Microsoft 365 Backup: What Microsoft Actually Protects, and What It Does Not

I get asked about Microsoft 365 backup more often than almost anything else, and it usually comes up in the same way. Someone rings us because a folder has vanished from SharePoint, or a director has emptied a mailbox they should not have touched, or a finance assistant has been phished and the attacker has spent an afternoon quietly deleting things. The question is always the same. Microsoft has it, right? It is all in the cloud.

The honest answer is that Microsoft holds your data, keeps it available, and protects the platform it sits on. That is not the same thing as backing it up for you. There is a real gap between what people assume they are covered for and what they are actually covered for, and most businesses only find the edge of that gap on the day they need something back.

This guide sets out what Microsoft protects by default, how long it keeps things, where the holes are, what Microsoft's own backup product covers and costs, and how to decide between native and third party options. I have written it for business owners and office managers rather than IT specialists, though if you look after a tenant yourself there is enough detail here to act on.

Does Microsoft 365 Back Up Your Data?

Not in the way you probably mean. Microsoft keeps multiple live copies of your data across its own infrastructure so that a failed disk or a datacentre problem never takes your email offline. That is resilience, and Microsoft is very good at it. It protects you from Microsoft's own failures.

What it does not do is protect you from your own. If a member of staff deletes a document, if someone gets into an account and destroys data on purpose, if a retention policy is set wrong and quietly clears a mailbox, Microsoft's replication will faithfully copy that deletion everywhere. The data is gone from every copy, because every copy is a mirror of the live service rather than a historical snapshot.

Microsoft is not shy about this. Section 6.b of the Microsoft Services Agreement says plainly, "We recommend that you regularly backup Your Content and Data that you store on the Services or store using Third-Party Apps and Services." The same section adds that "all online services suffer occasional disruptions and outages, and Microsoft is not liable for any disruption or loss you may suffer as a result."

That is about as clear as a supplier gets. The recommendation is there in the terms you agreed to. Most people have simply never read it.

Microsoft 365 Backup and the Shared Responsibility Model

The framework behind all of this is the shared responsibility model, and once you understand it the rest falls into place. It splits the job of protecting a cloud service into two halves.

What Microsoft Is Responsible For

Microsoft owns the physical infrastructure, the datacentres, the network, the servers, and the software platform itself. It handles uptime, patching of the service, physical security, and resilience against hardware failure. If a datacentre in Dublin has a problem, that is Microsoft's job to solve and you will most likely never notice.

What You Are Responsible For

You own the data inside the service. That means who can access it, how long it is kept, whether it can be recovered after an accident, and whether you can prove any of that to a regulator or an insurer. Microsoft gives you the tools. Deciding how to use them, and filling the gaps they leave, sits with you.

This trips people up because the language of cloud computing suggests everything is handled. It is not that Microsoft is being evasive. It is that "your data is safe with us" means something narrower than most business owners hear when they read it.

Microsoft 365 Backup Retention: What You Actually Get By Default

Every Microsoft 365 tenant comes with a set of recovery windows built in. They are genuinely useful, and for a lot of everyday mistakes they are all you need. The problem is that they are short, they vary by service, and almost nobody knows what they are until the clock has run out.

Here is what you get without buying anything extra.

Exchange Online Backup and Mailbox Retention

When someone deletes an email it goes to Deleted Items and sits there until they empty the folder or a policy clears it. Once it is emptied, the item moves into the Recoverable Items folder, which is the hidden second chance most people never see. Users can get to it through the Recover Deleted Items option in Outlook.

By default, items stay in Recoverable Items for 14 days. An administrator can extend that to a maximum of 30 days, and that is the ceiling. There is no setting that takes it further. The Recoverable Items folder also has quotas, with a soft limit of 20 GB and a hard limit of 30 GB in Exchange Online, so a very busy mailbox can push older recoverable items out before the time limit is even reached.

Thirty days sounds like plenty until you think about how businesses actually notice problems. A contract dispute surfaces in March about an email chain from January. An accountant asks for correspondence from the last VAT quarter. By then the window closed weeks ago.

SharePoint and OneDrive Backup Retention

SharePoint backup and OneDrive backup work on a different clock. Deleted files go to the first stage recycle bin, and once that is emptied they drop into the second stage recycle bin, sometimes called the site collection recycle bin. The total retention across both stages is 93 days. At the end of 93 days the file is permanently deleted from wherever it happens to be sitting.

Ninety three days is more generous than Exchange, and it covers a lot of ordinary accidents. What it does not cover is anything you fail to spot within roughly three months, which in a shared SharePoint library is a lot. Nobody audits a document library. Files go missing quietly.

Versioning helps here and is worth turning on everywhere. It lets you roll a single file back to an earlier state, which is exactly what you want when someone overwrites a spreadsheet. It does not help if the file itself is deleted and the recycle bin has expired.

What Happens When Someone Leaves the Business

This is the one that catches people out most often, and it is worth putting on a checklist somewhere.

When you delete a user account, their OneDrive content is retained for 30 days by default and then permanently deleted. An administrator can extend that in the SharePoint admin centre, up to 3,650 days, but almost nobody changes it because almost nobody knows it is there.

The mailbox behaves similarly. Restore the account within 30 days and everything comes back. Miss it and the content goes, unless you took a specific step first such as converting the mailbox to shared, placing it on litigation hold, or applying a retention policy.

Picture the sequence that causes the damage. A salesperson leaves in June. IT deletes the account to free up the licence, because paying for a leaver is money down the drain. In September, a client queries an order and everyone wants to see what was promised. The mailbox went months ago.

Retention Policies Are Not Backup

There is a common misunderstanding here that I want to head off, because it costs people real money.

Microsoft Purview retention policies are a compliance tool. They stop data being deleted before a date you set, which is exactly right for legal and regulatory obligations. They are not a recovery tool. They will not give you a clean copy of a SharePoint site as it looked last Tuesday morning, and they will not let you roll a mailbox back to the state it was in before an attacker got into it. They preserve, they do not restore.

If someone has told you that your retention policies mean you are backed up, they have confused two different jobs.

Microsoft 365 Backup Gaps That Catch UK Businesses Out

These are the scenarios I see in practice, roughly in order of how often they come up.

1. The slow discovery. Something was deleted months ago and nobody noticed. Every native window has expired. This is by far the most common one, and it is almost always SharePoint.
2. The leaver. Account deleted to save a licence, data gone with it, question arrives later. Covered above, and entirely preventable with a proper offboarding process.
3. The compromised account. Someone gets phished, an attacker logs in, and spends time deleting mail and files to cover their tracks or to apply pressure. The Cyber Security Breaches Survey 2025/2026 found that 43 per cent of UK businesses, roughly 612,000 organisations, identified a breach or attack in the previous 12 months, and that phishing hit 38 per cent of businesses and was rated the most disruptive type of incident by 69 per cent of those affected. Account compromise is not an edge case.
4. Ransomware that reaches synced files. Ransomware on a laptop encrypts local files, and the OneDrive sync client dutifully pushes the encrypted versions up to the cloud. Version history and the recycle bin will usually save you, but only if you catch it inside the window and only if the volume is manageable.
5. The misconfigured policy. Somebody sets a retention or deletion policy with the wrong scope and it clears data across a workload. This is rarer but the blast radius is enormous.
6. The lapsed subscription. If a tenant's subscription ends, Microsoft retains customer data for a limited grace period and then deletes it. Businesses that change hands, merge, or simply miss a renewal have lost data this way.

None of these are exotic. They are ordinary business events, and the native tools handle some of them well and others not at all.

Microsoft 365 Backup: What the Native Product Covers and What It Costs

Since 2024 Microsoft has sold an actual backup product, confusingly named Microsoft 365 Backup. It sits in the Microsoft 365 admin centre and it is a genuine improvement on relying on recycle bins. It is worth understanding properly, because it changed the answer to this question.

What Microsoft 365 Backup Protects

It covers three workloads: Exchange Online mailboxes, OneDrive accounts, and SharePoint sites. According to Microsoft's own documentation, the key figures are:

• Retention of one year across all three workloads.
• Recovery points every 10 minutes for the previous two weeks, then roughly daily express restore points, then weekly points going back up to 52 weeks. Exchange Online gets 10 minute granularity across the full 52 weeks.
• Point in time restore, so you can roll a SharePoint site or a OneDrive account back to how it looked at a specific moment.
• Fast recovery, with Microsoft quoting median rates of one to three terabytes per hour when using express restore points.
• Data never leaves the Microsoft 365 trust boundary and honours your existing data residency, which matters if you have committed to UK data residency in a client contract.

The architecture is append only rather than fully immutable. Microsoft cannot modify existing backup data, which protects you against an attacker corrupting old restore points, but an administrator can delete backups by offboarding the product. There is a 90 day grace period after offboarding during which you can recover, which softens that. Retention and deletion policies from Purview do not affect the backup retention period, which is a sensible bit of isolation.

Microsoft 365 Backup Pricing

Microsoft 365 Backup is pay as you go rather than per user. The list price is $0.15 per GB per month of protected content, and restores are free. Billing runs through an Azure subscription, though Microsoft is clear that there are no additional Azure API or storage costs beyond the backup usage itself.

The detail that surprises people is what counts towards that GB total. It is not just live data. Microsoft charges on the sum of:

• The live size of protected OneDrive accounts and SharePoint sites, including the first stage recycle bin.
• The live size of protected mailboxes plus any online archives.
• Deleted content sitting in the second stage recycle bin.
• Deleted and versioned items held inside protected mailboxes.

Microsoft's own worked example is a useful one. Protect a 1 GB site holding 0.5 GB in its second stage recycle bin, plus a 1 GB mailbox with a 1 GB online archive, and you are charged for 3.5 GB rather than the 2 GB you might have expected.

Let me put that into a shape that means something for a real business. Take a 30 person company with mailboxes averaging 12 GB, OneDrive accounts averaging 15 GB, and 400 GB across its SharePoint sites. That is 360 GB plus 450 GB plus 400 GB, which comes to 1,210 GB. Add roughly 15 per cent for archives, versions and second stage recycle bin content and you land near 1,390 GB. At $0.15 per GB that is about $209 a month, or somewhere around £165 depending on the exchange rate on the day. Call it five and a half pounds per user per month.

That is a fair price for what you get, but note that the figure is driven by storage rather than headcount. A business with ten staff and two terabytes of design files will pay considerably more than a business with fifty staff who only send email. Microsoft publishes a pricing calculator spreadsheet if you want to model your own tenant, and you can pull the underlying numbers from the usage reports in the admin centre.

What Microsoft 365 Backup Does Not Cover

This is the part that gets skipped in most write ups, so I want to be specific about it. Microsoft 365 Backup covers Exchange, OneDrive and SharePoint. It does not cover:

• Teams chat messages and channel conversations. Some of this data technically lives in mailboxes and SharePoint underneath, but restoring it back into Teams as a readable conversation is not something the native tool does.
• Planner boards and tasks.
• Loop workspaces and components.
• Whiteboard.
• Forms.
• Stream.
• Entra ID objects, so users, groups and conditional access configuration are outside the scope.

Whether that matters depends entirely on how your business works. If Teams is where your decisions get made and Planner is where your projects live, then a backup that ignores both is only doing part of the job. If Teams is chat and everything important ends up in SharePoint or email anyway, the gap is much smaller.

Microsoft 365 Backup Solutions: Native or Third Party?

There is no universal right answer here, and I am suspicious of anyone who gives you one without asking about your business first. Here is how I think it through.

When the Native Option Makes Sense

Microsoft 365 Backup is a good fit when your data lives in Exchange, OneDrive and SharePoint and not much else, when you want the fastest possible bulk restore after a serious incident, when you have committed to keeping data inside the Microsoft trust boundary for residency reasons, and when you would rather have one supplier, one bill and one admin centre.

The speed argument is genuinely strong. Because the backups sit inside the same data boundary as the live service, Microsoft is not pulling terabytes back across the internet from someone else's cloud. If you ever have to restore a thousand mailboxes at once, that difference is measured in days.

When a Third Party Backup Makes Sense

Third party Microsoft 365 backup solutions from the likes of Veeam, AvePoint, Datto, Barracuda and others tend to win on breadth and on independence. They typically cover Teams chats, Planner and other workloads that Microsoft leaves out. They store your data somewhere other than Microsoft, which gives you a genuinely separate copy rather than a copy held by the same supplier that runs the live service. Many offer retention beyond a year, which matters if you have a seven year record keeping obligation. Most price per user, which makes budgeting predictable and is usually cheaper for storage heavy businesses.

The independence point deserves a moment. Keeping your only backup with the same provider that runs your production service breaks the spirit of the 3-2-1 rule, which asks for three copies of your data, on two different types of media, with one copy held off site. Microsoft's own architecture is redundant and append only, so this is not the same risk as having no backup at all. But if your reason for backing up includes a lapsed subscription, a billing dispute, an account lockout or a tenant level administrative mistake, a copy held outside Microsoft is doing something that a copy held inside it cannot.

Microsoft 365 Backup Cost Compared

The two pricing models suit different shapes of business, and the crossover point is worth working out before you commit.

Native is consumption based, so your cost tracks your storage. Third party is usually per user per month, commonly somewhere in the range of two to five pounds per user depending on the vendor, the retention you choose and how many seats you have. Prices move, so treat that as a starting point for quotes rather than a figure to budget against.

Work out your total protected storage, divide by your user count, and you have your answer. Businesses with low storage per head often find native cheaper. Businesses with large SharePoint estates, big design or media files, or years of accumulated archives usually find per user pricing works out better, sometimes dramatically so.

A third option worth knowing about is that several vendors now build on Microsoft's own backup storage platform, which gives you the restore speed of the native service with a vendor's management layer and broader workload coverage on top. If you go that route you are billed by the vendor rather than by Microsoft.

Office 365 Backup and UK GDPR

There is a compliance angle to this that gets less attention than it should, and it is the one that turns a technical decision into a business risk.

Article 32(1)(c) of the UK GDPR requires organisations to have "the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident." That is not a suggestion. It is a security requirement written into the regulation, and it applies to any business processing personal data, which is effectively all of them.

The ICO's guidance on data security is direct about what this means in practice. You should be able to restore access to personal data after an incident, and an appropriate backup process is how you demonstrate that. If you suffer a breach or a loss event, your ability to recover is one of the things that will be examined.

So the question is not only whether you can get a file back. It is whether you could show a regulator, an insurer, or a client running a supplier assessment that you have a defined recovery process, that you have tested it, and that you know how long a restore takes. A 30 day mailbox window and a shrug is not a strong position to be in.

The same logic runs through cyber insurance and through supply chain questionnaires. Insurers increasingly ask specific questions about backup, retention and testing, and answers affect both premiums and whether a claim gets paid. If you have been through Cyber Essentials certification you will recognise the pattern, where the certification itself focuses on the five technical controls but the wider conversation with clients and insurers goes further.

How to Back Up Microsoft 365 Properly

Here is the sequence I would work through with any business that has not looked at this before. It is deliberately practical, and most of it can be done in an afternoon.

1. Find out what you have. Open the usage reports in the Microsoft 365 admin centre and look at mailbox sizes, OneDrive storage and SharePoint site storage. You cannot make a sensible decision about cost or coverage without knowing the numbers. Remember that these reports leave out second stage recycle bin content and online archives, so add a margin.
2. Check your current retention settings. Confirm whether your Exchange deleted item retention is still at the 14 day default or has been raised to 30. Check the OneDrive retention period for deleted users in the SharePoint admin centre. Both are quick wins and cost nothing.
3. Turn on versioning everywhere. It is on by default for most modern SharePoint libraries, but older sites and some migrated content can be missing it. Versioning is the single cheapest protection against overwritten files.
4. Decide what actually needs protecting. Not every SharePoint site holds business critical data. A site full of last year's marketing images does not need the same treatment as your finance library. Being selective controls cost, particularly with consumption based pricing.
5. Fix your leaver process. Write down what happens to a mailbox and a OneDrive when someone leaves, and make sure the person who deletes accounts is following it. Converting a mailbox to shared costs nothing and keeps it accessible. This one step prevents more data loss than any product.
6. Choose your backup approach. Native, third party, or a vendor built on Microsoft's platform. Base it on which workloads matter to you, how much storage you hold per user, how long you need to keep things, and whether you need a copy held outside Microsoft.
7. Test a restore. Then test it again in six months. An untested backup is a belief rather than a control.

Microsoft 365 Backup Best Practices

A few things I would add once the basics are in place.

Write down your recovery time and recovery point objectives. How long can the business survive without this data, and how much of it can you afford to lose? Those two numbers drive every other decision, and most businesses have never put a figure on either. If you have not done this exercise, our business continuity plan template walks through it.

Protect the backup administrator account properly. Whoever can delete your backups is now one of the most sensitive accounts in the business. Multi factor authentication, a privileged access review, and alerting on changes are all reasonable. Microsoft 365 Backup has a multi admin notification feature that emails a preset group when a potentially harmful action is taken, and it is worth switching on.

Keep backup separate from retention. They answer different questions. Retention answers "am I legally allowed to delete this yet". Backup answers "can I get this back". You need both, and satisfying one does not satisfy the other.

Review it annually. Storage grows, headcount changes, and the workloads a business depends on shift. A backup decision made three years ago when nobody used Teams may not be the right one now.

Do not forget the endpoints. Microsoft 365 backup covers cloud data. Files sitting only on a laptop hard drive, line of business applications, and on premises servers all need their own answer. Redirecting known folders such as Desktop and Documents into OneDrive is a simple way to bring more staff data under cloud protection.

Microsoft 365 Backup FAQs

Does Microsoft 365 have a backup?

Microsoft replicates your data for resilience and provides short recycle bin and Recoverable Items windows, but that is not a backup in the traditional sense. Microsoft also sells a separate product called Microsoft 365 Backup, which does provide point in time restore with one year retention for Exchange Online, OneDrive and SharePoint. It is not included in your subscription and has to be turned on and paid for.

Do I need to back up Microsoft 365?

If your business would be materially harmed by losing email or documents that were deleted more than 30 to 93 days ago, then yes. That covers most businesses. It also covers you for account compromise, misconfigured policies and staff departures, all of which sit outside what native retention handles well.

How much does Microsoft 365 backup cost per month?

Microsoft's native service is $0.15 per GB per month of protected content, with free restores, billed through Azure. Third party Microsoft 365 backup solutions typically charge per user per month, commonly in the two to five pound range depending on vendor and retention. For a 30 person business with around 1.4 TB of protected data, the native option works out near £165 a month, though the sterling figure moves with the exchange rate.

What is the price of Microsoft 365 backup in the UK?

Microsoft lists the native service in US dollars at $0.15 per GB per month and bills through your Azure subscription, so your invoice will reflect the prevailing rate. Third party vendors generally quote in sterling per user. Get quotes on both models using your own storage figures, because the cheaper option depends entirely on how much data you hold per person.

What is the best Microsoft 365 backup solution?

The one that covers the workloads your business actually depends on, at a retention period that matches your obligations, at a price that reflects your storage profile. If you live in Exchange, OneDrive and SharePoint, the native service is a strong and fast choice. If Teams chats or Planner hold real business information, or you need a copy held outside Microsoft, a third party product is the better fit.

Will I lose my emails if I cancel Microsoft 365?

Eventually, yes. Microsoft holds customer data for a limited grace period after a subscription ends and then deletes it. If you are moving away from Microsoft 365, export or back up what you need before you cancel rather than after, and do not rely on the grace period as a plan.

How long does Microsoft 365 keep deleted emails?

Items in the Recoverable Items folder are kept for 14 days by default, and an administrator can extend that to a maximum of 30 days. There is no way to go beyond 30 days using that setting alone.

Does Microsoft 365 Backup cover Teams?

Not directly. Teams chat messages and channel conversations, along with Planner, Loop, Whiteboard, Forms and Stream, sit outside the native product's scope. If those matter to your business you will need a third party tool alongside it.

Is a retention policy the same as a backup?

No. Retention policies stop data being deleted before a date you set, which is a compliance function. Backup gives you a recoverable copy from a point in time, which is a recovery function. They solve different problems and you generally need both.

Where to Start

If you take one thing from this, make it the storage report. Open your Microsoft 365 admin centre, look at how much data you are holding across mailboxes, OneDrive and SharePoint, and then ask yourself what would happen if a chunk of it disappeared and nobody noticed for four months. The answer usually settles the question quite quickly.

After that it is a matter of matching the tool to the business. Check your retention settings, fix your leaver process, decide which workloads genuinely need protecting, pick an approach, and test a restore so you know it works before you need it to.

None of this is complicated. It is just one of those things that stays comfortably off the priority list until the day it becomes the only thing that matters.

AIS Technology sets up and manages Microsoft 365 backup as part of our managed cloud service, including choosing between the native and third party route based on what a business actually holds, configuring retention properly, and testing restores on a schedule rather than in an emergency. If you are not sure what your current position is, we will run through your tenant and tell you what is and is not covered.