Do You Need to Back Up Microsoft 365?

A familiar story

An employee leaves, sometimes on bad terms, and on the way out deletes a folder of client files and a few years of email. Nobody notices for six weeks. By then the email is usually gone for good: once someone empties the Deleted Items folder, Microsoft keeps those messages recoverable for 14 days by default, 30 at most (Microsoft). The files may still be in the recycle bin, which holds them for 93 days.

With an independent backup, it's a different afternoon. You open the backup, browse what that person had on any day before they left, and put back exactly what's missing. Or you simply look, when what you need is to find out what was there.

What Microsoft promises, and what it doesn't

Microsoft's service level agreement for Exchange Online, SharePoint and OneDrive is a refund formula for downtime. If a service is up less than 99.9% of a month, you get a credit of 25% of that month's fee for it, rising to 50% below 99% and 100% below 95%. Those credits are the only remedy. The agreement says nothing about getting lost data back, and it excludes problems caused by someone using your passwords (Microsoft SLA, November 2026).

Microsoft does keep several copies of everything, so its own hardware failures don't cost you data. But its documentation says your data, accounts and settings remain your responsibility (Microsoft), that restoring a mailbox to an earlier point in time is outside what Exchange Online does (Microsoft), and its 2024 best-practices paper recommends a backup product for ransomware and mistaken deletion (Microsoft, 2024). That paper comes from a company that sells one, but it's still Microsoft saying so.

You may have read that "Microsoft's terms tell you to back up with third-party apps." That line comes from Microsoft's terms for personal accounts (Microsoft Services Agreement). Business contracts don't say it. They simply never promise to restore what's deleted.

What Microsoft keeps for you

These are Microsoft's defaults for business plans. They're genuinely useful, and for many everyday mistakes they're all you need.

• Email: the Deleted Items folder isn't emptied automatically. After someone empties it, or deletes with Shift+Delete, messages can be recovered for 14 days, and your IT person can raise that to 30.
• Files in OneDrive, SharePoint and Teams: deleted files stay in the recycle bins for 93 days, and earlier versions of each file are kept (Microsoft).
• Undoing a disaster: a whole OneDrive, or a whole SharePoint document library, can be rolled back to any point in the last 30 days (Microsoft). Microsoft built this for ransomware and mass deletion, and it works, if you notice within 30 days.
• Someone who leaves: a deleted user's account and mailbox can be restored for 30 days (Microsoft). Their OneDrive is kept 30 days by default, which your IT person can raise to as long as 10 years, then 93 more days in a recycle bin (Microsoft).
• Teams chats: a sender can undo a message they deleted, but without a retention policy there's no documented way for an admin to bring deleted chats back.

On Google Workspace instead? Similar idea: deleted Drive files stay in the trash for 30 days, admins can recover them for 25 days after that, and Google says its Vault tool "isn't a data archive" (Google).

Retention isn't a backup

On Business Premium, you can switch on retention policies that keep email and files for years, even after someone deletes them. Business Basic and Business Standard don't include retention policies for email and files (Microsoft), so their safety net is mostly the recycle bins and the windows above.

Even with retention on, it isn't the same as a backup. Retention is a "do not throw away" note taped to your files; a backup is a photocopy in a different drawer. Retained copies live inside the same Microsoft 365 account, controlled by the same admin logins. Someone with admin rights, or a criminal who steals them, can usually change or delete the policies, unless your IT person has locked them. And getting retained items back means searching for them and exporting them: fine for one contract, slow for a whole mailbox.

The departing-employee trap

When someone leaves, removing their license feels like an easy saving. It also starts clocks. Their email is kept 30 days after the license is removed, then deleted for good unless a retention policy covers it (Microsoft). Their OneDrive turns read-only after 60 days without a license and is archived at 93 days, after which reopening it is billed by the gigabyte. And since July 2026, a OneDrive that stays unlicensed and unpaid for a year can be deleted even if a retention policy or legal hold is on it (Microsoft).

The free fixes: before removing a license, convert the mailbox to a shared mailbox (no license needed up to 50 GB), move the files someone else needs, and have your IT person raise the deleted-user OneDrive retention from 30 days. Or keep an independent backup, so the copy you need doesn't depend on Microsoft's clocks.

Files on your computer

Files saved only on a computer aren't in Microsoft 365 at all. OneDrive can fix most of that: once it's signed in with your work account, it can back up each computer's Desktop, Documents and Pictures folders to OneDrive. Microsoft calls this Known Folder Move, and someone has to turn it on (Microsoft). Anything saved elsewhere on the computer still lives only there.

A bonus: once those folders are in OneDrive, a backup of each person's OneDrive covers them too, so many businesses don't need a separate computer backup for everyday files.

Microsoft's own backup add-on

Since July 2024, Microsoft has sold Microsoft 365 Backup. It protects email, OneDrive and SharePoint (which includes files shared in Teams, but not Teams chats), takes restore points as often as every 10 minutes, and keeps them for 3 months to 2 years. It costs $0.15 per gigabyte per month, restores are free, and it needs an Azure pay-as-you-go billing account (Microsoft, pricing).

It's fast and hard to tamper with, but it lives inside Microsoft 365. Microsoft's 2024 paper calls rules that require copies outside Microsoft 365 "outdated." US government guidance disagrees: CISA recommends offline, encrypted backups that you test regularly (CISA), and the long-standing 3-2-1 practice says to keep three copies, on two kinds of media, with one stored somewhere else (US-CERT). We side with the government guidance: at least one copy should live outside the system it protects.

What an independent backup costs

Published list prices for cloud backup of Microsoft 365 mostly run about $2 to $5 per person per month, with premium tiers up to about $7. Microsoft's own add-on is priced by data instead, so it can cost more or less depending on how much you keep. When you compare, ask two questions:

• Are shared SharePoint and Teams libraries included? Many plans include them in the per-person price; some charge for them separately, and large shared libraries can cost more through storage limits.
• Are computers included? Computer backup is often a separate product, at roughly $7 more per person.

If you buy Microsoft 365 through an IT provider, read their terms too: some put backup responsibility on you in writing.

Rules that may require it

• Health care: the HIPAA Security Rule requires a data backup plan, meaning retrievable exact copies of electronic patient information (45 CFR 164.308).
• Tax, accounting and other financial firms: the FTC Safeguards Rule doesn't use the word "backup," but it requires protecting the availability of customer information and a plan to recover from security events (16 CFR 314.4). Backups are the normal way to meet both.
• Records: the IRS says to keep most tax records for 3 years, employment tax records for at least 4, and some for 6 or 7 (IRS). If invoices and payroll live in email or OneDrive, a 30-day window after someone leaves can collide with that.
• Insurance: cyber insurance applications often ask about backups. See Does my business need cyber insurance?

Rare, but it has happened

Microsoft losing business data is genuinely rare. But in 2026 Microsoft told some nonprofit customers that, because of an error, it had deleted data from expired subscriptions before the retention period ended. Its message: "the data cannot be recovered" (The Register, September 2026). It's one case, not a trend. It's also the kind of loss only a copy outside Microsoft 365 protects against.

Do you need one? Seven questions

1. If an important folder was deleted two months ago and we noticed today, could we get it back?
2. When someone leaves, who decides what happens to their email and files before the license is removed?
3. Which Microsoft 365 plan are we on, and has anyone switched on retention policies?
4. How many people can sign in as an administrator, and do all of them use two-step login?
5. If a criminal got into an admin account and deleted everything, would we still have a copy they couldn't reach?
6. Does any law, contract or insurance application we've signed say we keep backups or records for a set time?
7. Are important files saved only on someone's computer, outside OneDrive?

If you answered "I don't know" to more than two, you're relying on luck, not on Microsoft.

Free checks you can do this week

No purchase needed. Your IT person can do most of these in an hour:

• List who has global admin rights. Microsoft recommends fewer than five, all using two-step login (Microsoft).
• Raise the OneDrive retention for deleted users from 30 days, for example to a year (SharePoint admin center, Settings, Retention).
• Make sure deleted email is kept the full 30 days, not the default 14.
• Test it: delete an email and a file, then restore both. Roll back a test library.
• Turn on OneDrive folder backup on every computer.
• Check the OneDrive accounts report for forgotten, unlicensed accounts heading for archive or deletion.
• Write down the steps for when someone leaves, and follow them every time.

This guide is general information, not legal advice. Microsoft changes these settings, windows and prices from time to time. The figures here were checked against Microsoft's own documentation in November 2026, and we review the guide regularly.

Sources

1. Microsoft, Service Level Agreement for Microsoft Online Services, November 2026 edition.
2. Microsoft Learn, Shared responsibility in the cloud, August 2026.
3. Microsoft, Microsoft 365 Backup: Best practices for data recovery and business continuity, July 2024.
4. Microsoft Learn, Back up email in Exchange Online and Recoverable Items folder in Exchange Online, 2025–2026.
5. Microsoft, Microsoft Services Agreement (consumer terms), effective September 30, 2026.
6. Microsoft Learn, SharePoint and OneDrive data resiliency, January 2026; Microsoft Support, Restore your OneDrive and Restore a document library.
7. Microsoft Learn, Restore a user, Unassign licenses and OneDrive retention and deletion, 2026.
8. Microsoft Learn, Manage unlicensed OneDrive user accounts, August 2026.
9. Microsoft Learn, Microsoft Purview service description, October 2026.
10. Microsoft Learn, Redirect and move Windows known folders to OneDrive, March 2025.
11. Microsoft Learn, Overview of Microsoft 365 Backup and pricing model, August 2026.
12. Microsoft Learn, Best practices for Microsoft Entra roles, June 2026.
13. CISA, #StopRansomware Guide, September 2023; US-CERT, Data Backup Options, 2012.
14. 45 CFR 164.308 (HIPAA Security Rule) and 16 CFR 314.4 (FTC Safeguards Rule); IRS, How long should I keep records?
15. The Register, Microsoft tells nonprofits their deleted M365 data isn't coming back, September 28, 2026.
16. Google Workspace Admin Help, Recover deleted files for Drive users and Vault overview.
17. Published list prices from several backup providers, checked November 1, 2026.