Does Microsoft back up my email and files in Microsoft 365?
The short answer: no, not really. Microsoft keeps its service running and protects against its own hardware failing, but keeping your data safe from deletion, ransomware or a disgruntled leaver is your responsibility. Deleted items are only kept for a limited time, typically between 14 and 93 days, and then they're gone for good. A separate Microsoft 365 backup fixes that.
What Microsoft does keep
Microsoft 365 has some safety nets. They're useful, but they're not a backup:
| What gets deleted | How long you can get it back |
|---|---|
| Emails deleted from Deleted Items | 14 days by default (an admin can raise it to 30) |
| Files in OneDrive or SharePoint | 93 days in the recycle bins |
| A deleted user (their whole account) | 30 days |
| Files encrypted by ransomware in OneDrive | Can be rolled back up to 30 days |
After that, the data is permanently deleted, and Microsoft can't get it back for you.
Why that isn't enough
- You often find out too late. Someone deletes a folder, or a leaver's mailbox is removed, and nobody notices until months later when a customer asks for an old email.
- Ransomware and hackers. Attackers who get into an account can delete or encrypt files and empty the recycle bins.
- Leavers. When you remove a leaver's licence, their mailbox and OneDrive are deleted after a short grace period, along with years of customer history.
- Mistakes sync everywhere. Delete a file on your laptop and OneDrive deletes it everywhere, straight away.
Microsoft's own approach is a "shared responsibility" model: Microsoft looks after the service, and you look after your data. Even Microsoft recommends using a separate backup.
What a proper Microsoft 365 backup does
A third-party Microsoft 365 backup copies your email, OneDrive, SharePoint and Teams to a separate, secure location every day, and keeps the copies for as long as you choose, often years. If anything goes wrong, you can restore a single email, a whole mailbox or a folder as it was on any day.
For a small business it usually costs a few pounds per person per month, which is far less than the cost of losing a mailbox.
Common questions
Isn't OneDrive a backup?
No. OneDrive keeps files in sync across your devices, so if a file is deleted or encrypted on one device, the same happens everywhere. That's useful for working, but it isn't a backup.
What about retention policies?
Retention policies can stop data being deleted, but they're designed for compliance, not for quickly restoring things. They're complicated to get right, and they don't give you an easy "put it back as it was last Tuesday".
How do I know if we're backed up?
If you've never paid for a Microsoft 365 backup product, you almost certainly aren't. Our free Microsoft 365 audit checks this, along with your security and licences. See a sample report.
Want us to check yours?
Our free Microsoft 365 audit looks at your licences, security, email and backups, and tells you in plain English what to fix first. No card, no obligation.