Many owners assume Microsoft 365 is backed up because it lives in the cloud. It is not. Microsoft protects its own servers. It does not protect you from your own mistakes, a departing employee, or ransomware.
That gap is easy to miss until a folder disappears and the recycle bin is empty. Here is what Microsoft actually covers and how to close the rest.
1. What Microsoft 365 does and does not protect
Microsoft runs on a shared responsibility model. They keep the platform available. You are responsible for the data inside it.
- Microsoft covers: data center outages, hardware failures, and keeping Exchange, OneDrive, and SharePoint online.
- You cover: accidental deletion, overwritten files, malicious insiders, compromised accounts, and ransomware.
- Retention is short. Deleted email is typically recoverable for 14 to 30 days, and recycle bins hold files for about 93 days. Then it is gone for good.
Sync is the other trap. OneDrive mirrors changes, so a deleted or encrypted file on one laptop spreads to every copy. That is why sync is not a backup, the same point we make in our OneDrive vs SharePoint vs Teams guide.
2. The real ways businesses lose Microsoft 365 data
Most losses are boring, not dramatic:
- Accidental deletion. Someone removes a shared folder or a whole mailbox and nobody notices for a month.
- Ransomware and account takeover. An attacker who gets in through business email compromise can delete or encrypt cloud files too. See our notes on how ransomware gets in.
- Departing employees. When an account is deleted at offboarding, its mailbox and OneDrive can be purged after a short window. Our offboarding checklist covers the handoff.
- Legal and insurance requests. You may need a year-old email, and the default retention will not have it.
3. How to back up Microsoft 365 properly
A good setup is simple and follows the same logic as any backup and disaster recovery plan:
- Cover everything. Exchange Online mailboxes, OneDrive, SharePoint sites, and Teams files and chats.
- Store it separately. The backup must live outside your Microsoft tenant, in an account an attacker cannot reach with a stolen admin login.
- Run it daily. Automated backups at least once a day keep your recovery point close to now.
- Protect the admin account. Use multi-factor authentication on the backup console and on every global admin.
- Test restores. Once a quarter, recover a mailbox and a folder. An untested backup is a guess.
Google customers face the same issue, which we cover in our Google Workspace backup guide.
The takeaway
Microsoft 365 is a reliable service, but it is not a safety net for your data. Add an independent daily backup of email, OneDrive, SharePoint, and Teams, keep it outside your tenant, and test a restore each quarter. The cost is small next to a lost client folder or a week of rebuilding.
Frequently asked questions
Does Microsoft 365 back up my data?
Microsoft keeps the service running and protects against its own hardware failures, but it does not promise to restore your data after you delete it, a user overwrites it, or ransomware encrypts it. Under the shared responsibility model, protecting your data is your job.
How long does Microsoft 365 keep deleted items?
It depends on the item and the license. Deleted email usually sits in Recoverable Items for 14 to 30 days, and OneDrive and SharePoint recycle bins hold files for about 93 days. After that the data is permanently gone.
Is OneDrive a backup?
No. OneDrive syncs files, so a deletion or an encrypted file on one device quickly spreads to the cloud copy. Version history helps for a while, but it is not an independent backup.
What should a Microsoft 365 backup cover?
At minimum, Exchange Online mailboxes, OneDrive, SharePoint sites, and Teams files and chats. Add calendars and contacts, and keep the backup in a separate account from your main tenant.
How much does Microsoft 365 backup cost?
Third-party backup typically runs a few dollars per user per month. For a 10-person office that is far less than a single day of downtime or one lost client folder.
Want Microsoft 365 backup set up for you?
Call Ghosxt at (831) 204-0501. We configure and monitor independent Microsoft 365 backups, and test restores, for businesses across Salinas and the Central Coast, and you talk directly to the owner. See current pricing or our managed IT services.
Book your free assessmentPrefer to talk first? Email sales@ghosxt.com or call (831) 204-0501.