Not in the way most people mean. Microsoft keeps several copies of your Microsoft 365 data across its data centres, so a failure at Microsoft’s end shouldn’t lose your emails or files. But it doesn’t protect you from your own side: a folder deleted by mistake, files scrambled by ransomware, or a leaver’s mailbox that disappears when their account is removed. Microsoft’s own shared responsibility model says you always remain responsible for your data, and the recycle bins built into Microsoft 365 are time-limited safety nets, not a backup.
What Microsoft looks after, and what you do
Microsoft publishes a “shared responsibility” model for its cloud services. For software it runs for you, such as Microsoft 365, Microsoft looks after the data centres, the physical network, the servers and the software platform. But Microsoft says that whatever type of cloud service you use, you always keep responsibility for:
- your data, including how it’s protected
- the devices that connect to your cloud services
- your user accounts, including adding and removing people
- who has access, including multi-factor authentication
In other words, Microsoft keeps the service running. Making sure you can get your data back after something goes wrong at your end is down to you.
What Microsoft 365 keeps, and for how long
Microsoft 365 does have some useful recovery features. Each one has a time limit:
- Deleted emails. Once an email is emptied from Deleted Items, it can be recovered for 14 days by default. An administrator can extend that to a maximum of 30 days. After that, it’s gone.
- Files in OneDrive, SharePoint and Teams. Deleted files sit in recycle bins for 93 days from the moment they were deleted, then they’re permanently removed.
- Version history. Earlier versions of a document are kept up to the limits your administrator sets. Versions that fall outside those limits are deleted permanently and don’t go to the recycle bin.
- Restore your OneDrive. Each person can roll their whole OneDrive back to any point in the last 30 days, which is useful after malware.
- Deleted users. When you delete a user, their account and mailbox can be restored for 30 days, then they’re permanently deleted. Their OneDrive is kept for 30 days by default, then moves to a recycle bin for 93 days.
Those features help with small, quickly noticed mistakes. They weren’t designed to be your only copy.
What small businesses get wrong
Assuming someone will notice in time. A folder deleted in spring might not be missed until the year-end accounts, months after the 93-day recycle bin has emptied. An email deleted in a tidy-up is gone after 14 days unless the setting has been changed.
Thinking sync is a backup. OneDrive and SharePoint sync is brilliant for working anywhere, but it syncs mistakes too. Delete a folder on one laptop and it’s deleted everywhere. If ransomware encrypts files on a synced laptop, the encrypted versions sync to the cloud.
Relying on recovery features during an attack. Restore your OneDrive works one person at a time and only goes back 30 days. Shared SharePoint libraries and Teams files need recovering separately. And recycle bins can be emptied by a user, an administrator, or an attacker who has got into their account.
Deleting leavers to save a licence. It’s common to delete a leaver’s account at the end of the month to stop paying for it. That starts the 30-day clocks on their mailbox and OneDrive, and if nobody copies what matters in time, the client emails and files they handled are lost. Converting the mailbox to a shared mailbox, which needs no licence up to 50 GB, is often a better route, and a backup taken before the account is removed is better still.
Mistaking retention policies for backup. Microsoft 365 can keep copies of content for compliance using retention policies, but they have to be set up in advance and they’re built for keeping records, not for putting a mailbox or site back the way it was last Tuesday. Microsoft itself keeps its backup product separate from them.
Microsoft sells a backup too
Microsoft offers its own Microsoft 365 Backup, a separate pay-as-you-go service for Exchange mailboxes, OneDrive and SharePoint, charged per gigabyte of data protected. Microsoft’s documentation describes it as protection against ransomware and accidental or malicious deletion, with recovery windows of up to two years. Other backup products for Microsoft 365 do a similar job. That a separate product exists tells you the built-in recycle bins aren’t meant to do that job on their own.
What a proper Microsoft 365 backup looks like
- It covers everything. Mailboxes, OneDrive, SharePoint sites and the files in Teams, which are stored in SharePoint.
- It runs automatically, at least daily. Nobody has to remember to start it.
- It keeps copies long enough. A year or more, so problems discovered late can still be fixed.
- It’s protected from attackers. Separate, tightly controlled admin access with multi-factor authentication, and copies that can’t simply be deleted from your Microsoft 365 account.
- It keeps leavers’ data. Check what happens to a backup when you remove someone’s licence, and decide how long you need their emails and files.
- Someone checks it. Backups that fail quietly are a common surprise. Someone should watch the alerts and test a restore from time to time.
- It doesn’t stop at Microsoft 365. Files saved only on a laptop’s desktop, or a database on an office server, need protecting too.
How we handle backup for our clients
Daily backups and a disaster recovery plan are part of our managed IT service, monitored by our team rather than left to run unchecked. We also look after the Microsoft 365 security settings that stop an attacker getting far enough to delete anything, and handle leavers properly, so their mailbox and files are kept for as long as you need them.
If you’re not sure what would happen if a folder, a mailbox or a whole SharePoint site disappeared tomorrow, we can check what you have and tell you where the gaps are. Find out more about our backup and disaster recovery and Microsoft 365 support, see what’s included in our pricing, or book a call.
Sources
- Microsoft Learn, Shared responsibility in the cloud
- Microsoft Learn, Recoverable Items folder in Exchange Online
- Microsoft Support, Restore items in the recycle bin that were deleted from SharePoint or Teams
- Microsoft Learn, Version history limits for document library and OneDrive
- Microsoft Support, Restore your OneDrive
- Microsoft Learn, Delete or restore user mailboxes in Exchange Online
- Microsoft Learn, OneDrive retention and deletion
- Microsoft Learn, About shared mailboxes
- Microsoft Learn, Overview of Microsoft 365 Backup