Do You Need a Separate Microsoft 365 Backup? What Is Already Covered

The short answer, with conditions

Microsoft does look after its own service. Your data is mirrored across datacentres and Microsoft keeps short-lived operational backups, so a hardware or datacentre failure should not become your problem. That is availability. It is not what most people mean when they ask whether Microsoft 365 is backed up.

What people usually mean is this: if someone deletes the wrong thing, ransomware encrypts a SharePoint library or a leaver's account is removed and nobody notices for six weeks, can we get it back as it was? Native tools can say yes to recent, small, user-level mistakes. They get much weaker when the problem is large, old, discovered late or caused by someone with admin rights. Microsoft's own FAQ keeps the shared responsibility stance unchanged and says disaster recovery copies hold the current state of content, not historical versions.

The rest of this article walks through what each native feature does and where it stops, what Microsoft's own add-on covers, and how to decide. The figures below were checked against Microsoft's documentation in November 2026. Windows and limits change, so confirm anything you are about to rely on.

Four things that all get called backup

Most arguments about Microsoft 365 backup are really people using one word for four different jobs. Separating them makes the rest much easier.

• Availability: the service stays up and survives datacentre failure. Microsoft handles this. It does not give you yesterday's version of a file.
• Retention: a retention policy is a rule about how long to keep content or when to delete it. It is about governance, not about rolling a site back to Tuesday. A retention policy is a rule, not a time machine.
• Legal hold: preserving content so it can be searched and exported for an investigation or dispute. Microsoft's FAQ says legal holds are optimised for export, not for mass restore.
• Recoverable backup: independent point-in-time copies that an administrator can restore from quickly, at a scale that matches the damage. This is the one that matters after ransomware or a bad bulk deletion.

Exchange Online: what you can get back and for how long

When someone empties Deleted Items or presses Shift+Delete, the item moves to the Recoverable Items folder, a hidden part of the mailbox. Users can pull things back through Recover Deleted Items in Outlook or Outlook on the web. The default deleted item retention period is 14 days and can be raised to a maximum of 30. When it expires, the item is removed from Exchange Online.

A Litigation Hold or In-Place Hold changes that. Automatic purging stops, and originals of edited items are kept as well, so a hold can genuinely rescue you. It is still a compliance tool: it keeps everything rather than letting you pick a moment to return to, and it is designed around search and export. Without a hold or a Microsoft 365 retention policy, nothing keeps the original of an email after someone edits it.

• Deleted items: 14 days by default, up to 30 days, then permanently removed (unless a hold or retention policy applies).
• Calendar items: with single item recovery on, Microsoft's default is to purge calendar items after 120 days rather than 14.
• Recoverable Items space: the default limits are a 20 GB warning and 30 GB hard limit. They rise to 90 GB and 100 GB when a mailbox is on hold or has a retention policy. If the folder fills up, users cannot delete items and version copies stop being made.
• User-created folders: if a user presses Shift+Delete on a folder they created, the folder itself is hard deleted and cannot be recovered, even on hold. The contents go to Recoverable Items and remain recoverable for the retention period.
• Deleted mailboxes: a mailbox deleted with its user account, or whose licence is removed, is held for 30 days and then permanently deleted.

SharePoint and OneDrive: recycle bins, versions and the support window

Deleted SharePoint and OneDrive files go through two recycle bins. The first stage is visible to users. If a user empties it, items move to the second-stage recycle bin, which only site collection administrators can see. The key point people miss is that 93 days is one clock covering both stages, starting when the item was first deleted. It does not restart on the second stage. The second-stage bin can also be purged earlier if it exceeds its quota, with the oldest items going first.

After 93 days the item is permanently deleted. Microsoft says it keeps backups for a further 14 days, and an administrator can ask Microsoft Support for a site collection restore in that window. That restore applies to whole site collections, not single files, so it is a last resort rather than a plan.

For ransomware or overwrites, version history lets you roll a file back, and OneDrive has a Restore your OneDrive feature that undoes activity from the last 30 days. Both depend on the state of the files being recoverable. Files permanently deleted from the recycle bin cannot be brought back this way, and Microsoft's FAQ points out that versions can be exhausted by the version limit and do not scale well when an administrator has to orchestrate a large recovery.

Retention policies add a safety net of a different kind. When content under a retention policy is edited or deleted, a copy of the original goes into the hidden Preservation Hold library. When the retention period ends, those items move to the second-stage recycle bin for up to 93 days before permanent deletion. Content in the recycle bins is not indexed, so an eDiscovery search cannot find it to place a hold on it.

Leavers and deleted users: the quiet gap

The most common real-world data loss is not a cyber attack. It is a leaver clear-out. Deleting a user account in Microsoft 365 starts a 30-day recovery window. After 30 days the account and its mailbox are permanently deleted. Removing an Exchange Online licence has the same 30-day grace period for the mailbox data.

OneDrive for a deleted user is kept for a period an administrator sets, between 30 and 3650 days, so check what your tenant is actually set to rather than assuming. If a retention policy covers the OneDrive, the files stay under that policy for its duration, and when the period ends with a delete action they move into the Site Collection Recycle Bin, where only an admin can reach them.

If you need a leaver's mailbox beyond 30 days, an inactive mailbox is one route: Microsoft's documentation describes placing a Litigation Hold on a mailbox before deleting it. That preserves content, but it keeps one mailbox on hold rather than giving you a backup you can restore from at a chosen date.

Treat the leaver process as a decision point. Before deleting, confirm whether anyone needs the mail or files, and whether your retention settings or a backup will still have them in three months.

Microsoft 365 Backup: Microsoft's own paid add-on

Microsoft 365 Backup is a separate product that backs up Exchange Online, OneDrive and SharePoint. It is not the same thing as retention or the recycle bin, and it is not switched on for you. A SharePoint Administrator, Global Administrator or the dedicated Microsoft 365 Backup Administrator role turns it on, links an Azure subscription for pay-as-you-go billing and creates backup policies for the sites, OneDrive accounts and mailboxes you want covered.

Microsoft documents it as billed by consumption, not per user. The overview gives a rate of $0.15 per GiB per month for the data protected, with restores free. That is a US dollar figure on Microsoft's page, so get a UK quote and tax treatment from your reseller or Azure billing before budgeting.

What it adds that native tools do not: recovery windows you can set to 3 months, 6 months, 1 year or 2 years, and restore points every 10 minutes for the last two weeks of OneDrive and SharePoint, then weekly points back 52 weeks. Exchange has 10-minute points over the previous 52 weeks. Microsoft is explicit that the 10 minutes is not a snapshot every 10 minutes: changes to an item are saved as a new version at that frequency, and all deletions are backed up. Backups are stored append-only, meaning new copies can be added but existing ones cannot be altered. Retention and deletion policies from Purview do not affect the backup recovery window.

Know the limits before you buy. Exchange coverage includes user and shared mailboxes, but not room or group mailboxes. A handful of legacy SharePoint site templates are unsupported. Scale limits apply per workload: up to 1,000,000 items, 100 policies and 100,000 items per policy. Edits to emails in the Drafts folder are not versioned.

Also be clear about what it does not change. The backups sit inside Microsoft 365's data boundary and are managed by your tenant admins. Microsoft says deletion is not blocked, so that customers can offboard, though offboarded backups get a fixed 90-day recovery grace period and a multi-admin email notification feature can alert a group of admins to harmful actions. Backup activation takes on average up to 60 minutes plus another 60 minutes to create restore points, so it protects you from the day it is configured, not retroactively.

Some independent backup vendors build products on the same Microsoft 365 Backup Storage platform. Microsoft lists Veeam Data Cloud, Rubrik, AvePoint, Cohesity, Commvault and Druva, and says these solutions are not endorsed or certified from a technical standpoint by Microsoft. Others copy data out to storage the vendor or you control. Which one you are buying is a question to ask, not assume.

Which route fits your business

This part is our engineering judgement rather than sourced fact, so weigh it against your own situation. The three realistic positions are staying native, adding Microsoft 365 Backup or adding an independent product.

• Native only can be reasonable if lost data is easy to recreate, your people work mostly in email and a small amount of files, you accept the 14 to 30 day mail window and the 93-day file window, and your admin accounts are tightly protected. The risk is accepting it by default and finding out the windows are shorter than you thought.
• Microsoft 365 Backup suits you if you want fast, in-tenant restores and a simple relationship with Microsoft, you are comfortable with consumption-based billing through Azure and you accept that your tenant admins control the backups. It makes ransomware recovery far more realistic than versions and recycle bins do.
• Independent backup, especially stored outside your tenant, suits you if the nightmare is a compromised Global Administrator account, if contracts or insurers expect a copy separate from the production service, or if you want a different supplier and a different set of admin credentials guarding the copy. NCSC's guidance on cloud backups is the same idea: keep at least one backup disconnected from live systems so a single incident cannot reach all of them, and make sure it can be restored. The trade-offs are another supplier handling your data, another bill, and slower restore at scale if the copy lives somewhere remote.
• You almost certainly need more than native tools if you have any of these: customer, financial or legal records only held in Microsoft 365; no one reliably reviewing leaver deletions; a heavy SharePoint estate; or a regulator, customer contract or insurer asking how you would recover from ransomware or a bulk deletion. Check those requirements directly, since we cannot tell you what yours says.

A buyer checklist for any Microsoft 365 backup

Whether you pick Microsoft's add-on or an independent product, these are the questions that separate a convincing offer from a vague one. Ask for answers in writing and compare them against the facts above.

• Coverage: which of Exchange mailboxes (user, shared, group, room), OneDrive accounts and SharePoint sites are protected, and what is excluded. If you rely on other Microsoft 365 data such as Teams content, ask about it by name rather than assuming.
• Recovery points and retention: how often copies are taken, how far back you can go and whether the retention is independent of your Microsoft retention settings.
• Where the copy lives: which country, which supplier, and whether it sits inside or outside your Microsoft 365 tenant.
• Who can delete it: whether a compromised Global Administrator, or the vendor's own admin console, could erase the backups, and what delay or alerting exists before deletion takes effect.
• Restore choices: item, mailbox, site or whole account; original or alternative location; and how permissions, versions and metadata come back.
• Restore speed at your size: ask for realistic figures for a full restore of your data, not a single file.
• Leavers: how long backups of deleted users are kept and how you recover them.
• Cost: pricing basis (per user or per GiB), restore charges, growth, currency and tax.
• Alerts: how you find out when a backup fails or a policy is paused, and who gets told.
• Exit: how you get your backup data out if you change supplier.

Test a restore before you rely on it

A backup you have never restored from is a hope, not a control. This is a short Microsoft 365 specific trial, using disposable data, that works with whichever route you choose. It needs admin rights for your tenant and the backup tool, so hand it to your IT provider if that is not you. Do not use live business content for this test.

1. Create a small set of test content: a test mailbox with a handful of emails, and a test SharePoint site or OneDrive folder with a few files. Make sure they are inside the scope of the backup policy.
2. Note the time and what the content looked like. If you have just switched Microsoft 365 Backup on, allow for it to catch up: Microsoft says activation takes on average up to 60 minutes plus another 60 to create restore points. For other products, ask the vendor how long until the first usable restore point.
3. Delete a few test items, then empty the relevant Deleted Items or recycle bin so you are testing recovery from backup rather than from the bin.
4. Restore to an alternative location, such as a new URL or a new folder in the mailbox, rather than overwriting the original. Microsoft's in-place restore of a site or OneDrive rolls it back to the chosen point and overwrites everything changed since, so never run that as a trial on a site people are using.
5. Check what came back: file contents, dates, folder structure and permissions, and that the mail is readable. Record how long it took, who ran it and what permissions they needed.
6. Repeat once for a leaver scenario if you plan to rely on backups for deleted users: ask how you would recover a test user's mailbox and OneDrive, and what the answer depends on.