1. Is Microsoft 365 Backed Up by Microsoft?
Not in the way most people expect. Microsoft keeps its data centres, servers and copies of the service running, so an outage at Microsoft should not lose your data. But Microsoft follows a shared responsibility model: if a user deletes a folder, a leaver's mailbox is removed, or ransomware encrypts files that then sync to OneDrive, Microsoft will not restore it for you after the built-in time limits have passed.
2. What Microsoft 365 Already Gives You
- Outlook / Exchange Online: deleted items go to Deleted Items, then to Recoverable Items, which keeps them for 14 days by default (an admin can raise this to 30 days)
- OneDrive and SharePoint: a two-stage recycle bin that keeps deleted files for up to 93 days, plus version history on files
- Restore your OneDrive: rolls a whole OneDrive back to any point in the last 30 days, useful after ransomware
- Leavers: when a licence is removed, the mailbox and OneDrive are kept for a limited time (normally 30 days) and are then deleted
These features are useful, but they are short-term safety nets, not a backup. After the time limit, the data is gone.
3. Retention Policies Are Not Backup
Retention policies and litigation hold (available in some plans) stop data from being permanently deleted, which helps with compliance. They do not give you a simple way to restore a whole mailbox, a SharePoint site or a folder to how it looked last Tuesday, and they still live inside the same Microsoft 365 tenant. A real backup is a separate, independent copy that you can restore from quickly.
4. The Gaps a Backup Closes
- Files or emails deleted by mistake and noticed after the recycle bin has emptied
- Ransomware or a bad sync that overwrites many files at once
- A compromised account where the attacker deletes mail or data
- Leavers whose mailbox and OneDrive are deleted with the licence
- Audits or disputes where you need an old version of a contract or invoice
5. What to Back Up
- Exchange Online: all mailboxes, shared mailboxes, calendars and contacts
- OneDrive: every user's files
- SharePoint: all sites and document libraries
- Teams: channel files (stored in SharePoint) and, where the tool supports it, channel conversations
6. Your Backup Options
- Microsoft 365 Backup: Microsoft's own add-on service with fast restores inside the tenant, billed for the storage you protect
- Cloud backup services such as Acronis Cyber Protect Cloud: the backup is stored outside your Microsoft 365 tenant, managed from one console
- Veeam Backup for Microsoft 365: flexible, can store backups on your own server or in the cloud
- A NAS in the office (for example Synology Active Backup for Microsoft 365): a local copy with no per-user fee for the software
The right choice depends on how many users you have, how much data there is, how fast you need restores and where you want the copy to live.
7. Follow the 3-2-1 Rule
Keep 3 copies of important data, on 2 different types of storage, with 1 copy outside your main system. For Microsoft 365 this usually means the live data in Microsoft 365 plus a backup in a separate cloud or on a NAS, ideally with immutable (cannot be changed) backups so ransomware cannot delete them.
8. Set Retention and Schedule
- Back up at least once a day; many tools run several times a day
- Keep backups for at least one year, longer if contracts or audits require it
- Protect the backup console with multi-factor sign-in and a separate admin account
- Include new users automatically so nobody is missed
9. Test Restores Every Quarter
A backup is only proven when you restore from it. Every quarter, restore a single email, a OneDrive folder and a SharePoint file to check that the backup works and that you know how long a restore takes.
10. Combine Backup with Security
Backup is your last line of defence. Reduce how often you need it with multi-factor sign-in for every user, email filtering, endpoint protection and a clear joiners and leavers process. Our Microsoft 365 setup checklist covers these basics.
Bringing It Together
Microsoft 365 is reliable, but it is not a backup. A separate backup of mailboxes, OneDrive, SharePoint and Teams, tested every quarter, protects you from deletion, ransomware and leavers. VOWTECH sets up and monitors cloud backup and Microsoft 365 support in Abu Dhabi and Dubai, as a project or as part of an IT AMC.