Microsoft 365 Backup: What Microsoft Keeps, What It Doesn't, and What You Need

Microsoft is responsible for keeping the Microsoft 365 service running: the data centres, the hardware, the replication between them, and recovering from a disaster on their side. Microsoft's own documentation describes multiple physically redundant copies of your data for exactly that purpose.

Microsoft is not responsible for what you and your staff do to the data: deleting it, overwriting it, encrypting it with ransomware through a compromised account, or an admin removing a user and their OneDrive. For those, Microsoft provides recycle bins and retention features with fixed windows, and beyond those windows the data is gone.

The practical test: if a disgruntled leaver deleted a shared mailbox and a SharePoint library on their last day and nobody noticed for four months, could you get it back? With the defaults, no.

These are the built-in recovery windows, from Microsoft's documentation. They are safety nets for everyday mistakes, and they are all measured in days.

Three things these windows do not cover:

• Anything older than the window. The typical discovery time for a data problem is longer than 30 days.
• Ransomware or bulk overwrites. File versioning helps, but a compromised account with permissions can delete versions and empty recycle bins.
• Point-in-time restore of a whole site or mailbox. The recycle bin gives you back individual items; it does not roll a site back to how it looked last Tuesday.

Purview retention policies (included with Business Premium) can hold content for longer, and are valuable for compliance, but they are designed to preserve content for legal and regulatory reasons, not to restore a working environment quickly after an incident. Microsoft's own backup documentation makes the point that what matters in a crisis is the ability to restore to a healthy state quickly.

Microsoft 365 Backup

Microsoft's own backup product, run from the Microsoft 365 admin centre and billed pay-as-you-go through an Azure subscription. Verified details from Microsoft Learn (August 2026):

• Protects OneDrive accounts, SharePoint sites and Exchange mailboxes, all or selected.
• Restore points every 10 minutes for the previous two weeks, then weekly; recovery window configurable from 3 months to 2 years, 1 year by default.
• Restores a whole site or OneDrive to a prior point in time, or individual mailbox items.
• Backups are stored inside Microsoft 365's own boundary on append-only storage, so ransomware or a rogue admin cannot alter existing restore points; deletion of the backups is possible but protected by a 90-day grace period and multi-admin notifications.
• List price $0.15 per GB per month of protected content; restores are free. UK billing is through Azure at the prevailing rate.

Strengths: very fast restores of large volumes, no data leaving Microsoft, simple to switch on. Limits: it lives inside the same tenant it protects (separation is logical, not physical), it does not cover every workload some third-party tools do (for example Planner or Teams-specific settings), and the cost scales with data size rather than user count.

Third-party backup services

Products from established backup vendors copy your Microsoft 365 data to their own storage, usually daily or more often, and typically price per user per month. Strengths: an independent copy outside Microsoft, broader workload coverage, long retention, granular search and restore. Limits: restores of large volumes are slower because the data has to come back over the internet; and you are trusting a second provider with your data, so their security and UK data residency matter.

Doing nothing beyond the defaults

A choice some businesses make consciously and many make by accident. It is defensible only if losing everything older than a month would not hurt, which is true of almost no one.

Whichever you choose, three things matter more than the product:

1. Test a restore at least twice a year: an individual email, a whole OneDrive, a SharePoint library.
2. Protect the backup admin accounts with MFA and separate credentials. A backup an attacker can delete is not a backup.
3. Decide the retention deliberately. One year is a sensible minimum; some contracts require more.

A worked example for a 25-person business with 400 GB across mailboxes, OneDrive and SharePoint, using Microsoft's list price and typical market rates; assumptions stated.

Both are small next to the cost of losing the data, which we will not try to put a fabricated number on. The right comparison is with what the recycle bin gives you for free: 30 to 93 days of individual-item recovery and no whole-site restore. For most businesses that is the argument.

Backup is part of our security baseline for every client: we choose the product to fit the business, configure retention, protect the backup credentials, and test restores on a schedule so that the first restore you rely on is not the first one anyone has tried.

If you are reviewing your Microsoft 365 licensing at the same time, our licensing and security guide covers what Business Premium includes (retention and labelling, but not backup), and the Copilot guide explains why tidy, well-protected data matters twice over once AI can read it.