Does Microsoft 365 Back Up Your Data? What Businesses Should Know

A real estate brokerage in Oakville loses its office administrator to another job. To save a licence, IT deletes her account the following week. Three months later, a dispute comes up with a buyer, and the team needs the emails she exchanged with the buyer's lawyer. The mailbox is gone, permanently.

Nobody made a glaring mistake. Like many small businesses, the brokerage simply assumed that "it's all in the cloud, so it's all backed up." But Microsoft 365 keeps your data available; it doesn't keep it indefinitely so you can go back in time.

So the question isn't whether Microsoft is reliable. It's what happens when the problem starts on your side: an employee, a departure, a hijacked account or ransomware.

What Microsoft guarantees, and what it doesn't

Microsoft publishes a shared responsibility model. For a SaaS service like Microsoft 365, Microsoft takes care of the datacentres, network, servers and software. But for every type of cloud service, Microsoft is explicit: you own your data and identities, and you're responsible for protecting them. Data, configurations and account management stay on your side of the line.

In practice, Microsoft replicates your email and files across several datacentres. If a server fails, you notice nothing. But replication copies your mistakes too: a deleted folder or files encrypted by ransomware get faithfully reproduced everywhere.

The scenarios that cause trouble almost always start on your side:

• an employee deletes a SharePoint folder by mistake and nobody notices for months;
• deleting a departing employee's account takes their mailbox and OneDrive with it;
• a compromised admin account is used to wipe data or empty the recycle bins;
• an infected laptop syncs encrypted files into OneDrive.

Built-in safety nets, and their limits

Microsoft 365 does include recovery features. The problem is how long they last.

These tools are great for yesterday's mistake. They're much less useful for a mistake discovered four months later, or against an attacker with admin rights.

Retention isn't backup

Retention policies and holds (Microsoft Purview, Litigation Hold) prevent covered content from being permanently deleted for a set period. They serve a compliance need: finding an email for an investigation or a lawsuit.

They don't replace a backup, for three reasons. Recovery means searching and exporting, not restoring the original folder structure to a specific date. The policies are managed by the same admin accounts that could be compromised. And retention won't put a SharePoint site back in working order after mass encryption.

They're still useful as a complement. For example, applying a hold to mailboxes before deleting an account keeps the mailbox as an inactive mailbox instead of losing it after 30 days. That's the kind of setting we check in a Microsoft 365 security audit.

Microsoft 365 Backup or a third-party tool?

Microsoft also offers its own paid service, Microsoft 365 Backup, which you turn on from the admin centre. According to Microsoft's documentation:

• it protects OneDrive, SharePoint and Exchange Online;
• the recovery window can be set to 3 months, 6 months, 1 year or 2 years;
• restore points are taken every 10 minutes for two weeks, then weekly, for OneDrive and SharePoint, and every 10 minutes for Exchange;
• the list price is US$0.15 per GB of protected content per month, billed pay-as-you-go, and restores are free;
• backups stay inside the Microsoft 365 environment in append-only storage, which prevents them from being modified.

As a rough illustration, 500 GB of protected content works out to US$75 a month at list price, though the billed volume also includes some deleted and versioned content.

The main advantage is restore speed. The limitation: the backup lives with the same provider, managed from the same tenant. A Backup admin can delete the backups (Microsoft provides a 90-day grace period), and the service only covers the three workloads listed.

A third-party tool stores a copy outside your tenant, with its own credentials. That's the cloud equivalent of the isolated copy in the 3-2-1-1-0 backup rule. The trade-off: large restores can be slower, and coverage varies from product to product. Our Microsoft 365 backup comparison reviews the native and third-party options.

How to decide for your business

• Name the scenarios that worry you: human error, employee departure, hijacked admin account, ransomware
• Set how far back you need to be able to go, based on your retention obligations
• Set an acceptable restore time for email and shared files
• Check whether the backup console has credentials and MFA separate from your Microsoft 365 admins
• Check where copies are stored, and whether they can stay in Canada
• Add a "shared mailbox or hold" step to your offboarding procedure before any account is deleted (see our employee offboarding checklist)
• Test a restore every quarter: one email, one folder, one full OneDrive

The bottom line

Microsoft 365 is reliable, but it isn't designed to protect you from your own mistakes beyond a few weeks. If an email from 2024 or a folder deleted last summer could one day matter to your business, you need a real backup, native or third-party, and a tested restore.

Our Microsoft 365 and Google Workspace audit reviews your retention settings, offboarding procedures and admin account protection, then recommends the backup option that fits your size.