Can Microsoft 365 Be Backed Up?

In short: In Microsoft 365, the datacenter, network and servers are Microsoft’s responsibility; data, accounts and access are yours. Deleted content can be recovered for a while, but these periods are limited to weeks. For longer recovery, Microsoft offers a separate backup service. Whichever path you choose, always test the restore.

Your email is in Exchange Online, your files are in OneDrive and SharePoint. “They’re in the cloud already, Microsoft must be backing them up” is a very common thought. The answer has two parts: Microsoft protects the infrastructure, while the data itself is your responsibility. In this article we explain where that line runs and which tools exist. This article is for general information.

Shared responsibility: who is responsible for what?

According to Microsoft’s shared responsibility model, for ready-made software services such as Microsoft 365, the physical datacenter, network, servers and operating system are Microsoft’s responsibility. The same document says that four areas always remain with the customer, whatever the service model: data, endpoints (devices), accounts and access management.

So keeping the service running during a datacenter failure is Microsoft’s job. Recovering a folder an employee deleted by mistake, files encrypted by ransomware, or the closed account of an employee who has left depends on the setup you put in place.

Microsoft 365’s own recovery options

In Microsoft 365, deleted data does not disappear immediately, but recovery periods are limited:

Exchange Online: Emails deleted from the Deleted Items folder as well can be recovered for 14 days by default. An admin can extend this to a maximum of 30 days.
OneDrive: When a user account is deleted, the OneDrive is kept for 30 days by default; this period can be changed in the admin center. It then stays in the recycle bin for 93 days; at this stage the restore is done with PowerShell.
Unlicensed OneDrive accounts: OneDrive accounts without a valid license are automatically archived on their 93rd unlicensed day. If the archive is unpaid for 12 months, the data may be deleted regardless of retention settings.
Retention policies and labels: Retention settings defined in Microsoft Purview take precedence over these processes. Content may be kept longer or deleted earlier.

These options work for everyday accidents. But for a deletion noticed a few weeks later, or an attack that corrupts hundreds of files at once, these periods may fall short.

Microsoft 365 Backup: a separate backup service

For this need, Microsoft offers a separate service called Microsoft 365 Backup. According to Microsoft’s documentation:

SharePoint sites, OneDrive accounts and Exchange mailboxes can be backed up; all of them or selected ones.
The recovery window is chosen in the backup policy as 3 months, 6 months, 1 year or 2 years.
Restore points vary by workload. In OneDrive and SharePoint, there is a point every 10 minutes for the last two weeks and one point per week from 2 to 52 weeks back. In Exchange, there is a point every 10 minutes for 52 weeks.
Backups are kept in append-only storage; existing restore points cannot be changed afterwards. Deleting the backup, however, is not blocked: when you offboard from the service, backups can still be recovered for 90 days. Purview retention policies do not affect the backup recovery window.
Billing is consumption-based on the amount of protected data, not per user.

One point to note: these backups are kept within Microsoft 365’s own data boundary, in line with your tenant’s data residency. This enables fast restores, but the copy is still on Microsoft’s infrastructure. Organizations that follow the principle of “at least one copy in a different environment” also want a copy outside. We explained this principle in our 3-2-1-1-0 rule article (in Turkish). Microsoft also notes that partner applications are built on the same infrastructure.

Four questions before you decide

Which data do you need to protect: email, OneDrive, SharePoint, or all of them?
How late might you notice a deletion? The recovery window should be longer than that.
Within how many hours after an incident do you need to be working again?
Does a copy of your data also need to exist outside Microsoft?

A backup is a backup when you can restore from it

Whichever method you choose, test the restore. Bringing back a file, a mailbox or a small site shows how long it would take you to recover in a real incident. We explained how to plan this in our restore test article.

Our Backup and Disaster Recovery page covers backup job management, off-site copy and restore testing; our Microsoft 365 management page covers roles, access and security settings. Contact us with your questions.