Home / Insights / Is Microsoft 365 Actually Backed Up?
Cybersecurity
Is Microsoft 365 Actually Backed Up?
The biggest misconception in IT, and what it means for your disaster recovery plan.
This is the single most common misunderstanding we see in IT environments: businesses assume that because their data lives in Microsoft 365, it’s automatically backed up. It isn’t.
Replication is not backup
Microsoft’s own service agreements are clear about this. Microsoft 365 is built for high availability, your data is replicated across multiple locations so that Microsoft’s infrastructure doesn’t lose it. But that protects against Microsoft’s failures, not yours. It does not protect you against:
- Accidental deletion by a staff member
- Malicious deletion by a disgruntled employee or compromised account
- Ransomware that encrypts or corrupts files, which then syncs across your replicated copies
- A retention policy gap that permanently purges data past its recovery window
Microsoft’s default retention windows (typically 30–93 days depending on the service) are also shorter than most businesses assume, and don’t cover every scenario a real backup would.
What a proper backup actually looks like
A real Microsoft 365 backup strategy covers Exchange, SharePoint, Teams, and OneDrive independently, stores copies outside Microsoft’s own infrastructure (so a tenant-level incident can’t take out your backups too), and, critically, gets tested. An untested backup is a hypothesis, not a safety net.
The question worth asking
If someone deleted your entire SharePoint document library right now, on purpose, how would you get it back, and how confident are you in that answer?
The four ways Microsoft 365 data is actually lost
Most real-world data loss is not a Microsoft outage. It is one of four everyday events: accidental deletion by a user, malicious deletion by a departing employee, ransomware or a compromised account encrypting or wiping files, and sync errors that silently overwrite good data with bad.
Microsoft’s built-in protection is retention, not backup. Deleted Exchange items are recoverable for a limited window (14 days by default, configurable up to 30), and SharePoint and OneDrive recycle bins keep items for 93 days in total. After that, the data is gone, and a retention policy does not let you roll a whole mailbox or site back to last Tuesday.
Questions to ask any backup provider
- Does it cover Exchange, SharePoint, OneDrive and Teams data?
- Where is the backup stored, and is it inside the EU for GDPR purposes?
- Is it separate from the credentials that run your tenant, so a compromised admin cannot delete it?
- How often does it run, and how long are versions kept?
- When did you last do a test restore, and how long did it take?
A backup you have never restored from is an assumption, not a plan. Schedule a test restore at least once a quarter.