Microsoft Doesn't Back Up Your Microsoft 365 Data. Read That Again.

Microsoft guarantees that Microsoft 365 stays up. It does not guarantee your data comes back when it’s deleted, overwritten, corrupted by a bad sync, or encrypted by ransomware — under the shared responsibility model, protecting the data itself is your job. If nobody in your company owns a real backup of Exchange, OneDrive, SharePoint and Teams, then nobody is protecting it.

Microsoft 365 shared responsibility, in one sentence

Microsoft protects the service; you protect your data in it. Microsoft runs redundant data centers and meets its uptime commitments, but replication is not backup: when a user deletes a file or ransomware encrypts one, that change replicates everywhere within seconds — faithfully and permanently.

Two details say the quiet part out loud. Microsoft’s own service agreement recommends keeping independent copies of your content. And Microsoft now sells a separate, paid backup product for Microsoft 365 — which would be a strange thing to offer if backup were already included.

What the built-in tools actually give you

The recycle bins and retention windows are real, but they’re short and they aren’t restore tools. OneDrive and SharePoint keep deleted files for around 93 days. A deleted mailbox is typically recoverable for 30 days. After those windows close, the data is gone.

Retention and litigation-hold policies can preserve content longer, but they’re compliance features: pulling a whole mailbox back out of them is slow, manual work, and there’s no way to roll a site or account back to how it looked yesterday at 4 p.m. Versioning helps with some overwrites, but ransomware that encrypts thousands of files — or a sync client replaying bad changes — can outrun what versions alone will save. Point-in-time restore is precisely what a backup is for, and it’s the one thing none of these features provide.

Five ways businesses actually lose Microsoft 365 data

1. Deletions discovered too late. The mistake surfaces in month four, after every recovery window has closed.
2. Departing employees. Accounts get emptied before offboarding, or licenses get removed and the mailbox purges on schedule.
3. Ransomware via sync. Files encrypted on one laptop sync dutifully up to OneDrive and SharePoint.
4. Third-party apps and sync errors. A misbehaving integration overwrites good data with bad, at machine speed.
5. Admin mistakes. A mis-scoped retention policy or cleanup script does exactly what it was told to do.

What a real Microsoft 365 backup looks like

• Independent. Stored outside Microsoft’s infrastructure, under separate credentials — so one compromised admin account can’t erase both copies.
• Frequent. Multiple restore points per day, retained for months or years, not weeks.
• Complete. Exchange, OneDrive, SharePoint and Teams — including the SharePoint sites Teams quietly creates behind every team.
• Granular. Restore one email, one folder, or an entire site to a chosen point in time.
• Tested. A quarterly restore drill, with the result written down.

Backups built this way are a big part of how we’ve kept a 100% ransomware recovery record for our clients — cloud data included.

Ownership matters as much as tooling. Decide who in your business — or which partner — is responsible for monitoring backup jobs, reviewing failures, and running the quarterly restore drill, and put it in writing. Most cloud data-loss stories we hear don’t involve exotic attacks; they involve a backup that quietly stopped running months earlier, a license change nobody mapped to retention, or an assumption that “Microsoft has it” which nobody ever tested against a real restore. Five minutes of checking per week costs less than one afternoon of explaining to a client why their project folder is gone.

Key takeaways

• Microsoft keeps the service running; recovering your data is on you.
• Recycle bins, retention and versioning are windows, not backups.
• Ransomware, departing employees and sync errors all reach the cloud.
• Use an independent, frequent, tested backup that covers all of Microsoft 365.

Not sure what your current Microsoft 365 setup would actually let you recover? Our cloud services team can tell you in one short review.