Do You Need to Back Up Microsoft 365? What Microsoft Keeps

Yes, most small businesses should back up Microsoft 365. Microsoft keeps the service running and stores redundant copies of your data, but its built-in recovery features are short: 14 days by default for purged email and 93 days for deleted files. A backup is a separate set of restore points that you control, either Microsoft’s own paid Microsoft 365 Backup service or a third-party product. The rest of this guide covers what is kept, for how long, and how to choose.

What Microsoft is responsible for, and what you are

Microsoft publishes a shared responsibility model for its cloud services. For software as a service, which includes Microsoft 365, Microsoft is responsible for the datacenters, the network, the servers, and the application itself. The customer column never changes: customer data, configurations and settings, and identities and users stay your responsibility in every deployment type.

In plain terms, Microsoft protects you against its own hardware failing. It does not decide which of your files matter, notice that someone deleted a folder three months ago, or undo an action taken by a person (or an attacker) signed in with a valid account. A deletion made with valid credentials is a legitimate instruction, and the service carries it out.

How long does Microsoft 365 keep deleted data?

These are the default recovery windows Microsoft documents. Everything in this table is a convenience feature inside your live tenant (your organization’s Microsoft 365 environment), not a separate backup.

What was deleted	Where it goes	How long you have
An email	Deleted Items folder, then the hidden Recoverable Items folder once Deleted Items is emptied	14 days by default in Recoverable Items, adjustable up to 30
A file in OneDrive or SharePoint (including files shared in Teams channels)	Site recycle bin, then the second-stage (site collection) recycle bin	93 days total across both stages, counted from the original deletion
Many files changed at once (for example by ransomware or a bad sync)	Files Restore rolls a whole OneDrive or document library back in time	Any point in the last 30 days
A whole SharePoint site	Deleted sites page in the SharePoint admin center	93 days
A user account	Deleted users page in the Microsoft 365 admin center	30 days to restore the account, mailbox included
A deleted user’s OneDrive	Kept, then moved to the recycle bin	30 days by default (adjustable), then 93 days in the recycle bin

Two details in that table matter more than they look.

First, the 93 days for files is a single clock. If someone empties the first recycle bin on day 10, the file sits in the second stage for the remaining 83 days, and only a site collection administrator can see it there.

Second, the same Microsoft page notes that OneDrive accounts without a valid license are automatically archived on their 93rd unlicensed day. Removing a license from a former employee to save money starts that clock, which is one reason file handover belongs in your offboarding checklist.

After these windows close, the data is gone unless something else was holding it: a retention policy, a hold, or a backup.

Do retention policies count as a backup?

No, although they are useful and they are often confused with one.

A retention policy is a rule set in the Microsoft Purview portal (Microsoft’s compliance tools) that says “keep this content for at least X years” or “delete it after X years,” or both. When a policy is set to retain and a user deletes something, Microsoft keeps a copy out of sight: in the Preservation Hold library for SharePoint and OneDrive, and in the Recoverable Items folder for Exchange mailboxes.

What retention policies do well:

• Stop content from being permanently destroyed before a period you choose, even if a user deletes it.
• Support legal and regulatory record keeping, and feed eDiscovery searches.
• Automatically delete old content when you want that.

What they do not do:

• They are not a point-in-time restore. There is no “put this mailbox or site back the way it was on March 3” button. Recovery means an administrator searching for the preserved items and exporting or copying them back, one search at a time.
• They live inside the same tenant. The preserved copies sit in the same Microsoft 365 environment as the originals, under the same administrator accounts. An attacker or a mistake at the admin level can change or remove the policy.
• They use your storage. Microsoft notes the Preservation Hold library counts against the site’s storage quota.
• A delete setting is a delete setting. A policy configured to remove mail after seven years will do exactly that, including mail you later wish you had.
• Licensing varies. Per Microsoft’s Purview service description, organization-wide retention policies need Microsoft 365 Business Premium or an enterprise plan. Business Basic and Business Standard do not grant those rights on their own.

Retention answers “are we keeping what we are required to keep?” Backup answers “can we get back to how things were yesterday?” A careful office wants both. Our guide to Microsoft 365 email archiving covers the retention side in more detail.

What is Microsoft 365 Backup, and what does it cost?

Microsoft 365 Backup is Microsoft’s own paid backup service, separate from your user licenses. According to Microsoft’s overview, as of September 2026 it works like this:

• What it covers: OneDrive accounts, SharePoint sites, and Exchange mailboxes. You choose all of them or selected ones. Files shared in Teams channels live in SharePoint sites, so they are covered when the site is. Teams chat messages are not in Microsoft’s list of protected workloads.
• Restore points: for OneDrive and SharePoint, every 10 minutes for the most recent two weeks, then weekly snapshots for weeks 2 through 52. For Exchange, every 10 minutes for the prior 52 weeks.
• How far back: the recovery window is set per backup policy at 3 months, 6 months, 1 year, or 2 years. Existing policies default to 1 year.
• Restores: whole OneDrive accounts and SharePoint sites roll back to a prior point in time. Mailboxes restore modified or deleted items, either everything or individual items found by search.
• Protection from tampering: Microsoft describes the backup storage as append-only, and says retention and deletion policies do not affect the backup. Backups can still be deleted by a backup administrator through offboarding, with a 90-day grace period.
• Where it lives: inside Microsoft’s own cloud. Microsoft states that data never leaves the Microsoft 365 data trust boundary, which is a large part of why restores are fast.

Pricing

The list price is $0.15 per GB per month of protected content as of September 2026, and restores are free. It is billed as a pay-as-you-go service through an Azure subscription, which is Microsoft’s cloud billing account. Microsoft says there are no extra Azure storage or API charges on top.

What counts as protected content: the live size of each protected OneDrive, site, and mailbox (online archives included), plus deleted and versioned data the backup is holding for recovery.

As a worked example, picture a ten person office with 25 GB of mail and files per person plus a 100 GB shared SharePoint library. That is 350 GB, or about $52.50 a month at list price, rising as deleted items accumulate inside the recovery window. Microsoft offers a downloadable calculator on the pricing page if you want a closer estimate.

Setup in brief

Per Microsoft’s setup guide, you need an Azure subscription and the SharePoint Administrator or Global Administrator role. In the Microsoft 365 admin center you activate pay-as-you-go services under Setup, in the Billing and licenses section, link the Azure subscription, turn on Backup, and then create one policy each for OneDrive, SharePoint, and Exchange. Microsoft says a new policy takes about an hour to process and another hour to produce its first restore points.

Microsoft 365 Backup or a third-party backup?

Third-party Microsoft 365 backup products connect to your tenant, copy your data on a schedule, and store it somewhere else, usually the vendor’s cloud. Some newer products are instead built on Microsoft’s backup storage platform; Microsoft notes that with those partner applications you pay the partner and get the same underlying restore speed.

Question	Microsoft 365 Backup	Traditional third-party backup
Where are the copies?	Inside Microsoft’s cloud, within the Microsoft 365 boundary	Outside Microsoft, in the vendor’s cloud or storage you choose
Independent of Microsoft and your tenant?	No	Yes, which is what the 3-2-1 backup rule asks for
Retention	Up to 2 years	Set by the vendor, often multi-year or unlimited
Coverage	OneDrive, SharePoint, Exchange	Varies. Many also cover Teams chats, Planner, or groups. Check the list.
Pricing model	Per GB per month, scales with data	Usually per user per month. Ask about storage caps.
Restore speed for a large recovery	A documented strength	Depends on the vendor and on Microsoft’s API limits

Neither is wrong. An office whose main worry is recovering quickly from ransomware or a bad deletion may be well served by Microsoft 365 Backup alone. An office that must keep records for many years, wants a copy that survives a problem with the Microsoft account itself, or needs Teams chat history usually wants a product that stores data outside Microsoft. Some use both.

What should you look for in a Microsoft 365 backup?

Use this as a checklist when comparing products or reviewing what you already have.

1. Coverage. Exchange mailboxes (including shared mailboxes and archives), OneDrive, SharePoint, and, if you rely on it, Teams chat.
2. Automatic and frequent. Several backups a day with no one needing to start them.
3. Retention you set. Long enough for your record keeping needs. If you work under HIPAA or similar rules, confirm the period with your compliance advisor. Our HIPAA IT overview explains where backups fit.
4. Granular restore. One email, one file, one folder, as well as a whole mailbox or site.
5. Separate access. Backup administration protected by its own sign-in and multi-factor authentication, so one compromised account cannot delete both the data and the backups.
6. New users picked up automatically. A backup that misses the person hired last month is a common gap.
7. Former staff. Know whether a departed user’s data stays in the backup and whether it still costs a license.
8. Export. You can get your data out in a standard format if you change products.
9. Alerts. Someone receives and reads failure notices.

Questions to ask a vendor: where is the data stored, is it encrypted, what happens to backups if we stop paying, how long does a full mailbox restore typically take, and will you sign a business associate agreement if we need one?

How to test a restore

A backup that has never been restored is an assumption. A short test once a quarter is enough for most small offices.

1. Pick one real mailbox, one OneDrive, and one SharePoint library.
2. Restore a single email from at least a month ago to a different folder, not over the original.
3. Restore one file and one whole folder to an alternate location. Open them to confirm they are intact.
4. Time each restore and write it down.
5. Confirm the newest employee appears in the backup.
6. Confirm the oldest restore point matches the retention you think you are paying for.
7. Keep the notes. Cyber insurance applications and some compliance reviews ask for evidence of restore testing.

When built-in recovery may be enough

Not every business needs a paid backup on day one. If Microsoft 365 holds only email you could afford to lose, your working files and records live in another system that has its own backup, and no rule requires you to keep records, the recycle bins plus Files Restore may cover the realistic risks. Decide that on purpose, write it down, and revisit it when you start storing more in OneDrive or SharePoint.

Common mistakes

• Treating OneDrive sync as a backup. Sync copies changes both ways, deletions and encrypted files included. See our OneDrive for Business guide.
• Assuming a retention policy can put things back the way they were.
• Deleting a former employee’s account before moving their mail and files somewhere safe.
• Backing up mailboxes but not SharePoint, where shared files usually live.
• Letting every global administrator also administer the backup.
• Never running a test restore.

Common questions

Does Microsoft back up my Microsoft 365 data?

Microsoft keeps multiple redundant copies of your data to protect against its own hardware and datacenter failures. That is not a customer-facing backup. Unless you buy Microsoft 365 Backup or a third-party product, your only recovery options are the recycle bins, Recoverable Items, and Files Restore, which run from 14 to 93 days.

Is Microsoft 365 Backup included in Business Premium?

No. It is a separate pay-as-you-go service billed through an Azure subscription at a list price of $0.15 per GB per month as of September 2026. No Microsoft 365 user license includes it. You turn it on in the Microsoft 365 admin center and choose which mailboxes, OneDrive accounts, and sites to protect.

Can I recover an email deleted six months ago?

Only if something preserved it. By default a purged email is recoverable for 14 days, or up to 30 if an administrator raised the setting. After that it is recoverable only if the mailbox was under a retention policy or Litigation Hold, or if you had a backup with a restore point from before the deletion.

Does ransomware affect files in OneDrive and SharePoint?

It can. Files encrypted on a synced computer sync to the cloud as new versions. Files Restore can roll a OneDrive or library back up to 30 days, and version history may help with individual files. A backup extends that window and does not depend on noticing within 30 days. Our ransomware guide covers prevention.

How we can help

Coastal Growth Co. can review what your Microsoft 365 tenant keeps today, estimate what Microsoft 365 Backup or a third-party product would cost for your data, set up whichever you choose, and run the first test restore with you. Scope and price are agreed before any paid work. See our cloud, email, and Microsoft 365 services or get in touch.