Many people assume that once e-mail and files are in Microsoft 365, a backup exists automatically. That is only partly true: Microsoft is mainly responsible for keeping the service running, not for letting you recover every deleted or damaged file months later. This article explains where that line is and when an additional backup is worth considering.
The shared responsibility model
Microsoft makes sure the service works: data centres, hardware, replication of data to multiple locations and recovery from failures. If a disk fails in a Microsoft data centre, your mailbox does not disappear.
What happens to data inside your organisation, however, is your responsibility:
- an employee deletes a folder and nobody notices for months;
- ransomware encrypts synced OneDrive files and the encrypted versions reach the cloud;
- a departed employee's account is deleted, and their mailbox and OneDrive go with it;
- an attacker or a malicious user deletes data on purpose.
Microsoft can only restore what the built-in tools allow, and only within their time limits.
Built-in protection and its limits
| What | How long | Limitation |
|---|---|---|
| SharePoint and OneDrive recycle bin | About 93 days in total (first and second stage) | After that the file is gone for good |
| Outlook Deleted Items and Recoverable Items | 14 days by default; an admin can extend this to 30 days | Short window; losses are often noticed later |
| "Restore your OneDrive" | Up to 30 days back | Rolls the whole OneDrive back to a chosen point |
| File versions | Depends on versioning settings | Versions of a deleted file are deleted with it |
| Retention policies | The period you choose | Designed for retention and compliance, not convenient restores |
Data from a departed employee's deleted account is also kept only for a limited time. After that the mailbox and OneDrive are permanently deleted unless they were retained or handed over separately.
Retention policies are configured in the Microsoft Purview portal (Data lifecycle management). They keep data even if a user deletes it, but recovery goes through search and export and is slow.
When a separate Microsoft 365 backup makes sense
- You need to recover data from further back than roughly one to three months, for example accounting or contract documents.
- Your core work lives in SharePoint or OneDrive and a ransomware attack would stop the whole company.
- Staff turnover is high and departed users' data must be kept without paying for their licences.
- Customers, an auditor or the law require a defined retention period and proven recoverability.
- You want a copy outside your Microsoft 365 tenant in case the administrator account itself is compromised.
What to look for
- What is backed up: Exchange mailboxes, OneDrive, SharePoint and Teams. Check whether Teams chats and channel files are covered.
- Where the copy is stored and whether it stays in the European Union.
- How often backups run and how long copies are kept.
- Restore options: a single file, a single e-mail, a whole mailbox, restore to a different user.
- Protection against deletion: immutable copies and separate admin access with MFA.
- Pricing model: per user or per data volume, and whether keeping a departed user's backup costs extra.
You can choose between third-party products and Microsoft's own paid backup service. Either way, do a test restore once it is set up.
When to call a professional
If you do not know how far back you can currently restore data, or there is no clear process for departed employees' data, review it before something is lost. ITABIKS can set up retention and backup as part of Microsoft 365 administration, phone +372 53 888 229.