreement: "We recommend that you regularly backup Your Content and Data that you store on the Services or store using Third-Party Apps and Services."[2] Independent analyst work on SaaS data protection reaches the same conclusion from the other direction - the platform's retention windows are an availability feature, not a recovery point objective, and organisations that treat them as backup discover the gap during an incident[3]. That is a fair signal to take seriously when it is the vendor itself doing the recommending.
How long Microsoft keeps deleted items
Microsoft does hold on to deleted items for a while, in recycle bins. The catch is that "a while" is short, and a recycle bin is not a backup:
How long Microsoft keeps deleted items
Exchange (email)
How long a deleted item survives
14 days by default, up to 30 if configured
SharePoint and OneDrive
How long a deleted item survives
93 days across both recycle bin stages
A deleted user's OneDrive
How long a deleted item survives
30 days by default
Teams messages
How long a deleted item survives
1 to 7 days
Table comparing 4 rows across 2 columns: Where, How long a deleted item survives.
How long Microsoft keeps deleted Microsoft 365 data
Days before permanent deletion
Deleted mail items (default)
Deleted mail items (maximum)
Deleted user's OneDrive (default)
SharePoint / OneDrive recycle bin
These are grace periods, not backups: they expire on Microsoft's schedule, they do not survive a compromised administrator, and none of them gives you a point-in-time restore. Mailbox windows come from the Exchange Online Recoverable Items documentation; the file windows from the SharePoint and OneDrive retention documentation.
Show the data
Horizontal bar chart of Microsoft 365 retention windows in days: deleted mail items 14 days by default and 30 days maximum, a deleted user's OneDrive 30 days by default, and the SharePoint or OneDrive recycle bin 93 days.
Once that window passes, the item is gone. Delete a mailbox, a folder or a SharePoint site and go a month without noticing, and no recycle bin is going to bring it back.
The four ways businesses actually lose Microsoft 365 data
An outage at Microsoft is rarely the culprit. In practice, data disappears through:
1Accidental deletion. Someone empties a folder or overwrites a file, and it is past the recycle-bin window before anyone spots it.
2Ransomware and malware. Modern attacks reach synced cloud files and encrypt them along with everything else.
3A departing or malicious employee. Mailboxes and OneDrive files tied to that person's account can vanish when the account is removed.
4A retention or configuration slip. A policy gets changed, and months of data quietly ages out.
Native backup versus a real backup
Microsoft now sells its own backup add-on[4]. It is better than nothing, with two limits worth knowing. It covers only Exchange, SharePoint and OneDrive, and it keeps the copy inside Microsoft's own environment. A separate third-party backup adds what that cannot: an independent copy held outside Microsoft, so a platform-wide problem does not take your recovery down with it, and fast item-level restores, so pulling back one lost mailbox is a matter of minutes.
What a working backup looks like for a small business
None of this needs to be elaborate. For a team of 5 to 50 people, a solid setup comes down to four things:
A daily, automatic backup of Exchange, SharePoint, OneDrive and Teams.
An immutable copy that cannot be altered or deleted, so ransomware has nothing to reach.
A restore you have run for real, rather than one you assume works.
A recovery time you actually know, so if the worst happens you can give your team and your clients a straight answer on when things will be back.
With those four in place, a bad day stays an inconvenience rather than a threat to the business.
Questions we get asked
Sources
Every figure in this article traces back to a named source. Where we quote our own numbers, they come from work we have done with small businesses in Israel and across Europe, and we say so.
