Microsoft 365 Backup: What Microsoft Keeps, What It Doesn't, and What You Need

Microsoft is responsible for keeping the Microsoft 365 service running: the data centres, the hardware, the replication between them, and recovering from a disaster on their side. Microsoft's own documentation describes multiple physically redundant copies of your data for exactly that purpose.

Microsoft is not responsible for what you and your staff do to the data: deleting it, overwriting it, encrypting it with ransomware through a compromised account, or an admin removing a user and their OneDrive. For those, Microsoft provides recycle bins and retention features with fixed windows, and beyond those windows the data is gone.

The practical test: if a disgruntled leaver deleted a shared mailbox and a SharePoint library on their last day and nobody noticed for four months, could you get it back? With the defaults, no.

These are the built-in recovery windows, from Microsoft's documentation. They are safety nets for everyday mistakes, and they are all measured in days.

Three things these windows do not cover:

• Anything older than the window. The typical discovery time for a data problem is longer than 30 days.
• Ransomware or bulk overwrites. File versioning helps, but a compromised account with permissions can delete versions and empty recycle bins.
• Point-in-time restore of a whole site or mailbox. The recycle bin gives you back individual items; it does not roll a site back to how it looked last Tuesday.

Purview retention policies (included with Business Premium) can hold content for longer, and are valuable for compliance, but they are designed to preserve content for legal and regulatory reasons, not to restore a working environment quickly after an incident. Microsoft's own backup documentation makes the point that what matters in a crisis is the ability to restore to a healthy state quickly.

Everything above applies to Google Workspace with the numbers changed. Google keeps the service running and keeps redundant copies for its own recovery. It does not keep your data for you once it has been deleted.

• Gmail and Drive. A deleted email or file sits in the Bin for 30 days, then it is gone. An administrator can recover a user's deleted Drive files for up to 25 days after they were removed from the Bin, and only if the file was owned by that user. After that, nothing.
• A deleted user. When a leaver's account is deleted, their Gmail and Drive go with it. Google gives administrators a 20-day window to restore the account; after that the data is unrecoverable. Suspending rather than deleting keeps the data but keeps the licence cost too.
• Google Vault is not a backup. Vault holds and searches data for legal and compliance purposes. It cannot restore a folder structure, sharing permissions or a user's Drive as it was, it only covers licensed users and the content types you set retention on, and it lives inside the same tenant as the data it holds. Google's own documentation describes it as retention and eDiscovery, not recovery.
• Ransomware and sync. Drive for desktop syncs encrypted files up just as OneDrive does. Version history helps for a handful of files and is hopeless for ten thousand.

The answer is the same as for Microsoft 365: a separate, third-party backup of Gmail, Drive, shared drives, Calendar and Contacts, held outside your Google tenant, with restores that put things back where they were. We provide it for Workspace clients on the same basis as Microsoft 365: see Google Workspace backup.

Microsoft 365 Backup

Microsoft's own backup product, run from the Microsoft 365 admin centre and billed pay-as-you-go through an Azure subscription. Verified details from Microsoft Learn (August 2026):

• Protects OneDrive accounts, SharePoint sites and Exchange mailboxes, all or selected.
• Restore points every 10 minutes for the previous two weeks, then weekly; recovery window configurable from 3 months to 2 years, 1 year by default.
• Restores a whole site or OneDrive to a prior point in time, or individual mailbox items.
• Backups are stored inside Microsoft 365's own boundary on append-only storage, so ransomware or a rogue admin cannot alter existing restore points; deletion of the backups is possible but protected by a 90-day grace period and multi-admin notifications.
• List price $0.15 per GB per month of protected content; restores are free. UK billing is through Azure at the prevailing rate.

Strengths: very fast restores of large volumes, no data leaving Microsoft, simple to switch on. Limits: it lives inside the same tenant it protects (separation is logical, not physical), it does not cover every workload some third-party tools do (for example Planner or Teams-specific settings), and the cost scales with data size rather than user count.

Third-party backup services

Products from established backup vendors copy your Microsoft 365 data to their own storage, usually daily or more often, and typically price per user per month. Strengths: an independent copy outside Microsoft, broader workload coverage, long retention, granular search and restore. Limits: restores of large volumes are slower because the data has to come back over the internet; and you are trusting a second provider with your data, so their security and UK data residency matter.

Doing nothing beyond the defaults

A choice some businesses make consciously and many make by accident. It is defensible only if losing everything older than a month would not hurt, which is true of almost no one.

Whichever you choose, three things matter more than the product:

1. Test a restore at least twice a year: an individual email, a whole OneDrive, a SharePoint library.
2. Protect the backup admin accounts with MFA and separate credentials. A backup an attacker can delete is not a backup.
3. Decide the retention deliberately. One year is a sensible minimum; some contracts require more.

A worked example for a 25-person business with 400 GB across mailboxes, OneDrive and SharePoint, using Microsoft's list price and typical market rates; assumptions stated.

Both are small next to the cost of losing the data, which we will not try to put a fabricated number on. The right comparison is with what the recycle bin gives you for free: 30 to 93 days of individual-item recovery and no whole-site restore. For most businesses that is the argument.

Backup is part of our security baseline for every client: we choose the product to fit the business, configure retention, protect the backup credentials, and test restores on a schedule so that the first restore you rely on is not the first one anyone has tried.

If you are reviewing your Microsoft 365 licensing at the same time, our licensing and security guide covers what Business Premium includes (retention and labelling, but not backup), and the Copilot guide explains why tidy, well-protected data matters twice over once AI can read it.