Microsoft 365 is not backed up in the way most people assume. Microsoft keeps the service running and protects against its own infrastructure failures, but it does not protect you from a deleted mailbox, a compromised account wiping files, or data aged out by a retention policy. Once Microsoft’s short recovery windows pass, that data is gone.
What Microsoft actually provides
- Recycle bins – deleted items recoverable for 30 days (93 for some), then purged
- Version history in SharePoint and OneDrive – limited number of versions
- Retention policies – only if you configure them, and they are about compliance, not backup
- Litigation hold – preserves data for legal reasons, not a restore tool
What it does not cover
- A user (or attacker) permanently deleting mail or files
- Ransomware encrypting synced OneDrive and SharePoint content
- A departed employee’s mailbox deleted, then needed months later
- Corruption or mass changes you do not notice for weeks
- Recovering a single item from two years ago
The fix: third-party backup
A dedicated Microsoft 365 backup takes independent daily copies of Exchange, OneDrive, SharePoint and Teams, retained for years, restorable to any point. This is what closes the 3-2-1 backup gap – your 365 data becomes a real, recoverable copy rather than a single live version. We include it in our backup and disaster recovery service.
Need help with Microsoft 365? See our backup and disaster recovery service or talk to our Edmonton team.
Microsoft 365 guides
- Microsoft 365 vs Google Workspace
- Microsoft 365 licensing explained
- What you get with Business Premium
- OneDrive vs SharePoint vs Teams files
- Microsoft 365 security checklist
- Is Microsoft 365 backed up?
- Migrating email to Microsoft 365
Frequently asked questions
Does Microsoft back up my email and files?
Only for its own operational recovery. It does not offer a full point-in-time backup you can restore from after a deletion, ransomware event or retention lapse – that is your responsibility.
How long does Microsoft keep deleted items?
Typically 30 days in the recycle bin, up to 93 for deleted mailboxes and some items, then permanent deletion. Not enough for many real recovery needs.
Do I need a backup if I have retention policies?
Retention policies are a compliance control, not a backup. They can also be changed or misconfigured. A separate backup is still needed.
How does Scandifix help?
We set up and monitor a third-party backup of your entire Microsoft 365 tenant, with tested restores, as part of managed backup.