Short answer: Not the way most businesses think. Microsoft 365 keeps the service running and protects your data from failures on Microsoft's side, and it holds deleted items for a limited time: 14 days by default for permanently deleted email (up to 30 if your admin changes it) and 93 days in the SharePoint and OneDrive recycle bins. After that, deleted data is gone for good. If you need to recover from ransomware, a former employee's deleted mailbox or a mistake nobody noticed for months, you need a separate backup.
Most small businesses move to Microsoft 365 and assume backups come with it. Microsoft is very good at keeping the service available. Keeping a copy of your business data that you can restore from any point in time is a different job, and it's mostly left to you.
What does Microsoft 365 actually keep?
Microsoft 365 includes a few safety nets, and they are useful for everyday mistakes:
- Deleted email: when someone empties their Deleted Items folder, Exchange Online keeps those messages in a recoverable items folder. Microsoft's default is 14 days, and an admin can raise it to a maximum of 30 days.
- Deleted files in SharePoint and OneDrive: deleted files go to the recycle bin and stay there for 93 days from the time they were deleted, then they are permanently removed.
- Version history: Word, Excel and PowerPoint files keep earlier versions, so you can roll back a file that was overwritten.
- Files Restore: OneDrive and SharePoint document libraries can be rolled back to any point in the last 30 days, which helps after a mass deletion or a ransomware attack that encrypted synced files.
All of that is helpful. None of it is a true backup: a separate copy you control and can restore from any point in time.
Where are the gaps?
- Time limits. If nobody notices a deleted folder or a missing mailbox until after the window closes, it can't be brought back.
- Departing employees. When a user's license is removed, Microsoft deletes their mailbox after 30 days, and their OneDrive becomes read-only and is then archived, where nobody can open it without paying to restore it. If a manager needs that email six months later, it may not exist.
- Ransomware and bad syncs. Encrypted or corrupted files sync to the cloud just like good ones. Version history and Files Restore can help, but only inside their windows and only if they were set up correctly.
- Malicious or careless admins. Anyone with admin rights can delete data and shorten retention settings. A separate backup with its own logins and locked, unchangeable copies gives you data they can't easily delete.
- Everything outside Microsoft 365. Files on local computers, a server in the closet, line-of-business software and accounting data are not covered at all.
What should a small business add?
A complete plan usually has four parts:
- A dedicated Microsoft 365 backup that copies email, OneDrive and SharePoint on a schedule. Third-party services usually keep that copy outside Microsoft for as long as you choose, and many also cover Teams. Microsoft's own paid Microsoft 365 Backup add-on keeps restore points inside Microsoft's cloud for a set period of up to two years.
- Backups of everything else: servers, key computers and any software that stores data locally.
- Retention settings checked and documented, so you know exactly how long Microsoft holds deleted items in your tenant.
- Restore tests. A backup that has never been restored is a guess. Test a mailbox, a folder and a full file restore on a schedule.
How much does Microsoft 365 backup cost?
Microsoft 365 backup is usually priced per user per month, and many managed IT providers include it in their plans. The total depends on how many users you have, how long you need to keep data and whether you also need servers or computers backed up. Our guide on how much managed IT services cost explains how backup usually fits into a monthly plan.
Frequently asked questions
Is Microsoft responsible for backing up my data?
Microsoft is responsible for running the service and keeping its data centers resilient. Recovering your business data from user mistakes, departed employees, ransomware or long-past deletions is largely your responsibility, which is why separate backup services exist.
How long does Microsoft keep deleted emails?
After a user empties Deleted Items, Exchange Online keeps the messages in the recoverable items folder for 14 days by default. An admin can increase that to 30 days. Litigation hold and retention policies can keep mail longer, but they are compliance tools, not a restore plan.
Does OneDrive count as a backup?
OneDrive syncs files, which means deletions and encrypted files sync too. The recycle bin and Files Restore help for a limited time, but OneDrive by itself isn't a separate copy you can count on.
What happens to a user's data when they leave the company?
If their license is removed and nobody saves their data, the mailbox is deleted after 30 days and the OneDrive is locked and archived a few months later. Converting the mailbox, transferring ownership or backing it up first keeps that data available. It belongs on your employee offboarding checklist.
Get your backups checked
TechCore sets up and supports business cloud services and backup for companies in Nashville, Middle Tennessee and Chattanooga, alongside cybersecurity and network security and a local help desk. Request a free IT assessment and we'll review how your Microsoft 365 data is protected today, what would happen if it were deleted, and what it would take to close the gaps.
