Microsoft 365 Backup: Why It's Still Necessary

The shared-responsibility model in plain English

Microsoft's Services Agreement is explicit: 'We recommend that you regularly backup Your Content and Data that you store on the Services.' Microsoft keeps the platform running, patches the servers, and handles hardware failure. You are responsible for the data itself accidental deletion, malicious deletion, ransomware, misconfigured retention, and departing-employee data loss.

What native Microsoft 365 retention actually covers

Retention policies can extend some of these, but they are still not a backup you can't restore a mailbox to a specific point in time, and administrator errors that delete data also delete the retention entries.

• Deleted items folder: 30 days by default in Exchange Online
• Recoverable items (litigation hold): 14-30 days for standard mailboxes without a hold applied
• OneDrive and SharePoint recycle bins: 93 days total across the two-stage bin
• Teams messages: governed by Exchange retention plus complex chat-specific rules

What a dedicated Microsoft 365 backup adds

• Point-in-time restore of mailboxes, OneDrive, SharePoint sites, and Teams
• Long-term retention independent of Microsoft (years, not weeks)
• Granular restore: a single email, a single file version, a single Teams channel
• Protection against ransomware that reaches OneDrive or SharePoint via sync clients
• A recovery path when a departing employee's OneDrive is deleted with their account
• Legal-hold and export capabilities that aren't tied to your active tenant

Real scenarios where backup mattered

In practice, the backups we've restored from most often are: a user who emptied their deleted-items folder and then discovered they still needed an email chain, a departing employee whose OneDrive was purged too aggressively during offboarding, and ransomware that encrypted files locally on a laptop and then synced the encrypted versions up to OneDrive. In each case, native retention would have either partially covered the loss or missed it entirely.

How to choose a Microsoft 365 backup product

• Covers Exchange, OneDrive, SharePoint, and Teams (not just email)
• Stores backups in a separate cloud, not inside your own Microsoft 365 tenant
• Offers immutable storage so backups themselves can't be encrypted or deleted by ransomware
• Supports granular restore without complicated PowerShell scripting
• Priced per user, per month, with reasonable retention included

Common mistakes

• Assuming Microsoft handles backup you're actually responsible
• Relying on litigation hold as a backup it's a legal control, not a recovery tool
• Storing backups inside the same tenant they're protecting
• Not testing restores until an emergency happens

When to call an IT provider

If you can't answer 'where is our Microsoft 365 backup, how far back does it go, and when was the last restore tested?' bring in an MSP. This is a two-week project with a small monthly cost that eliminates a large category of business risk.

Frequently asked questions