Does Microsoft back up your Microsoft 365 data?
Microsoft keeps the service running and gives you ways to undo recent mistakes. That is not the same as holding a separate copy you can restore from months later. Here is where the line sits.
What Microsoft does protect
Microsoft 365 is built so that a failure on Microsoft's side does not lose your data. Its documentation for SharePoint and OneDrive puts it this way:
“Every file is simultaneously written into both a primary and a secondary datacenter region.”
Microsoft Learn, SharePoint and OneDrive data resiliency
On top of that, you get tools for undoing your own mistakes:
- Version history. New document libraries keep 500 versions of each file by default.
- Files Restore. A whole library or OneDrive can be rolled back to any point in the last 30 days.
- Recycle bins. Deleted files and emails sit in a recycle bin before they are removed for good.
This is real protection and it covers the most common accident, which is someone deleting the wrong thing and noticing the same week.
The time limits
Each of those tools has a window. These are Microsoft's defaults at the time of writing.
| What happened | How long you have |
|---|---|
| An email was deleted, then emptied from Deleted Items | 14 days by default. An administrator can raise this to a maximum of 30. |
| A mailbox was deleted, or its licence removed | 30 days. After that the mailbox is permanently deleted and can't be recovered. |
| A file was deleted from SharePoint or OneDrive | 93 days in the recycle bin. |
| A library was hit by ransomware or a bulk mistake | 30 days of roll-back through Files Restore. |
| A staff member left and their account was deleted | Their OneDrive is kept for 30 days by default, then moves to a recycle bin for a further 93 days, where only an administrator can restore it. |
Where the gaps appear
None of those limits is unreasonable. The trouble is that data loss is rarely noticed on Microsoft's schedule.
- The late discovery. A folder was deleted in March and someone goes looking for it in August. The 93 days have passed.
- The departed employee. Someone leaves, the licence is reclaimed to save money, and nobody copies the mailbox within 30 days.
- The deliberate deletion. Recycle bins can be emptied. Anyone with enough access, careless or malicious, can remove items before the window closes.
- The slow corruption. A bad change spreads quietly through shared files and is only spotted after the roll-back window has gone.
Aren't retention policies enough?
Microsoft 365 also has retention policies and legal holds, which can keep content well beyond the windows above. They help, and regulated businesses often need them anyway.
They are built for compliance, though: proving what existed and keeping it from being destroyed. They are not designed to put a whole team's files back the way they were last Tuesday. For that you want something built for restoring.
Your three options
| Option | Where the copy lives | How far back | Cost |
|---|---|---|---|
| Rely on the built-in windows | Inside your tenant | 14 to 93 days | Included |
| Microsoft 365 Backup | Inside the Microsoft 365 boundary, in your data's region | 3 months to 2 years, set by policy | Pay-as-you-go: US$0.15 per GB per month, with free restores |
| Third-party backup | A separate platform, outside Microsoft | Set by the product and plan | Usually per user, per month |
Microsoft 365 Backup is Microsoft's own product. It covers OneDrive, SharePoint and Exchange Online, and it has to be switched on and paid for separately. The price shown is Microsoft's list price at the time of writing. Microsoft says its backup data “never leaves the Microsoft 365 data trust boundary”, which is good for data residency and also means the copy sits with the same vendor as the original.
A third-party backup puts the copy somewhere else entirely. If your concern is an account compromise or an administrator mistake inside the tenant, that separation is the point.
Five questions to ask about any backup
- What exactly is covered: mailboxes, OneDrive, SharePoint, Teams?
- How far back can you go, and does that change if a user's licence is removed?
- Where is the copy held, and in which country?
- When was a restore last tested, and can I see the result?
- Who can get at the backups, and is that access logged?
How Lumetra handles it
Our Professional and Fortified plans include third-party backup of your Microsoft 365 data with unlimited retention, and we test restores. Fortified adds an annual disaster recovery test. Backup locations are listed in the data-locations table you receive before you sign.
Sources
All from Microsoft Learn, checked 11 October 2026. Microsoft changes these defaults from time to time.
This guide is general information for Australian businesses, correct to the best of our knowledge when it was last reviewed. It is not legal, financial or security advice for your specific situation.