Is Microsoft 365 Backed Up? What Microsoft Covers

Quick answer Not in the way most people mean. Microsoft protects the service: it replicates your data so a failed disk in a Microsoft data centre doesn't lose it. Protecting your data from deletion, overwriting, a departing employee or ransomware is your responsibility. Native recycle bins and retention help for a few weeks, but they aren't an independent, point-in-time backup you can restore from on demand.

The shared responsibility model, in plain English

Every major cloud service splits responsibility between the provider and the customer. Microsoft's own shared responsibility documentation is clear that, whatever the service type, your information and data, your accounts and identities, and your devices stay on the customer's side of the line.

Microsoft is responsible for	You are responsible for
Data centres, servers and network	Who can access your data
Keeping Exchange, SharePoint and Teams running	What users delete, overwrite or share
Replicating data across locations for availability	Recovering data after a mistake or attack
Patching the underlying platform	Securing admin accounts and devices

Replication is the key misunderstanding. If a user deletes a folder, or ransomware encrypts a SharePoint library, that change is replicated too, faithfully and immediately. Replication keeps the service available. It doesn't give you yesterday's version.

What Microsoft 365 keeps natively, and for how long

Microsoft 365 does have built-in safety nets. They're useful, and you should know their limits.

What's deleted	Default native recovery window	The catch
Emails emptied from Deleted Items	14 days (admins can raise to 30)	After that they're purged, unless a hold or retention policy applies
Files in OneDrive or SharePoint	Up to 93 days in the recycle bins	Restoring a whole library to a point in time is limited and slow
A departed user's OneDrive	30 days by default	Easy to miss during offboarding; then it's gone
A deleted user mailbox	30 days (soft-deleted)	Licence removal at offboarding starts the clock
Teams chats and channel files	Depends on the underlying mailbox or SharePoint site	Restoring a channel's full history isn't a one-click task

Defaults as documented by Microsoft at time of writing. Retention policies and holds in Microsoft Purview can extend some of these, depending on your licence.

The five ways SMEs actually lose Microsoft 365 data

Accidental deletion, noticed late. Someone tidies a shared folder in March. A client asks for a file in July. The recycle bin window has passed.
Offboarding. A staff member leaves, their licence is removed to save cost, and 30 days later their mailbox and OneDrive, including client correspondence, are gone.
Ransomware. Synced OneDrive folders get encrypted from an infected laptop, and the encrypted versions overwrite the good ones in the cloud.
Compromised accounts. An attacker who takes over a mailbox can delete evidence, or with admin access, change retention settings themselves.
Malicious insiders. A disgruntled employee deletes project files on the way out.

In every case, the problem isn't that Microsoft failed. It's that the only copies of your data sit inside the same tenant that has the problem.

Why retention policies aren't a backup

Microsoft Purview retention policies and litigation holds are compliance tools. They stop content from being permanently deleted so it can be found during an investigation. That's valuable, but it's a different job from backup:

They're built for finding content, not restoring a mailbox or site to how it looked last Tuesday.
They live inside your tenant, so a compromised global admin can alter them.
Bulk recovery after ransomware is slow and manual.
They don't cover your Entra ID configuration: users, groups and conditional access policies.

A good test: ask your IT team, "If every file in our main SharePoint site were encrypted at 2am tonight, how would we restore it, and how long would it take?" If the answer involves the recycle bin, you don't have a backup plan.

What to look for in a Microsoft 365 backup

You have two broad options: Microsoft's own pay-as-you-go Microsoft 365 Backup service, or a third-party backup platform such as Druva, Veeam or similar. Whichever you choose, check for:

Coverage of Exchange, OneDrive, SharePoint and Teams, ideally Entra ID too.
Separation from your tenant, so a compromised admin can't delete the backups.
Immutability, meaning backups can't be altered or encrypted after they're written.
Granular and bulk restore: one email, or an entire site to a point in time.
Retention you choose, matched to your contracts and record-keeping obligations.
Data residency options if clients or regulators care where copies are stored.
Someone watching it. A backup nobody checks is a backup that quietly stopped in February.

We use Druva for our managed clients, and explain why in how Cloudeli protects Microsoft 365 data with Druva. Microsoft 365 backup is included from our Cloudeli Secure package upwards.

The Singapore compliance angle

Under the PDPA, organisations must make reasonable security arrangements to protect personal data, and that includes protecting it from loss. Financial institutions following MAS TRM guidelines are also expected to have tested recovery capabilities. Neither names a product, but "Microsoft has it" won't satisfy an auditor asking how you'd recover client records. If you're working through PDPA obligations, our PDPA IT checklist for SMEs covers backup alongside the other controls.

Three things to do this week

Check your offboarding process. Do you convert leavers' mailboxes to shared mailboxes or back them up before removing licences?
Raise Exchange deleted-item retention to 30 days. It's a free setting and doubles your window.
Decide on a real backup. Then test a restore, because a backup isn't proven until you've recovered from it. Our guide to disaster recovery planning explains what to test.

FAQ

Questions, answered

Does Microsoft back up Microsoft 365 data?

Microsoft replicates Microsoft 365 data across its data centres to keep the service available if hardware fails, and offers recycle bins and retention features. That is not the same as a point-in-time backup you control. Under the shared responsibility model, protecting and being able to recover your data remains the customer's responsibility, which is why Microsoft itself sells a separate Microsoft 365 Backup product.

How long does Microsoft 365 keep deleted emails?

By default, Exchange Online keeps items deleted from the Deleted Items folder in the Recoverable Items folder for 14 days, and administrators can extend this to a maximum of 30 days. After that, items are purged unless a retention policy or litigation hold is in place.

How long are deleted OneDrive and SharePoint files kept?

Files deleted from OneDrive or SharePoint go to the recycle bin and can be restored for up to 93 days from the original deletion. When a user account is deleted, their OneDrive is kept for 30 days by default, configurable in the SharePoint admin centre.

Is a Microsoft 365 retention policy the same as a backup?

No. Retention policies stop content being permanently deleted for compliance purposes, but they are not designed for fast, bulk, point-in-time restoration of mailboxes, sites or Teams after an incident such as ransomware. They also live inside the same tenant, so a compromised admin account can change them.

Do we need third-party backup for Microsoft 365 under PDPA?

The PDPA requires organisations to make reasonable security arrangements to protect personal data, which includes protecting it against loss. It does not name a specific product, but being unable to recover client records after deletion or ransomware is a risk you should assess and document. An independent backup is the most common way to address it.

Is Microsoft 365 backed up?