Microsoft 365 Backup: Why You Need It and How It Works

The Misconception: Microsoft 365 Is Not a Backup

Many businesses assume that because their data is stored in Microsoft's cloud — Exchange, SharePoint, OneDrive, Teams — it is automatically backed up and recoverable. This is a common and costly misunderstanding.

Microsoft's Shared Responsibility Model makes the boundary clear: Microsoft is responsible for the infrastructure, availability and security of the platform. You — the customer — are responsible for your data. Microsoft's own service agreement explicitly states that it recommends using third-party backup applications.

What Microsoft provides is not a backup — it is data durability and availability. There is a meaningful difference.

What Microsoft 365 Actually Provides

Recycle Bin / Deleted Items

Deleted files in OneDrive and SharePoint move to the Recycle Bin and are recoverable for 93 days. After that, they move to a secondary Recycle Bin for up to 93 more days before permanent deletion. Deleted emails in Exchange are recoverable for 14-30 days (depending on configuration) from Deleted Items.

This is useful for accidental deletion by the user, but it doesn't protect against a scenario where someone permanently deletes content, or where the retention window has passed.

Version History

SharePoint and OneDrive maintain version history for files — by default, 500 versions per file. This allows you to restore a previous version if a file has been edited incorrectly or overwritten. The version history is not a backup: it only covers the current state of files that exist, not files that have been deleted.

Retention Policies

Microsoft Purview retention policies (available on paid plans) can preserve content for a defined period, preventing users from permanently deleting items. This is a compliance tool — it is designed to ensure content is available for legal and regulatory purposes, not to provide a restore capability in the traditional sense.

Common Data Loss Scenarios Microsoft 365 Doesn't Fully Protect Against

• Accidental bulk deletion — a user deletes a SharePoint library, a mailbox, or a large number of files in one action. If this isn't noticed within the recycle bin retention window, data is gone
• Ransomware — ransomware that encrypts files in OneDrive or SharePoint can overwrite version history if the encryption process runs for long enough before detection. Microsoft 365's ransomware recovery tools help but have limitations against sophisticated attacks
• Malicious deletion by a departing employee — an employee who knows they're being terminated can delete their emails and documents before their account is locked. Without a backup, that data may be unrecoverable
• Account compromise — an attacker with admin access can delete mailboxes and data. Purge from the admin portal bypasses user-level recycle bins
• Licence expiry — if a Microsoft 365 subscription lapses, Microsoft retains data for 90 days before permanent deletion. Data recovery during this window can be complicated

What a Proper Microsoft 365 Backup Provides

A third-party Microsoft 365 backup solution provides:

• Point-in-time restore — restore data to a specific point in time, before an incident occurred
• Extended retention — retain backed-up data for months or years, independent of Microsoft's recycle bin windows
• Granular recovery — restore individual emails, files, or contacts without restoring an entire mailbox or site
• Independent storage — backup data stored separately from Microsoft's infrastructure, so a Microsoft outage or compromise doesn't affect recovery capability
• Automated daily backup — without manual intervention

Coverage Across Microsoft 365 Services

A comprehensive Microsoft 365 backup should cover:

• Exchange Online (email, calendar, contacts, tasks)
• SharePoint Online (document libraries, lists, pages)
• OneDrive for Business (user files)
• Microsoft Teams (channel conversations, files, chat)

Not all third-party backup tools cover all four services. When evaluating backup solutions, confirm that Teams data and SharePoint list items are explicitly covered, as these are often gaps.

How AMVIA Provides Microsoft 365 Backup

AMVIA provides Microsoft 365 backup for UK businesses as part of our managed Microsoft 365 service. We use enterprise-grade backup platforms that provide daily automated backup of Exchange, SharePoint, OneDrive and Teams, with a simple restore interface and regular backup health reporting.

For businesses without a current backup solution, a Microsoft 365 backup deployment typically takes a few hours to configure and begins capturing data on the same day.