Microsoft 365 Backup: The Gap Most Businesses Don’t Know They Have

September 18, 2026

There is a belief, extremely widespread and entirely understandable, that data in Microsoft 365 is backed up because it is in the cloud.

It is not. And Microsoft says so, in the documentation, in a section almost nobody reads.

The shared responsibility model, in one line

Microsoft is responsible for keeping the service running. You are responsible for your data in it.

Their obligation is availability and infrastructure resilience — if a data centre fails, your email keeps working. It is not to give you back a file you deleted four months ago, or to restore a mailbox to how it looked before someone emptied it.

The protections that do exist are retention features, and retention is not backup. A recycle bin with a timer protects you from a mistake you notice quickly. It does nothing about a mistake you notice in March that happened in November.

What you actually get natively

Exchange Online. Deleted Items, then Recoverable Items, then gone. The default window is measured in weeks, not years.

SharePoint and OneDrive. A two-stage recycle bin totalling 93 days. Version history helps within a document, but not if the document itself is gone.

Teams. More complicated than either, because Teams data lives across Exchange, SharePoint and its own chat service, and the retention behaviour differs for each.

Those are useful features. They are not a backup, because they have a fixed expiry, they cannot restore a point in time, and they are administered from inside the same tenant that might be compromised.

Self-check

What your Microsoft 365 tenant does and does not protect

Tick what you believe is genuinely covered in your setup today.

Deleted email is recoverable after 30 daysItems in Deleted Items and then Recoverable Items are purged on a timer. Past that window, Microsoft cannot get it back for you.

A file deleted from SharePoint is recoverable after 93 daysThe two-stage recycle bin totals 93 days. After that it is gone, regardless of your licence level.

You could recover from an ex-employee deleting files on their last dayDeliberate deletion by someone with legitimate access is the case native retention handles worst.

A departed user’s OneDrive survives their account being deletedBy default, OneDrive content is removed a set period after the account goes. Plenty of businesses discover this a quarter later.

You could roll a mailbox back to how it looked last TuesdayPoint-in-time recovery of an entire mailbox is not something native tools do.

You could recover if ransomware encrypted files that then synced to SharePointSync is efficient and obedient. It will replicate encryption to the cloud copy quite happily.

You know who would do the recovering, and how long it would takeKnowing it is theoretically possible is different from knowing the procedure.

0 of 7

The four scenarios that catch people out

The departed employee. Someone leaves, their account is deleted to free the licence, and their OneDrive goes with it after a grace period. Three months later somebody needs a document that only existed there.

Deliberate deletion. An unhappy leaver clears their mailbox on their last afternoon. Native retention is built around accidents, not intent.

Ransomware that syncs. Files are encrypted on a laptop, OneDrive dutifully synchronises the encrypted versions, and the cloud copy is now encrypted too. Version history can help here, but recovering thousands of files individually is not a realistic afternoon.

Discovered late. Most damaging deletions are not noticed for months. By the time anyone looks, the retention window has closed.

What a real backup adds

Independent storage outside your tenant, so a compromised or closed account does not take the backup with it. Point-in-time restore, so you can recover a mailbox or site as it was on a specific date. Retention you choose, whether that is a year or seven. And granular restore, so you can bring back one folder rather than reverting everything.

It also, quietly, helps with data protection obligations — being able to produce information about an individual is easier when you have a searchable archive than when you have a 93-day window.

How to check where you stand

Ask one question: if someone deleted an important folder six months ago and we noticed today, could we get it back?

If the answer is no, or the honest answer is “I think so”, you have found the gap. If the answer is yes, ask the follow-up: when did we last actually do that?

The practical position

Microsoft 365 backup is inexpensive, quick to put in place, and almost entirely invisible once running. The reason it gets skipped is not cost — it is that the gap is genuinely not obvious, and nobody discovers it until the day it matters.

If you are not sure whether your tenant is backed up or merely retained, that is a five-minute answer we are happy to give you.

Found this useful?

September 19, 2026

Every status you set has its own forwarding rules sitting behind it. Setting them up once means calls go somewhere sensible whether you are at your desk, in a meeting or on a train.

Read →