Does Microsoft 365 already back up your data?
Microsoft guarantees the service runs and keeps deleted items for a certain period. This is not the same as a backup: to recover data deleted long ago, encrypted by ransomware or lost with a closed account, you need an independent copy.
- Microsoft protects the service, not users’ mistakes
- Recycle bins and retention have time limits
- The model provides for shared responsibility
- An external backup covers deletions, ransomware and staff leaving
What Microsoft guarantees
Microsoft guarantees the availability of the service and that the infrastructure will not lose data through its own faults: it replicates data across data centres and maintains operational continuity. This is the shared responsibility model: the provider answers for the cloud, the customer for what they put in it, that is data, identities and configurations.
What it keeps and for how long
Deleted items remain recoverable for a limited period, which differs from service to service. According to Microsoft’s documentation, items deleted from SharePoint and OneDrive remain recoverable for 93 days. Exchange also has its own recovery limit, and the mailbox of a deleted user remains available only for a certain time after the account is closed. They are meant to fix recent mistakes and are not a substitute for an archive.
Default values change over time and with the type of licence: they should be checked against Microsoft’s documentation and, above all, against the real configuration of your Microsoft 365 environment (tenant).
When retention is not enough
Deletion discovered late. A folder deleted months ago is no longer in the recycle bins.
Ransomware. If files are encrypted and synchronised, even recent versions can be compromised.
People leaving the company. When an account is closed, the mailbox and personal files follow precise retention rules: without a plan, they are lost.
Configuration errors. A modified retention rule can delete more data than intended.
Legal or audit requests. You must be able to show what was present on a given date.
What an independent backup does
A dedicated backup copies email, Teams, SharePoint and OneDrive outside the Microsoft environment, with a long history, selective restore of a single item and immutable copies, designed to withstand an attack. It follows the same principle as the 3-2-1 rule: several copies, on different media, at least one of them kept separate.
At ATView we use Veeam solutions, of which we are a partner, and we verify restores with periodic tests: a backup whose restore has never been tested offers no certainty at all.
How to check where you stand
Three questions to find out:
1. If a user deletes a shared folder and notices after six months, can it be recovered?
2. If an account is closed today, is its mailbox still available in a year?
3. When was the last restore tested, and how long did it take?
If any answer is missing, it is worth checking the configuration before buying any tool.
Frequently asked questions
Is Microsoft 365 backup mandatory?
No rule requires a specific tool. However, GDPR requires measures appropriate to the risk, and data availability is among them: how to demonstrate it is the company’s choice.
Is it enough to sync files to a computer?
No: synchronisation also replicates deletions and encryption. It is a copy, not a backup.
Where are the copies stored?
You can choose: a dedicated infrastructure, another cloud or both. The length of the history and the location where data is stored must also be set.
Read more: Microsoft Cloud
Is your Microsoft 365 protected?
We review access, sharing and backup together and tell you what to fix first.
Request a Microsoft 365 review