Does Microsoft 365 Back Up Your Data? Retention, Recovery And Responsibility Explained

Microsoft 365 protects its services and includes ways to recover deleted or changed data, but your subscription alone does not establish a complete business backup plan. Exchange Online, OneDrive and SharePoint have different recovery mechanisms. Microsoft also offers a separate, paid Microsoft 365 Backup service that administrators must configure. Microsoft’s backup overview explains that distinction.

If you are asking “does Microsoft 365 back up data?”, the practical question is whether your organisation can recover the right information, from the right date, within an acceptable time. This guide compares the recovery routes and gives you a worksheet for agreeing retention, recovery requirements and ownership.

What Microsoft Protects And What Your Business Must Decide

Service resilience helps Microsoft keep applications available when infrastructure fails. A recycle bin helps reverse a deletion. Version history can recover an earlier file. Retention policies preserve or delete content according to records rules. A backup service provides a separately managed recovery history. These controls serve different purposes; none should be judged solely by how many days appear in its description.

Protection Layer	What It Helps With	What You Must Verify
Service Resilience	Availability during infrastructure failures	Your process for recovering an unwanted deletion or overwrite
Recycle Bins And Versions	Everyday user mistakes	The relevant clock, surviving versions and administrator access
Purview Retention	Preserving or disposing of specified records	Correct scope, start event, licensing and retrieval process
Configured Backup	Recovering protected content from earlier points	Coverage, history, restore scope, destination and recovery time

Your business owns the decisions about acceptable loss, retention purposes, access and recovery priorities. IT or an appointed provider implements the controls and proves they work. Record those responsibilities in the service agreement; “Microsoft 365 is managed” does not explain which mailboxes or sites are backed up. For wider planning, see our data backup and recovery strategies guide.

Microsoft 365 Recovery Scenario Matrix

Use the following matrix to choose the first recovery route. The scenarios are illustrative, not results from a tested tenant. The limits describe different events and should not be added together as a guaranteed protection period. On smaller screens, scroll the table sideways to read all three columns.

Scenario	First Recovery Route And Limit	Owner And Decision
An Exchange Email Was Deleted Yesterday	Check Deleted Items, then Recover Deleted Items. After removal from Deleted Items or Shift+Delete, the recoverable-item period is normally 14 days, configurable up to 30. Exchange limit.	User starts recovery; Exchange administrator checks further recovery if needed. Confirm the actual mailbox setting.
An Email Was Purged Or The Loss Was Noticed Late	Single item recovery and holds can change what an administrator can retrieve; they do not promise unlimited user recovery. Check retained content and configured backups. Recoverable Items behaviour.	Exchange/compliance administrator verifies what still exists and the relevant authority to retrieve it.
A Work OneDrive File Was Deleted	Check the online recycle bin. Microsoft describes 93 days for work/school files unless the administrator changed the setting; permanent deletion can close that route. OneDrive recovery.	File owner acts promptly; IT checks any remaining administrative or backup route. Do not apply the personal-account 30-day rule.
A SharePoint File Was Deleted	Check both recycle-bin stages. The normal 93 days starts at deletion from the original location; moving to the second stage does not restart it. Manual purge and quota pressure can shorten availability. SharePoint recycle bins.	User/site administrator recovers the item; site owner verifies its location and access.
Many SharePoint Files Were Overwritten	A site administrator can use Restore this library for changes in the last 30 days. It relies on versions and the recycle bin; permanently removed files cannot be recovered this way. Library rollback.	Site administrator and business owner agree the rollback point and how to preserve legitimate later work.
A Whole OneDrive Was Changed Or Encrypted	Eligible Microsoft 365 subscribers can use whole-OneDrive restore for the last 30 days. Recovery still depends on available content and the documented limitations. OneDrive restore options.	Owner and IT identify a healthy point and contain the incident before restoring.
A File Is Needed After Ordinary Recovery Has Expired	Check a valid retention policy/hold or a backup that already protected the location. SharePoint Support has a further 14-day backup recovery route after actual deletion, at site-collection scope. Support recovery scope.	IT escalates immediately. A support request is not an item-level backup plan or a promise of recovery.
An Employee Has Left	User deletion, licence removal and file deletion have different lifecycles. Follow the Microsoft 365 offboarding checklist before removing licences or deleting identities.	HR approves timing; a data owner approves preservation and successors; IT verifies access and recovery dependencies.

First establish where the data lived. A file shown in Teams may be stored in SharePoint or OneDrive. Recovering its storage location does not establish that every Teams conversation, membership or connected application is protected. List each required workload explicitly when checking any backup product.

Why Retention Is Not The Same As Backup

Microsoft Purview retention policies and labels can keep content for a defined purpose or arrange its deletion. A retain-only, delete-only or retain-and-delete configuration has a different outcome. Check the applied settings rather than assuming any policy named “retention” preserves information. See Microsoft’s retention guidance.

Preservation can support a legal or records requirement without giving you a convenient restoration of an entire working site. In SharePoint and OneDrive, retained changes can be preserved in the Preservation Hold library; Exchange uses its own preservation mechanisms. Retrieval, permissions and restoration still need planning. Microsoft explains how retention works for SharePoint and OneDrive.

The retention clock is particularly easy to misread. A policy retaining an email for seven years normally measures the message’s age from receipt or sending, rather than giving it seven fresh years when the policy is assigned. Files can use creation or modification dates; labels support other start events. Record the actual trigger. Retention start events.

Licensing depends on the precise feature and deployment method. Microsoft 365 Business Premium includes rights for several retention capabilities, but advanced automatic labelling, adaptive scopes and records features have separate requirements. Do not assume Business Basic, Standard or Premium includes every Purview function. Check the current Purview licensing tables against each affected user and location.

For UK personal data, keeping everything forever is not a sound default. The ICO says organisations must justify retention periods and review data they no longer need; UK GDPR does not prescribe one universal retention period. Its guidance is currently under review following the Data (Use and Access) Act. Agree records decisions with the responsible compliance owner. ICO storage limitation guidance.

What The Separate Microsoft 365 Backup Service Adds

Microsoft 365 Backup is a consumption-billed service for protected Exchange Online mailboxes, OneDrive accounts and SharePoint sites. It operates within Microsoft 365’s data boundary. A partner application using Microsoft 365 Backup Storage is not automatically an off-platform copy; ask where data and recovery controls actually reside. Backup architecture and billing.

Current policy options differ by workload: SharePoint and OneDrive support three months, six months, or whole-year windows from one to ten years; Exchange supports three months, six months, one year or two years. Existing policies default to one year. Longer retention only helps if protection has accumulated the required history; it cannot recreate expired or never-created recovery points. Policy recovery-window settings.

Restore granularity matters as much as retention length. Microsoft’s current documentation limits selected file/folder restores in OneDrive and SharePoint to recovery points within the most recent 14 days. Older recovery points support full account/site recovery. Full restores can overwrite later content and permissions; a new destination may help preserve current work. Granular restores inherit destination permissions rather than restoring item-level permissions. Restore scope, destinations and limitations.

Do not turn a vendor’s performance estimate into your own recovery promise. Define recovery point objective (RPO: acceptable loss measured in time) separately from recovery time objective (RTO: acceptable time to resume the required work). Measure the complete recovery process, including investigation, approval, restoration and validation.

Check Scope, Billing And Administrator Access Before Enabling Backup

An authorised administrator must arrange pay-as-you-go billing and create the workload policies. Billing setup needs a valid Azure subscription and the required Azure access. Backup-management permissions vary by workload: Microsoft lists the Microsoft 365 Backup Administrator role, SharePoint Administrator for OneDrive/SharePoint and Exchange Administrator for Exchange. Some restore features have additional role requirements; the granular file/folder procedure specifies SharePoint Backup Admin. Follow the setup prerequisites and specific restore procedure rather than assigning Global Administrator by default.

Check the actual protected objects, not just whether billing is enabled. Include shared mailboxes where needed and verify new starters and new sites enter protection. Microsoft’s current policy guidance supports user and shared mailboxes, while other recipient types such as room and group mailboxes are excluded. Full Workload Backup and dynamic membership features remain marked preview; do not assume them as a universally available production default. Policy scope and preview notices.

Compare alternatives against the same recovery requirements: supported objects, location of copies, administrative separation, deletion safeguards, export/exit options, retention and restore evidence. Separately sourced backup may suit some risks; Microsoft’s own service may suit others. Product choice follows the recovery requirement.

A Retention And Recovery Policy Worksheet

Copy this worksheet into your internal policy or service ticket. Complete one record for each data class and location. It combines records decisions with recovery needs while keeping the approval and technical owners visible. A completed table is a decision record; it is not proof that the settings have been applied.

Field	What To Record
Data And Location	Business purpose; workload; mailbox/site/library; sensitivity; included and excluded objects
Accountable Owner	Named business approver, IT implementer, recovery operator and absence cover
Records Requirement	Retention purpose and justification; period; start event; end action; hold/exception owner
Recovery Scenarios	Single deleted item, mass overwrite, delayed discovery, leaver and compromised administrator
Recovery Targets	Maximum acceptable loss (RPO); time to resume work (RTO); how long an incident might go unnoticed
Controls And Coverage	Recycle-bin/version settings; exact retention/hold scope; backup product, policy and protected objects
Available History	Earliest usable recovery point; granular versus full recovery limits; known coverage gaps
Destination And Access	Original or separate destination; permission checks; protection of later valid work
Licences And Cost	Required service plans, billing owner, storage/consumption assumptions and review date
Verification And Review	Evidence reference, last verification date, failed checks, action owner and next review

Keep two durations separate: how long the business must preserve a record, and how far back it must recover an operational state. A long records period does not prove that an old file can be restored individually, with its former permissions, within an hour.

Worked Example: A Loss Discovered After Six Weeks

Consider a fictional 25-person UK consultancy. An operations workbook is overwritten, but nobody notices for six weeks. The business wants the earlier workbook without rolling its current project site back. Assume the required version is no longer available and no applicable retention copy has been confirmed.

The 30-day library rollback route cannot meet this request. A long Microsoft 365 Backup recovery window may provide a full-site recovery point, but six weeks is outside its documented 14-day selected-file restore window. IT therefore assesses restoring the older site to a separate destination and retrieving the workbook, or another configured product’s supported granular recovery route. That is a proposed recovery approach, not a tested result.

The worksheet should record “recover one six-week-old workbook while preserving current work”, with a named approver and measured recovery-time target. “Keep backups for a year” is too vague to show that this requirement is met. This comparison is derived from the library rollback limit and backup restore limitations.

What To Check In Your Organisation This Week

Choose one important mailbox, one OneDrive account and one SharePoint site. Ask the data owner and IT administrator to complete the worksheet together. Check the configured policy against the actual object list, confirm usable recovery points and identify any gap between the required scenario and the available restore scope.

Before a live restore, contain any active compromise, obtain approval for the affected scope and preserve useful later work. Use a suitable separate destination where supported and check its access. Verify content and permissions before returning recovered information to normal use. Our SharePoint permissions guide explains why access needs its own check.

Keep evidence of an authorised restore exercise and record corrective actions. A successful backup job alone does not demonstrate that people can resume their work within the agreed time.

Frequently Asked Questions

Documentation reviewed on 10 November 2026. This guide covers Exchange Online, OneDrive for work or school and SharePoint Online, not on-premises Exchange/SharePoint or personal OneDrive. The matrix, worksheet and consultancy example are editorial analysis and planning aids; no tenant configuration or restore test was performed. Confirm current licensing, feature availability and your actual settings before making changes.