It's one of the most common assumptions we hear from small businesses, schools and charities: "Our email and files are in Microsoft 365, so they're backed up automatically." It's an understandable belief. Microsoft is a huge company with enormous data centres, and your data is safely in the cloud. Surely that means it's backed up?
The honest answer is: not in the way most people think. Microsoft does a lot to keep its service running, but that isn't the same as keeping a recoverable copy of your data for as long as you might need it. If you've searched "does Microsoft 365 back up my data", here's what you need to know.
What Microsoft actually protects
Microsoft works on what's often called a shared responsibility model. Put simply, Microsoft is responsible for the infrastructure, and you are responsible for your data.
On Microsoft's side, that means:
- Keeping its data centres secure and running
- Replicating data across multiple servers and locations, so a hardware failure doesn't wipe out your mailbox
- Keeping the service available, with very high uptime
This is excellent protection against Microsoft's own systems failing. What it doesn't protect you from is something going wrong on your side, such as a person deleting the wrong thing, a cyber attack, or a sync problem. If your data is deleted or encrypted, that change is faithfully replicated too.
It's worth noting that Microsoft's own services agreement recommends that customers regularly back up their content using third-party apps and services.
The built-in safety nets, and their limits
Microsoft 365 does include some recovery features, and they're genuinely useful for everyday mistakes. But they are short-term safety nets, not backups.
Email (Exchange Online)
When you delete an email, it goes to Deleted Items. Once that folder is emptied, items can usually still be recovered for a limited period, 14 days by default, which an administrator can extend to a maximum of 30. After that, they're gone.
Files (OneDrive and SharePoint)
Deleted files go into a recycle bin and can typically be recovered for up to 93 days. Version history also lets you roll back changes to a document, and OneDrive has a restore feature that can wind a whole library back to an earlier point within the last 30 days.
Retention policies and holds
Depending on your licence, you can set retention policies or litigation holds that stop data being permanently deleted. These are designed for compliance and legal purposes rather than quick, practical recovery. They can be fiddly to set up correctly and aren't a simple way to put things back the way they were.
Where businesses get caught out
The gaps tend to show up in a few common situations:
- **Accidental deletion discovered too late.** Someone deletes a folder of client files, and nobody notices for three or four months. The recycle bin has long since been emptied.
- **Staff leaving.** When an employee leaves and their licence is removed, their mailbox and OneDrive don't stay around forever. Typically you have around 30 days before the data is permanently removed. Many organisations only realise they needed something from that account much later.
- **Ransomware and malicious activity.** If a device is infected and synced files are encrypted, those encrypted versions sync to the cloud. Recovery tools may help, but they're limited in time and not always straightforward.
- **Compromised accounts.** If an attacker gains access to a mailbox, they may delete emails or files to cover their tracks.
- **Sync errors and migrations.** Moving data between systems, or a sync tool misbehaving, can overwrite or remove data at scale.
- **Compliance and record keeping.** Schools, care providers and charities often have obligations to keep certain records for years, which built-in tools alone may not reliably meet.
What a proper Microsoft 365 backup looks like
A dedicated backup service takes regular, independent copies of your Microsoft 365 data and stores them separately, so they're not affected by what happens inside your tenant. A good solution should:
- Back up Exchange email, OneDrive, SharePoint and Teams data
- Run automatically, several times a day
- Keep copies for as long as you need, whether that's months or years
- Store data separately from Microsoft 365 itself, ideally in UK data centres if that matters to you
- Let you restore anything from a single email to an entire mailbox or site, quickly
- Keep backups of leavers' accounts so you can safely remove their licences
Microsoft has also introduced its own paid backup add-on, and there are several well-established third-party options. Which one suits you depends on your size, budget, retention needs and how quickly you'd need to get data back. There isn't a single right answer for everyone.
Is it worth it for a small organisation?
For most organisations, yes. The cost of a Microsoft 365 backup service is usually modest compared with the time, stress and potential reputational damage of losing important emails, contracts, pupil records or client files. It also tends to make day-to-day IT easier, because restoring a lost file becomes a quick task rather than a worrying investigation.
The key thing is not to wait until something has gone wrong to find out where you stand.
Not sure if your data is protected?
If you're unsure what's currently backed up, how long you could recover deleted data for, or what happens to leavers' accounts, we're happy to help. Cloud 4 Sure supports businesses, schools, charities and care providers across Sussex, Surrey, Hampshire and Kent with Microsoft 365 and cloud backup. Get in touch to book a free IT health check, and we'll give you a clear, jargon-free picture of how well your data is protected.