Does Microsoft 365 Back Up Your Data? Not the Way You Think
Updated: 18 hours ago
"It's in the cloud, so Microsoft has a copy." We hear it from almost every firm we meet. And it's half right. Microsoft keeps Microsoft 365 running, with redundant datacenters and a service that rarely goes down.
But Microsoft's own documentation puts your data on your side of the line. And the risk that matters most for a small firm isn't Microsoft losing a datacenter. It's someone signed in as one of your people, deleting or encrypting everything they can reach, at 2am on a Saturday.
Here's what Microsoft 365 actually keeps, where it falls short, and what a real Microsoft 365 backup looks like.
THE SHORT VERSION
Microsoft 365 keeps the service running and offers recycle bins, versions and retention settings, but under Microsoft's shared-responsibility model your data is your responsibility. Recycle bins expire (93 days for SharePoint and OneDrive, 14 to 30 days for deleted mail), and an attacker in your account can reach them too. A separate backup, tested, closes the gap.
Does Microsoft 365 back up your data?
Not in the way most firms assume. Microsoft keeps the service available and recoverable on its side, but under its shared-responsibility model, your data, your accounts and your settings are yours to protect.
Microsoft's shared responsibility guide lists "Customer data" as the customer's responsibility for software-as-a-service like Microsoft 365, and says: "For all cloud deployment types, you own your data and identities."
Microsoft's job | Your job |
|---|---|
Physical datacenters | Your data: email, files, Teams chats and sites |
The network and the servers | Who has accounts, and how they sign in |
Keeping the Microsoft 365 service running | Your settings and permissions |
Its own disaster-recovery copies of the service | A separate, restorable copy of your data |
Microsoft now sells more tools for this, but its position hasn't changed. Asked in its backup FAQ whether its stance on shared responsibility changed, Microsoft answers: "No, we still have the same point of view, but are now offering more tools..."
What Microsoft 365 does keep (and for how long)
Microsoft 365 has real safety nets. They're built for everyday mistakes, not for a bad day.
Recycle bins
Deleted files in SharePoint and OneDrive sit in recycle bins: "For SharePoint, the retention time is 93 days" (Microsoft Support). After that, they're permanently deleted.
For email, "The default deleted item retention period for Exchange Online is 14 days. You can modify this period for mailboxes up to a maximum of 30 days" (Microsoft Learn).
Version history
Version history is great for getting back yesterday's copy of one spreadsheet. Microsoft says it "doesn't scale well for large-scale ransomware attacks," and versions "might also be exhausted depending on the version limit set by the admin."
Retention policies and holds
Retention settings and legal holds keep data for legal and regulatory reasons. Microsoft's FAQ says they "retain data, but that feature is optimized for export (for example, via eDiscovery), not for mass restore." Getting a whole mailbox back to last Tuesday isn't what they're for.
Microsoft's disaster-recovery copies
Microsoft keeps its own copies so the service survives an outage. But "A DR copy with Microsoft 365 maintains the current state of content, not any historical versions from prior points in time." If your files were encrypted yesterday, the current state is the encrypted one.
Feature | What it's for | Where it falls short |
|---|---|---|
Recycle bins | Undoing a recent deletion | 93 days for files, 14 to 30 days for deleted mail, then gone |
Version history | Rolling back one file | Doesn't scale for ransomware; versions can run out |
Retention and holds | Keeping data for legal reasons | Built for export, not mass restore |
Microsoft's DR copies | Keeping the service running | Current state only, no earlier points in time |
The security problem: an attacker has the same access you do
Here's what most backup conversations miss. When someone takes over a mailbox or OneDrive, with a stolen session or a device-code phishing trick, they aren't an outsider anymore. To Microsoft 365, they're your employee. They can delete files, empty the recycle bin, and set up rules to hide what they're doing. The attacker has the same access to your recycle bin and version history that you do.
That's why "Microsoft 365 backed up" is on 24uNet's security list, not just its IT list. The backup has to be:
Separate from Microsoft 365, so deleting something in Microsoft 365 doesn't delete the backup.
Behind separate credentials, so someone signed in as your admin can't reach it.
Immutable and ransomware-resistant: attackers cannot delete or encrypt it.
Microsoft genuinely does not do this for you. Catching the takeover early matters just as much as restoring afterward. That's the job of account takeover detection.
Why it matters for a small firm: Verizon's insurance-claims research found that "In the SMB segment, the impact median approximates a modest $38,000" (2026 Breach Impact Study, verizon.com/dbir; SMB means under $25 million in revenue). That's a typical claim, not a worst case.
Not sure whether your Microsoft 365 is backed up separately? Book your independent security review or email sales@24unet.com.
What a real Microsoft 365 backup covers
Use this as a checklist. It applies whatever product you use.
Everything that matters: Exchange mailboxes, OneDrive, SharePoint sites and Teams files.
Point-in-time restores of whole mailboxes and sites, not just one file at a time.
Copies the attacker's credentials can't reach, stored separately and protected from deletion.
Retention long enough for your obligations, which for some firms means years, not weeks.
A test restore of both files and email from the backup copy at least once a year, with written results. An untested backup is a hope, not a control.
Several providers back up Microsoft 365. What matters is separation, retention and tested restores, not the brand.
24uNet offers Microsoft 365 backup and file data backup as separate services, and we can run test restores of both files and email from the backup copy, with written results. Which pieces fit your firm gets settled in a short conversation: Book a security review or email sales@24unet.com.
For RIAs: Reg S-P and books-and-records retention
If you're a registered investment adviser, the question isn't only "can we get it back?" It's "can we show the SEC we could?"
Regulation S-P requires written policies that include "a program reasonably designed to detect, respond to, and recover from unauthorized access to or use of customer information" (17 CFR 248.30). The books-and-records rule, Rule 204-2(a)(25), adds that advisers must keep "written documentation of any detected unauthorized access to or use of customer information, as well as any response to, and recovery from" it (17 CFR 275.204-2).
Then there's how long records must last. Under Rule 204-2(e)(1), most required records "shall be maintained and preserved in an easily accessible place for a period of not less than five years from the end of the fiscal year during which the last entry was made on such record, the first two years in an appropriate office of the investment adviser." Rule 204-2(g) allows electronic storage, as long as records can be easily located, accessed and retrieved.
Neither rule says "back up Microsoft 365." But if your required records live in Outlook and SharePoint, a 14-to-93-day recycle bin isn't a five-year plan. Ask your provider how they'd restore a mailbox an attacker deleted 18 months ago. See how we work with RIAs and financial firms.
General information, not legal advice.
Five questions to ask your IT provider
Is our Microsoft 365 data backed up somewhere separate from Microsoft 365?
Could someone signed in as one of our admins delete the backups?
Can you restore a whole mailbox or SharePoint site to last Tuesday?
When did you last test-restore files and email from the backup, and can we see the written result?
How long are backups kept, and does that match our recordkeeping obligations?
Frequently asked questions
Does Microsoft 365 back up my data?
Not in the way most firms assume. Microsoft keeps the service available, but its shared-responsibility model makes customer data the customer's responsibility. Recycle bins and retention help, but they aren't a separate, restorable backup.
How long does Microsoft keep deleted files in OneDrive and SharePoint?
93 days in the recycle bins, then they're permanently deleted.
How long does Exchange Online keep deleted emails?
14 days by default after they leave Deleted Items, adjustable up to 30 days.
Is version history a backup?
No. It helps restore one file, but Microsoft says it doesn't scale for ransomware and versions can run out.
Do I need a third-party Microsoft 365 backup?
You need a separate, tested backup that an attacker in your account can't delete. Whatever product you use, what matters is separation, retention and tested restores.
Does Reg S-P require RIAs to back up Microsoft 365?
Reg S-P doesn't name backup, but it requires a program to "detect, respond to, and recover from" unauthorized access, and Rule 204-2 requires many records to be kept for at least five years. General information, not legal advice.
Not sure what you have today?
Book 24uNet's independent security review. We'll check how your Microsoft 365 is backed up, who could delete it, and when it was last tested, along with the rest of your security. About an hour, no tooling to install, no access required. The written findings are yours to keep, and you get a plan, not a quote.
ABOUT THE AUTHOR
Dane Gray, Cofounder, 24uNet. Certified Ethical Hacker (CEH), CompTIA Security+, Texas A&M University, 25+ years in IT. Dane leads SEC exam prep for RIAs and broker-dealers, CMMC Level 1 readiness and independent security reviews for firms in Commerce City, CO 80022 and College Station, TX 77845. Connect with Dane on LinkedIn.
Last reviewed: October 2, 2026
Comments