Microsoft keeps the Microsoft 365 service running, but protecting your data against deletion, ransomware, and account compromise is largely your responsibility. Built-in recycle bins and retention help, but they are not the same as an independent backup.
Key takeaways
What to know before you act
- Microsoft is responsible for the service's availability; customers are responsible for their data, accounts, and configuration.
- Recycle bins and retention policies help recover recent deletions but have limits and are not independent backups.
- Microsoft 365 Backup and third-party services can provide longer, separate restore points.
Why it matters
What business leaders should understand
Deleted items, overwritten files, and malicious changes may be unrecoverable once retention windows pass. A backup with its own retention and restore options reduces that risk.
The right response should reflect your environment, data, vendors, risk, and operational priorities. Use this guide as a practical starting point, then validate important decisions with the people responsible for your technology, cybersecurity, legal obligations, and insurance coverage.
Learn how Meta IT Pro can help with microsoft 365 services, backup and disaster recovery, and business continuity planning.
Related reading: What is the 3-2-1 backup rule? and Microsoft 365 security checklist.
What Microsoft 365 provides natively
Microsoft 365 includes resilience against infrastructure failure and several ways to recover deleted content. SharePoint and OneDrive recycle bins generally retain deleted items for 93 days across both stages. Exchange Online keeps recoverable deleted items for a default period that administrators can extend within limits. Retention policies and litigation holds can preserve content for longer when configured.
These features are valuable, but they were designed for compliance and recovering recent mistakes. They may not meet every need for point-in-time restoration after ransomware, malicious deletion by a compromised administrator, or problems discovered months later.
When a separate backup makes sense
Consider a backup when the business needs to restore data from further back than native retention allows, recover quickly from a large-scale change, or keep a copy that is protected from tenant-level compromise.
- Microsoft 365 Backup: a Microsoft add-on that creates restore points for SharePoint, OneDrive, and Exchange Online.
- Third-party backup: services that store copies outside the tenant, often including Teams and other data.
- Departed users: decide how long to keep mailboxes and OneDrive data after offboarding.
- Testing: periodically restore a mailbox, a file, and a site to confirm the process works.
Practical action plan
Steps your business can take
Review current retention settings for Exchange, SharePoint, OneDrive, and Teams.
Decide how far back you need to restore and how quickly.
Evaluate Microsoft 365 Backup or a third-party backup service.
Test restoring a mailbox, a file, and a site.
Recommended next steps
Continue from this article.
These pages expand the specific risks and decisions covered in this guide. Use them to move from general understanding to the service, tool, or related topic that best matches your next question.
Related guide
What is the 3-2-1 backup rule?
Keep separate, protected copies of important data.
Explore nextRelated guide
Microsoft 365 security checklist
Reduce the chance of account compromise and malicious deletion.
Explore nextRelated guide
Cloud backup for small businesses
Compare backup features and restore options.
Explore nextLearning center
Data protection & recovery
Explore backup, recovery, and incident guidance.
Explore nextWarning signs
Do not ignore these indicators
- The business assumes Microsoft backs everything up indefinitely
- Departed users' mailboxes and files are deleted without review
- Nobody has tested restoring Microsoft 365 data
How Meta IT Pro can help
Related services and practical next steps
Explore the services connected to this topic. These links provide more detail about scope, safeguards, support, and how to start a conversation with our team.
Authoritative references
Sources and further reading
These primary sources support the guidance in this article and provide additional technical or consumer information.
Microsoft Learn
Overview of Microsoft 365 Backup
Microsoft's description of backup and restore capabilities for SharePoint, OneDrive, and Exchange Online.
National Institute of Standards and Technology
Protecting Data from Ransomware and Other Data Loss Events
A practical guide for small organizations on backup, recovery, and protecting data from loss events.
Cybersecurity and Infrastructure Security Agency
#StopRansomware Guide
Preparation, prevention, response, and recovery guidance for ransomware and data-extortion incidents.
Need help with your IT solution?
Get practical guidance from a local IT and cybersecurity team.
Meta IT Pro helps Massachusetts and Rhode Island businesses improve support, security, Microsoft 365, Google Workspace, networks, backup, recovery, and compliance readiness. Tell us what is not working - or what you want to improve - and we will help identify a sensible next step.