Mostly no. Microsoft keeps the lights on; protecting your data from deletion, ransomware and departing staff is your job.
Resources / Microsoft 365 Backup
Mostly no. Microsoft keeps the Microsoft 365 service running; it does not keep an independent backup of your emails and files. Under Microsoft's shared responsibility model, the platform is their job and your data is yours.1 What feels like a backup is really a set of retention windows measured in days, and Microsoft's own service agreement recommends backing up your content with third-party services.2 Here is where the gaps are and what a real backup looks like.
how long deleted Microsoft 365 data typically survives, depending where it lived
under the shared responsibility model, the data is yours to protect
the rule a real backup follows: three copies, two media, one off-platform
Microsoft protects the service: the data centres, the uptime, the redundancy that means a failed disk on their side never loses your mailbox.3 That protection is genuinely excellent, and it is also not the risk that hurts small businesses. The incidents that actually cost people data are deletions, overwrites, ransomware and account mistakes, and those all happen on your side of the shared responsibility line. Microsoft faithfully preserves whatever you do to your own data, including the damage.
| What happened | Recovery window | After that |
|---|---|---|
| An email deleted from Deleted Items | Typically 14 to 30 days in the recoverable items area | Gone |
| A file deleted from OneDrive or SharePoint | 93 days across the two recycle bins | Gone |
| A departed employee's account is deleted | About 30 days for their mailbox and files | Gone |
| A file overwritten or encrypted by ransomware | Version history, while versions last | Whatever synced, everywhere |
These windows are conveniences, not backups. They run on default settings most small businesses never change, and none of them gives you what a backup gives you: the ability to restore everything to how it looked at a point in time.
The departed employee. An account gets deleted in an offboarding tidy-up, and a month later their mailbox, and every quote and approval in it, is unrecoverable.4 This is the single most common way small businesses lose Microsoft 365 data.
Ransomware that syncs. OneDrive is sync, not backup: encrypt the files on one laptop and the encrypted versions sync everywhere. Version history helps if you catch it quickly; it is not designed to unwind a whole drive reliably.
The slow discovery. Retention windows assume you notice the loss within days. Real businesses often discover a missing folder months later, when the window is long closed.
Retention policies mistaken for backup. Litigation hold and retention policies are compliance tools. They keep specific things for legal reasons; they are not a restorable copy of your business.
Yes, in writing. Microsoft's services agreement states plainly that it recommends regular backups of your content and data with third-party apps and services.2 The shared responsibility model says the same thing in architecture terms. The confusion exists because "it's in the cloud" feels like "it's backed up", and for the everyday failure modes that matter, it is not.
An independent copy, outside Microsoft's platform, taken automatically several times a day, covering Exchange mailboxes, OneDrive, SharePoint and Teams, with point-in-time restore and no time limit on how far back you can reach. It follows the Essential Eight's regular backups control, including the part almost everyone skips: actually test-restoring. We set this up as part of managed IT, and it is one of the cheapest pieces of insurance a business can buy; the software typically costs a few dollars per user per month.
Essential Eight for small business: regular backups is one of the eight controls.
The 10-step Microsoft 365 migration plan: moving in properly in the first place.
All resources: tools, guides and case studies.
Not in the way most owners assume. Microsoft protects the service itself: the servers, the uptime, the infrastructure. Your emails and files are covered by limited retention windows, not by an independent backup, and Microsoft's own service agreement recommends you regularly back up your content using third-party services.
No. OneDrive is sync, not backup. If a file is deleted, corrupted or encrypted by ransomware on one device, OneDrive faithfully syncs that damage everywhere. Version history and the recycle bin soften the blow for a while, but they are recovery conveniences with time limits, not an independent copy of your data.
It depends where the data lived. Deleted emails are typically recoverable for 14 to 30 days after leaving the Deleted Items folder. SharePoint and OneDrive recycle bins hold files for 93 days. When a staff member's account is deleted, their mailbox and files are generally gone about 30 days later.
If losing your email or files for good would hurt the business, yes. A real backup keeps an independent copy outside Microsoft's platform with point-in-time restore, covering Exchange, OneDrive, SharePoint and Teams. It is one of the cheapest pieces of insurance in IT.
Regular backups are one of the eight controls, and the maturity model expects backups to be retained and actually tested. Relying on Microsoft's default retention windows alone would not meet the intent of the control.
General information only. This article does not account for your specific circumstances and is not legal, financial, or professional advice. For guidance on your situation, get in touch.
Tell us your team size and setup. We'll tell you what is and isn't protected today, and what proper backup would cost. One business day, no obligation.
Prefer to talk? Call (02) 9053 8789.
Belivanis Information Systems