Microsoft runs the service, but recovering your data after a mistake or an attack is a different job.
Most organizations should add a separate Microsoft 365 backup. Under Microsoft’s shared responsibility model, Microsoft runs the service and keeps it resilient, while you own your data, accounts and settings. Built-in recovery windows run from about two weeks to about three months, so a deletion, overwrite or ransomware event noticed late can fall outside them.
What Microsoft is responsible for, and what you are
Microsoft 365 is software as a service. Microsoft’s shared responsibility guidance (2026) says that for every kind of cloud deployment you own your data and identities, and it lists four responsibilities you always keep: your data, the endpoints that connect to the service, your user accounts and access management. For Microsoft 365, the split looks like this:
| Area | Who is responsible |
|---|---|
| Datacenters, hosts and the physical network | Microsoft |
| Operating system and network controls | Microsoft |
| Applications and client devices | Shared |
| Your data | You |
| Configurations and settings | You |
| Identities and users | You |
Client devices are shared in name only: Microsoft offers some device management tools, but protecting the laptops and phones that connect stays with you. Microsoft also builds resilience into the service. Exchange Online keeps at least three copies of every mailbox database in separate datacenters, and SharePoint and OneDrive write each file to two datacenter regions at once (both as of 2026). That protects you from a failed disk, server or building.
Microsoft runs the service. You own the data and the recovery plan.
Why resilience is not the same as backup
Replication copies every change as it happens, including a deletion, which is why it survives hardware failure but does nothing about the wrong file being removed. Microsoft’s Exchange documentation says its lagged database copy exists for rare, system-wide corruption and is not meant for recovering an individual mailbox or message. The losses that actually happen are often smaller and closer to home:
- A project folder is deleted and nobody notices for four months.
- An employee leaves, IT deletes the account, and in week six someone needs the mailbox.
- A laptop with ransomware syncs encrypted files to OneDrive and overwrites the good copies. CISA’s ransomware guide (2023) warns that automated cloud backups may not be enough for exactly this reason.
- An attacker who phishes a password signs in as that user, or as an administrator, and deletes mail and files. Email security and awareness training lowers the odds, and a backup limits the damage.
- A migration, a script or an over-permissioned app overwrites data in bulk.
Microsoft 365 backup windows: what the built-in recovery covers
These are the recovery windows Microsoft documents today. Each is a safety net for ordinary mistakes, and each one ends.
| What you lose | Built-in recovery, per Microsoft’s documentation (as of 2026) |
|---|---|
| Email removed from Deleted Items | 14 days by default, up to 30 days if you extend it (Recoverable Items folder) |
| SharePoint and OneDrive files you delete | 93 days across the two recycle bin stages (SharePoint and OneDrive resiliency) |
| A document library damaged or encrypted | Files Restore to any moment in the last 30 days, which relies on file versions (same page) |
| A deleted user account | Restore within 30 days, mailbox included (Restore a user) |
| Microsoft 365 Backup, a paid Microsoft service | A recovery window you choose: 3 months, 6 months, 1 year or 2 years (Backup overview) |
Once a window closes, recovery depends on something you set up in advance, such as a hold, a retention policy or a separate backup. Take the leaver example: IT deletes an account on the 1st, and the account and mailbox can be restored until about the 30th. If a client asks the following month for a thread from last spring, built-in recovery will not bring it back unless one of those was in place.
Retention policies are worth having, but they answer a different question. Microsoft describes them as a way to retain what you need and delete what you do not (2026): a policy decides what to keep and when to let it go, while a backup exists to put things back. Microsoft’s own backup product keeps a recovery window that retention and deletion policies do not affect.
Your options for a Microsoft 365 backup
Microsoft’s own overview of Microsoft 365 Backup (2026) names two scenarios it is built for: ransomware that encrypts large amounts of data, and accidental or malicious deletion or overwrite. That is a fair description of the gap the built-in windows leave. You have three routes:
- Microsoft 365 Backup. Microsoft’s pay-as-you-go service for SharePoint sites, OneDrive accounts and Exchange mailboxes, with a recovery window you choose. Data stays inside the Microsoft 365 trust boundary.
- Partner products on Microsoft’s platform. Applications from independent publishers, built on Microsoft 365 Backup Storage and operated and billed through the partner. Same underlying platform, with the partner’s own console and features.
- An independent backup service. A separate product that copies your data out of your tenant to storage it controls. You get a copy outside Microsoft’s boundary, and one more system to run and test.
Whichever you pick, check four things:
- Coverage. Teams files live in SharePoint and OneDrive, and Teams messages are stored with Exchange, so ask exactly how a product handles Teams content.
- Independence. Where does the copy live, and can the accounts an attacker would use delete it?
- Granularity and reach. Can you restore one message, one file, one site or a whole tenant, and how far back?
- Proof. Has anyone restored a real mailbox and a real folder and written down how long it took?
How to run a Microsoft 365 backup so it works when you need it
- Scope it properly. Cover every user mailbox, shared mailboxes, each person’s OneDrive and the SharePoint sites that matter, including the ones behind Teams.
- Match retention to how late you notice. Choose a window longer than the longest gap you might go before spotting a problem. If a quarterly report can go missing for four months, 93 days is not enough.
- Give the backup its own administrators. Use separate accounts with multi-factor sign-in, so a compromised daily admin login cannot also delete the backups.
- Plan for leavers. Decide what happens to a departed employee’s mailbox and files before the 30-day account window runs out.
- Record your configuration. Keep a current export or written record of conditional access policies, mail flow rules and sharing settings, so a damaged tenant can be rebuilt.
Then prove it works. A restore test takes an afternoon:
- Pick a mailbox and a folder that matter, and note something specific to look for, such as last month’s contract.
- Restore to a new location, never over the original.
- Check that items open, with attachments, permissions and dates intact.
- Record how long each step took and who had to be involved.
- Fix what the test exposed, then book the next one.
Insurers and auditors ask the same question in different words: can you restore, and can you prove it? Tested, offline backups are among the controls underwriters ask about most often, and “Microsoft hosts it” is rarely a satisfying answer. Our compliance and cyber insurance readiness work covers the evidence.
What to do next
If you run Microsoft 365, ask for the complimentary assessment. An engineer reviews your network, email and backups, including what happens to your Microsoft 365 data if a mailbox, a site or an account is lost, and ranks what to fix first. SNATEK adds separate, tested backups for Microsoft 365 through its backup and disaster recovery service and plans, migrates and manages Microsoft 365 through its cloud services, from our office in Cooper City.
Frequently asked questions
Does Microsoft 365 include a backup?
It includes resilience, recycle bins, versions and short recovery windows. A backup with restore points you can return to after those windows close is a separate Microsoft service, Microsoft 365 Backup, or a third-party product. Microsoft’s shared responsibility model leaves the protection of your data with you.
Is OneDrive a backup?
No. OneDrive syncs files between devices and the cloud, so encrypted or deleted files can sync too. Versions, the recycle bin and Files Restore help with ordinary mistakes for up to 93 days, but they do not cover mailboxes, they end, and they live in the same tenant as the files.
Do retention policies replace a backup?
Not on their own. Microsoft describes retention policies and labels as a way to retain what you need and delete what you do not. A policy decides what to keep and when to let it go, while a backup exists to put things back. Microsoft’s own backup product keeps a recovery window that retention and deletion policies do not affect.
How often should we test a Microsoft 365 restore?
On a schedule, and after any big change such as a tenant migration or a new backup product. Each test should restore real items, record how long it took and note what was missing. A backup you have never restored is an assumption.
Written by the SNATEK engineering team, Cooper City, Florida. Managed IT, cybersecurity and cloud support for South Florida organizations since 1996.