Microsoft 365 backup: What Microsoft does not back up
Many companies assume that Microsoft backs up their data in Microsoft 365. That is only partly true: Microsoft makes sure the service stays available and that data is not lost if hardware fails. For data that is accidentally deleted, encrypted or tampered with, you as the customer are responsible.
How long Microsoft keeps deleted data
| Service | Default | After that |
|---|---|---|
| Exchange Online (deleted items) | 14 days, can be extended to a maximum of 30 days | permanently deleted |
| SharePoint and OneDrive (recycle bin) | 93 days across both recycle bin stages | 14 days of backup, but only for entire site collections and only through Microsoft Support |
| Entra ID (deleted users and groups) | 30 days | permanently deleted |
What this table does not cover: files that were overwritten or encrypted by ransomware, mailboxes after employees leave, or configurations such as Conditional Access policies. If an error only comes to light after several weeks, built-in tools often can no longer fix it.
Retention policies are not a backup
Microsoft Purview lets you set up retention policies. They prevent content from being permanently deleted before a set period has expired. They are still not a backup:
- The data stays in the same tenant. If an administrator account is compromised, the retained data is within the attacker's reach as well.
- Recovery is cumbersome: content has to be found and exported through eDiscovery; there is no one-click restore.
- Policies have to be set up and maintained deliberately. If one is missing, so is the protection.
What options you have
Microsoft 365 Backup: Microsoft offers its own backup for Exchange, SharePoint and OneDrive, billed on a pay-as-you-go basis. It runs within Microsoft's infrastructure.
Independent backup solution: Solutions such as Keepit store the data outside Microsoft, in separate infrastructure. A compromised tenant or a failure at Microsoft does not affect the backup. Keepit also operates a data center in Zurich.
Five questions for your business
- Six months from now, could you still restore the mailbox of an employee who has left?
- How long would it take to roll back an encrypted SharePoint site to yesterday's state?
- Is your backup stored outside the tenant it is meant to protect?
- Are Teams content and your Entra ID configuration backed up as well?
- Have you ever tested a restore?
If you cannot answer “yes” to every one of these questions, it is worth taking a closer look at your backup strategy.