Discussing data protection requirements
Microsoft 365 Partner · CSP Reseller

Microsoft 365 Backup

Microsoft protects its infrastructure. It does not protect you from a deletion nobody noticed until four months later.

This page sets out exactly what the recycle bin, version history and retention policies cover, where the gap actually is, and how to work out whether it matters enough for you to spend on.

No, Microsoft 365 is not backed up. Microsoft operates a shared responsibility model: it protects the platform against infrastructure failure, and your data and configuration remain yours to protect. The recycle bin covers days and weeks; version history covers accidents caught quickly; retention policy is a compliance tool, not a recovery one. The loss that actually happens — something deleted and missed for months — is covered by none of them.

Being fair to Microsoft

What Microsoft genuinely does provide

All four of these are real and useful. The problem is not that Microsoft provides too little; it is that these are routinely described as a backup, which they are not.

shield

Protects its own infrastructure

Redundancy across datacentres, hardware failure, and the platform staying available. This is genuinely excellent and it is what Microsoft's availability commitments are about. It is not about protecting you from yourself.

restore

Recycle bin, for a period

Deleted items and files are recoverable for a limited window. Beyond that window they are gone. The window is measured in days and weeks, not years.

history

Version history

Previous versions of files in SharePoint and OneDrive. Useful for accidents found quickly. Useless if the file itself was deleted and the deletion has aged out.

policy

Retention policies

Retain or delete content according to rules you configure. This is a compliance tool, not a backup — it governs what is kept, and it is not designed for restoring a working state.

Scenario by scenario

What is and is not covered

The last row is what Microsoft’s redundancy protects against, and it is not the risk you actually face. The first three are.

ScenarioCovered?Why
A file deleted and noticed four months laterNoPast every recycle bin window. This is the single most common real-world loss.
A departed employee's OneDrive, after the retention windowNoDeleted with the account once the configurable window lapses.
A SharePoint site deleted in error and noticed lateNoRecoverable for a period, then not.
Ransomware that encrypted filesPartlyVersion history often allows rollback. Depends on scope and on how quickly it is caught.
Something deleted yesterdayYesRecycle bin handles this well. This is the case people generalise from.
A malicious insider clearing a mailboxPartlyDepends on retention configuration and on whether litigation hold was in place beforehand.
Microsoft losing your data through infrastructure failureYesThis is precisely what Microsoft's redundancy is for, and it is not the risk you face.
Before you buy anything

Five questions that decide it

Backup is a real category with real value, and it is also sold hard on fear. These five questions establish whether you have a genuine exposure or are being sold an insurance policy against something that would not actually hurt you.

1

Could you reconstruct a year-old file if it vanished?

If not, you have a gap worth costing.

2

Do you have regulatory or contractual retention obligations?

Retention policies may satisfy these. Check, rather than assume backup covers it.

3

How long could you operate without a given SharePoint site?

That answer is your recovery objective, and it drives the product choice.

4

Who can delete things at scale?

Every global admin. That is a reason both to limit admins and to hold a copy outside.

5

Would you notice a quiet deletion within thirty days?

Most organisations would not, which is what makes the recycle bin window misleading.

Microsoft 365 backup — common questions

help

Does Microsoft back up Microsoft 365?

expand_more

Not in the sense most people mean. Microsoft protects its own infrastructure against hardware and datacentre failure, and provides a recycle bin, version history and retention policies. None of that is a backup you control, and none of it helps with something deleted and discovered months later. Microsoft describes this as a shared responsibility model: the platform is theirs, your data and configuration are yours.

help

Is the recycle bin enough?

expand_more

For something deleted yesterday, yes, and that is the case people generalise from. The recycle bin window is measured in days and weeks. The losses that actually hurt are noticed months later — a file somebody needed for an audit, a folder deleted during a tidy-up in March and wanted in September. Those are past every window.

help

Is OneDrive sync a backup?

expand_more

No, and this is a genuinely dangerous assumption. Sync replicates changes, including deletions — delete a file on your laptop and it deletes in the cloud. Version history and the recycle bin cover accidents caught reasonably quickly. Sync itself is the opposite of a backup: it propagates the mistake faithfully.

help

Does retention policy count as backup?

expand_more

It is a compliance control, not a recovery tool. Retention governs what must be kept and for how long, and it can preserve content beyond deletion. What it does not give you is a straightforward way to restore a working state — a site as it looked on a particular Tuesday, with structure and permissions intact. Those are different problems and they need different tools.

help

Do we actually need third-party backup?

expand_more

It depends on what losing data would cost you, and the honest answer for some small businesses is no. The test we use: could you reconstruct a year-old file if it disappeared, and would you notice a quiet deletion within thirty days? If the answer to both is no and the data matters, you have a gap worth costing. If your genuinely critical records live in an accounting system that is backed up separately, the gap may be narrower than a backup vendor would suggest.

help

What does ransomware do to Microsoft 365?

expand_more

Typically it encrypts files on a laptop, and sync dutifully carries the encrypted versions into OneDrive and SharePoint. Version history means earlier copies often survive and can be rolled back, and OneDrive supports a point-in-time restore. That is a real advantage over a local drive, and it is not complete — coverage depends on scope, on how fast it is caught, and on retention settings.

help

Does Business Premium include backup?

expand_more

No. Business Premium adds security capability — Defender for Business, Intune, Purview Information Protection — which reduces the chance of an incident. None of it is backup. This distinction matters because Premium is frequently sold as covering data protection, and the two are not the same thing.

help

What would you recommend?

expand_more

Start by working out what you would lose and how long you could operate without it, because that determines whether this is worth spending on at all. If it is, third-party backup for Microsoft 365 is a mature and inexpensive category, and we will scope and price it as a separate line rather than folding it into a licence quote where it becomes invisible.

Assess your actual exposure

We will work out what you would lose, how long you could operate without it, and whether your current setup already covers it. Sometimes the answer is that you do not need to spend anything.

  • check_circle

    A recovery requirement established before any product is discussed

  • check_circle

    Backup quoted as a separate line, not buried in a licence quote

  • check_circle

    We will tell you when the gap is not worth closing

What Microsoft 365 protects when an office floods — and the deletion gap it does not — is worked through on our page for Microsoft 365 partner in Alappuzha.

Prefer to talk first? Call +91 99467 89916 or email admin@techgeum.com.

call