Does Microsoft 365 back up your business data?

It depends on what you mean by backup. If you mean the service's ability to survive a failed server or datacentre, Microsoft takes care of that. If you mean getting back, on your request, a file deleted months ago, the mailbox of someone who has left, or the state of your data before an attack, the built-in features work within set time limits. Beyond those limits you need a retention policy, the Microsoft 365 Backup offering or another backup solution, chosen and configured by your business.

This article relies only on Microsoft's official documentation, consulted on 21 October 2026. The periods quoted can change: check them again before making a decision.

Who is responsible for what

Microsoft describes a shared responsibility model: depending on the type of cloud service, some tasks fall to the provider and others to the customer. Microsoft 365 is listed as software as a service (SaaS), meaning ready-made applications whose infrastructure Microsoft runs. For every type of service, the documentation states that customers own their data and identities and are responsible for protecting them. Managing user accounts, from creation to removal, is also the customer's job.

Microsoft adds that this model is illustrative guidance and does not change the terms of your agreement. Your exact rights come from the terms of your subscription. If an IT provider manages your environment, the split of tasks between you and them is worth putting in writing: it is one of the points covered in our article on managed IT contract clauses.

Microsoft's page on data resiliency also makes the intent clear: it states that most data loss results from customer actions, which is why the service lets customers restore accidentally deleted items themselves. The tools are there; how they are used, configured and limited is up to the business.

What Microsoft 365 provides, according to its documentation

Service resilience

For SharePoint and OneDrive, Microsoft states that every file is written to two datacentre regions at the same time. This protects against a failure in Microsoft's infrastructure. It does not protect against a deletion or change made from inside your environment: a redundant copy reflects the content as it is, mistakes included.

Recycle bins and deleted items

In SharePoint, a deleted item goes to the site recycle bin and then to the site collection recycle bin. According to the documentation, the total retention time is 93 days from the original deletion.

In Exchange Online, the Microsoft 365 email service, a message removed from Deleted Items moves to the Recoverable Items folder. The default retention period is 14 days, and an administrator can raise it to a maximum of 30 days per mailbox.

Versions and restoring to an earlier point

SharePoint keeps 500 versions of each file by default in newly created document libraries. Files Restore can take a library or a OneDrive back to any point in the last 30 days, including after mass deletions, overwritten files or malware infection. Microsoft notes that the feature relies on file versions: reducing the number of versions kept can make it less effective.

Retention policies

Microsoft Purview retention policies and labels prevent content from being permanently deleted for a period you set. The documentation presents them as a way to retain content for compliance reasons, with the content staying in its original location. They preserve a record; they do not put a site or mailbox back into the state it was in on a given date.

Microsoft 365 Backup

Microsoft offers a separate product, Microsoft 365 Backup, which backs up all or selected SharePoint sites, OneDrive accounts and Exchange mailboxes. It is billed on a pay-as-you-go basis according to consumption, not per user like standard licences. It only applies once a protection policy has been created, with a recovery window that can be set between three months and two years according to the documentation. It is an option to assess, not something switched on by default.

What these features do not cover on their own

A deletion noticed too late

Recycle bins and Files Restore work within a fixed window. A folder found missing after the year-end close, or an email deleted and purged months ago, can no longer be recovered this way unless a retention policy or a backup kept it.

An employee leaves and their account is deleted

A deleted account can be restored with its data for 30 days. The user's OneDrive files are kept for 30 days by default, a period that can be changed. For email, Microsoft advises moving the messages you want to keep before deleting the account. A mailbox only becomes an inactive mailbox, retained beyond that window, if a hold was applied before the account was deleted. The order of the steps matters as much as the tools: it belongs in your leaver process, which we support as part of our workplace and communication tools service.

Ransomware encrypting synced files

Ransomware is malicious software that encrypts files to demand a ransom. On a computer synced with OneDrive, encrypted files are uploaded to the cloud like any other change. Restoring a OneDrive to an earlier point is designed for this case, within the last 30 days and the versions available. Microsoft states that protection against malware is a shared responsibility: detecting the attack, restoring and checking the result all need a prepared procedure.

An admin or application error

Microsoft points out that SharePoint provides APIs that can skip the recycle bin and delete content immediately. A misconfigured application, a script or a compromised admin account can therefore cause a deletion the recycle bin will not catch. It helps to know which applications and accounts hold those rights.

What to check in your own environment

Illustrative example: an accounting firm deletes an employee's account on her last day, without moving her mailbox or applying a hold. Two months later, a client asks for an email exchange from the previous year. The account can no longer be restored and the mailbox was not retained: the built-in features cannot bring those messages back.

Decide, then test

Once the gaps are clear, the decision is about how long you need to keep data and which solution meets that need. Whatever you choose, a restore is only reliable once it has been tried: our article on business data backup and restore testing explains how to check. Smart IT's cybersecurity and business continuity support covers defining backup scope, monitoring copies and checking that data can be restored.

Microsoft 365 does not leave your data unprotected, but its recovery features come with time limits and conditions. Knowing those limits, comparing them with your needs and testing a restore tells you what you could actually get back.