Does Microsoft back up your Microsoft 365 data?

It's one of the most common assumptions in small business IT: everything is in the cloud, so Microsoft must have a backup. Microsoft does protect its infrastructure, but recovering your data from your own mistakes or an attack is largely your responsibility.

What Microsoft provides

Microsoft 365 includes recovery features that help with everyday accidents:

• Deleted email stays recoverable for a limited period, 14 days by default, which administrators can extend to 30 days.
• SharePoint and OneDrive keep deleted files in recycle bins for up to 93 days.
• Version history lets you roll back changes to individual documents.
• Retention policies and holds can preserve content, depending on your licensing.

Where the gaps are

These features aren't designed to be a complete, independent backup. They can fall short when:

• Something is deleted and nobody notices until after the retention window.
• Ransomware encrypts files that then sync to OneDrive or SharePoint.
• An employee leaves and their account and mailbox are removed.
• You need to restore a large amount of data, or restore it to a specific point in time.

What a proper backup adds

A dedicated Microsoft 365 backup keeps separate copies of email, OneDrive, SharePoint, and Teams data on a schedule, retains them for as long as you choose, and lets you restore individual items or entire accounts. Microsoft also offers its own Microsoft 365 Backup service, alongside third-party products.

Whichever you choose, the important part is the same: confirm backups are running, keep them long enough, and test restores regularly. A backup you've never restored from is an assumption, not a plan.

Zach Albano

Founder of Albano Tech, providing managed IT, Microsoft 365, and cybersecurity services to businesses in Delaware, Maryland, and the Philadelphia region. More about Zach.