Microsoft 365 Backup: Why Microsoft Does Not Protect Your Data for You

In short:

• Microsoft keeps the service running. For the data - deleted emails, overwritten files, departing employees - you are responsible.
• What is deleted in Microsoft 365 can only be restored for a limited time: weeks, not years.
• When you delete a departing employee's account, their mailbox and OneDrive are lost after about 30 days unless you have saved them.
• A separate backup outside your Microsoft 365 environment is the only way to recover data after retention periods expire, after a mistake or after an attack.

What Microsoft protects and what it does not

Microsoft works on a shared responsibility model. In short:

In other words: if a Microsoft server burns down, your data is safe. If an employee deletes a folder or malware encrypts OneDrive, Microsoft will not give you back last month's state.

How long deleted items are kept

Microsoft 365 has built-in "recycle bins", but with short retention. With standard settings:

Retention can be extended with retention policies, but that is not a backup: the data stays in the same environment, and if that environment is compromised, it is affected too.

Five situations in which data is lost

1. Deleted more than a month ago

An employee deletes a folder of contracts or correspondence. Nobody notices until the next audit or a dispute with a client. When you look for it, the retention period has long expired.

2. A departing employee

The licence is freed up, the account is deleted - and after about 30 days the mailbox and files are gone for good. That is often exactly where the history with clients and suppliers lives.

3. Ransomware in OneDrive

Encrypted files on the computer sync to OneDrive and overwrite the healthy ones. Restoring OneDrive helps if you react within 30 days and the attack is caught in time.

4. A compromised account

An attacker with access to the mailbox deletes emails, forwards mail or deletes files to cover their tracks. The later it is discovered, the less can be recovered from the recycle bins. Two-factor authentication reduces this risk considerably - see why businesses use MFA.

5. A sync or migration error

A wrong setting, a bad mail rule or a problem when moving from another system. See also migrating from Google Workspace to Microsoft 365 - there, a separate copy before the switch is a must.

What a Microsoft 365 backup should include

• Exchange Online mail - including shared mailboxes, calendars and contacts.
• OneDrive for every user.
• SharePoint and Teams - team sites and files.
• A copy outside your Microsoft 365 environment - if an admin account is compromised, the copy must remain out of the attacker's reach.
• A long enough retention period - months and years, not weeks.
• Fast restore of a single item - one email or one file, without restoring the whole mailbox.
• Regular restore testing - a backup nobody has tried to restore is only a hope.

These requirements are part of the company's overall backup plan - see how to back up company data without risk.

How we do it

We support companies' Microsoft 365 as part of our subscription support: users, security, two-factor authentication and backups. At the client's request, we back up email, OneDrive, SharePoint and Teams with NAKIVO in our own infrastructure in Bulgaria - distributed storage with three copies of the data and a separate backup site connected by a direct fibre link.

We regularly check that backups can be restored, and when something is deleted, we bring back the specific email or file without the whole company stopping. See our cloud services and Microsoft 365 support for business.

Frequently asked questions

Isn't the Microsoft 365 recycle bin enough?

For a file deleted by accident yesterday - yes. For a mistake found a month later, a departing employee or an attack - no, because the retention periods are short and the data stays in the same environment.

Aren't retention policies a backup?

Not really. They keep data longer, but in the same environment. They do not give you fast restore of a single email, and they do not protect you if the environment itself is compromised.

Should we keep a departing employee's mailbox?

If it contains correspondence with clients, contracts or accounting documents - yes. Save it before deleting the account, otherwise it is lost after about 30 days.

How often is a backup made?

Usually at least once a day, automatically. What also matters is how long the copies are kept and whether restores are tested regularly.

How much does Microsoft 365 backup cost?

The price depends on the number of Microsoft 365 licences and the volume of data we back up. That is why we first review your environment and then propose a specific price.

A real-world example: IMAP to Microsoft 365 email migration.

Let's talk about your needs, and we will propose the best solution and price.