Does Microsoft 365 back up my data?

What does Microsoft actually protect in Microsoft 365?

Microsoft protects the platform: its data centres, hardware, network and the uptime of Exchange Online, SharePoint, OneDrive and Teams. Your data, and who can change or delete it, stays with you.

That split is called the shared responsibility model. Microsoft's own page on shared responsibility in the cloud lists four things you always keep, whatever the service type: your data, your endpoints, your accounts and your access management. In a SaaS service such as Microsoft 365, Microsoft takes over the operating system, physical hosts, network and data centre. It doesn't take over responsibility for your content.

So when a user deletes a folder, an admin removes the wrong account or ransomware encrypts a SharePoint library, Microsoft's systems carry out those changes faithfully. The service stays available, which is exactly what it promises. Recovering the data is a separate job, and that's where backup as a service comes in. We cover the full model in our guide to the Microsoft 365 shared responsibility model.

Replication is not a backup

Microsoft replicates data across data centres so that a hardware failure doesn't take your mailbox offline. Replication copies every change, including deletions and encryption. It protects availability, not your ability to go back to a clean point in time.

How long does Microsoft 365 keep deleted data?

Between 14 and 93 days for most items, depending on the workload and settings. After that, data is permanently removed unless you've set up retention policies or an independent backup.

Microsoft also keeps SharePoint backups for 14 days beyond the 93-day window. According to the same support page, Microsoft Support can restore entire site collections from those, but not individual files. That helps after a large accident. It doesn't help if you notice three months later that a single contract folder is missing.

Retention policies in Microsoft Purview can keep content for years. They're built for compliance and eDiscovery, though, not for fast, granular restores of a working environment.

Does Microsoft 365 protect you against ransomware?

Partly. Microsoft blocks a great deal of malware and phishing, and versioning can roll back some encrypted files. If an attacker gets into an account, though, their actions look like the user's own, and native recovery tools sit inside the same tenant they've reached.

The threat is real for organisations of every size. According to the Verizon 2026 Data Breach Investigations Report, as summarised by Help Net Security, ransomware was involved in 48% of breaches analysed, up from 44% the year before. The Microsoft Digital Defense Report 2025 found that at least 52% of attacks with a known motive were driven by extortion or ransomware, and that more than 97% of identity attacks are password attacks.

Attackers also go after recovery options. In a Sophos survey of 2,974 organisations hit by ransomware, 94% said the criminals tried to compromise their backups, and 57% of those attempts succeeded. Organisations whose backups were compromised reported median recovery costs eight times higher.

Microsoft's own ransomware protection guidance for Microsoft 365 lists what you can use natively: 500 file versions by default, a 93-day recycle bin, Files Restore for the last 30 days and single item recovery in Exchange. It's useful. But it all depends on someone noticing in time, and on the attacker not having admin rights to purge it. Read more in our article on Microsoft 365 ransomware recovery.

Is Microsoft 365 Backup enough on its own?

Microsoft 365 Backup, Microsoft's paid add-on, is a real improvement on recycle bins, but it's still a Microsoft service managed from your Microsoft 365 tenant. Whether it's enough depends on how much independence your risk assessment and your auditors expect.

According to Microsoft's Microsoft 365 Backup FAQ, it protects Exchange Online, OneDrive and SharePoint, keeps backups for one year and offers a 10-minute recovery point objective for those workloads. (The recovery point objective, or RPO, is how much recent work you could lose.) Teams isn't listed in the FAQ as a separate workload.

Microsoft itself recommends evaluating Microsoft 365 Backup or a partner solution in its ransomware guidance. The deciding question is simple to ask: if your tenant or your global admin account were compromised tonight, would your backup still be out of the attacker's reach?

What Microsoft 365 data should you back up yourself?

All four core workloads: Exchange Online, OneDrive, SharePoint and Teams. Leaving one out is the most common gap we see, usually Teams or SharePoint.

• Exchange Online: mailboxes, calendars and contacts. Email is often your record of agreements and decisions.
• OneDrive: each user's working files, including files that only ever existed on one laptop's synced folder.
• SharePoint: team sites and document libraries, where project and customer files tend to live.
• Teams: channel conversations and the files shared in them, which are stored across SharePoint and Exchange.

Pay extra attention to leavers. When you delete a user, their mailbox and OneDrive start a countdown, as the table above shows. A backup taken before deletion means you can still restore a former colleague's files a year later.

Our Microsoft 365 backup covers Exchange, OneDrive, SharePoint and Teams. Backups are stored in our own Tier III data centres in the Netherlands and Germany, kept immutable with Object Lock plus an air-gapped copy, and every backup job is checked automatically. If you're unsure where sync ends and backup begins, see cloud storage vs cloud backup.

How do you check your Microsoft 365 data protection?

Work through five checks. You'll know within an afternoon whether you can recover a deleted mailbox, a SharePoint library or a full user from two months ago.

1. List your workloads. Which of Exchange, OneDrive, SharePoint and Teams do you use, and which hold business records?
2. Check your current windows. Look up your Exchange deleted item retention and any Purview retention policies. Note what happens after 30 and 93 days.
3. Confirm independence. Is there a backup outside your tenant, with separate credentials and multi-factor authentication on admin actions?
4. Set targets. Agree how much data you can afford to lose (RPO) and how quickly you need it back (RTO). Our RTO and RPO explainer helps you choose.
5. Test a restore. Restore one mailbox and one SharePoint folder from at least 60 days ago, and time it. Our guide on how to verify your backup works covers what to measure.

What to do next

Microsoft 365 doesn't back up your data in a way that survives ransomware, admin mistakes or a deleted account beyond a few weeks. Treat its recycle bins as a convenience and put an independent, immutable and tested backup alongside them.

If you fall under NIS2, this is also a legal point. Article 21(2)(c) of the NIS2 Directive (EU) 2022/2555 lists "business continuity, such as backup management and disaster recovery, and crisis management" among the required measures. See how this fits your wider setup on our backup as a service page.

Want to see a restore of a deleted mailbox and a SharePoint library from an EU data centre? Book a free 15-minute demo. You'll talk to a person, in Dutch, German or English.

This article is information, not legal advice.