Does Microsoft Back Up Your Microsoft 365 Data?

The short answer: Microsoft keeps several copies of your data so that the service survives hardware failures and datacentre problems. That isn't the same as a backup you can restore from whenever you need to. For your own mistakes, malicious deletions or ransomware, you rely on recycle bins and version history with fixed time limits, typically between 14 and 93 days. Beyond that, you need a backup: Microsoft's paid Microsoft 365 Backup, or a third-party product.

What Microsoft protects

Microsoft designs Exchange Online, SharePoint and OneDrive for resilience. Mailbox databases are kept in multiple copies across datacentres, and SharePoint and OneDrive keep short-term internal backups. These exist to keep the platform running. Microsoft's own documentation notes, for example, that Exchange's delayed database copy isn't intended for recovering individual mailboxes or items.

What you can recover yourself, and for how long

Retention policies and holds, available on some plans, can keep data longer for compliance. They're designed to preserve data, not to restore a working mailbox or site quickly.

Where the gaps are

• Problems noticed late. A folder deleted in January and missed until April is usually gone.
• Leavers. Remove a licence or delete a user without planning, and their mailbox and OneDrive are on a countdown.
• Malicious insiders or compromised admin accounts can delete data and empty recycle bins.
• Ransomware that syncs. Encrypted files on a laptop sync to OneDrive. Files Restore helps, but only within 30 days, and only if someone acts.
• Granular restores. Getting back a single calendar, or a Teams channel's files as they were last month, is awkward or impossible with built-in tools.
• A single copy. Everything lives in one provider's platform, which falls short of the 3-2-1 backup rule.

Option 1: Microsoft 365 Backup

Microsoft's own backup service works from the Microsoft 365 admin centre and covers Exchange, OneDrive and SharePoint.

• Restore points every 10 minutes for recent data, with retention of up to two years depending on the setting you choose.
• Backups are held in append-only storage within Microsoft 365.
• Priced at US$0.15 per GB of protected data per month, billed through an Azure subscription, with no charge for restores.

It's fast and well integrated. The trade-off is that the backup stays inside Microsoft's platform.

Option 2: A third-party backup

Many backup vendors protect Microsoft 365, some using Microsoft's own backup storage platform and others copying data to their own storage. Things to check:

• Which workloads are covered: Exchange, OneDrive, SharePoint and Teams.
• Where the backup is stored, and whether it's outside Microsoft 365 and in the UK.
• Whether backups are immutable, and whether a compromised Microsoft 365 admin account can delete them.
• How easy it is to restore one item, one mailbox or a whole site.
• Pricing per user or per GB, and the retention period.

Quick wins, whatever you choose

1. Raise Exchange's deleted item retention to the 30-day maximum.
2. Have a leaver process that reassigns or exports data before a user is deleted.
3. Turn on multi-factor authentication for every account, especially admins.
4. Test a restore, and write down how you did it.

Help from Apaxon

Apaxon sets up and manages Microsoft 365 for UK businesses, including backup, as part of its managed cloud services and managed IT services. Compare the plans in Microsoft 365 Business Basic vs Standard vs Premium, or get in touch.

Sources

• Microsoft Learn: Exchange Online data resiliency
• Microsoft Learn: SharePoint and OneDrive data resiliency
• Microsoft Learn: Exchange Online limits
• Microsoft Learn: OneDrive retention and deletion
• Microsoft Support: restore your OneDrive
• Microsoft Learn: Microsoft 365 Backup overview
• Microsoft Learn: Microsoft 365 Backup pricing