Does Microsoft 365 Back Up Your Data? What Most Small Businesses Assume, and What Microsoft Actually Says

Your files live in the cloud. That isn’t the same as your files being backed up.

Picture a small firm where someone tidies up a shared SharePoint folder and deletes a project directory. Nobody notices. Four months later, a client asks for a document from that project. Someone checks the recycle bin, and it’s empty.

Nothing broke and nobody was careless. The firm assumed that data in Microsoft 365 is backed up, and for most of what small businesses mean by “backed up,” it isn’t. This is why understanding what Microsoft 365 backup actually covers matters.

This is one of the most common gaps we see in small business IT, and it’s fixable. Here’s what Microsoft 365 does and doesn’t do, in plain English.

What Microsoft takes care of, and what it leaves to you

Microsoft runs the service: it keeps it available and durable. Protecting your own data, including being able to get it back after a mistake, an attack, or a deletion, is described by Microsoft as a shared responsibility, with customers responsible for their data management and protection. The same shared responsibility applies to Microsoft 365 backup.

In practice, that means Microsoft keeps the lights on, and recovering a file or mailbox from last quarter is largely your job.

What Microsoft 365 gives you by default

Microsoft 365 does include safety nets for everyday mistakes. They’re useful, but they’re short and they aren’t the same thing as a backup. Examples from Microsoft’s documentation:

• Email: by default, Exchange Online keeps permanently deleted mailbox items for 14 days. An administrator can raise that to a maximum of 30 days. After that, the item is gone.
• Files in SharePoint and OneDrive: for work or school accounts, the recycle bins keep deleted files for a total of 93 days, across two stages. After that, they’re permanently deleted.

These windows are defaults. Administrators can change some of them, and retention policies and holds can keep data longer. But the point stands: they’re built for “oops, I deleted that yesterday,” not “we need that file from last spring.”

Check your own settings rather than assuming. They may differ from the defaults above.

Where the gap shows up

A recycle bin and a backup are different tools. A few situations where the difference matters:

• A deletion nobody notices for months, like the folder above
• A departing employee who removes files on the way out
• Sync spreading a mistake, where a file deleted or damaged on one device is deleted or damaged everywhere
• An account takeover, where an attacker deletes or changes mail and files
• Ransomware, where the question that matters is how quickly you can restore clean copies

Microsoft also sells its own paid backup product, Microsoft 365 Backup, which has a longer retention window than the built-in tools. It’s worth looking at alongside third-party options. Check Microsoft’s current details and licensing, since they change.

What good backup looks like

The Canadian Centre for Cyber Security recommends the 3-2-1 rule for Microsoft 365 backup: three copies of your information (the original plus two backups), on two different types of storage, with one copy kept off site.

Its guidance goes further in ways that matter for small businesses:

• Backups reachable from your network can be reached by ransomware. The Cyber Centre says offline storage offers the most protection, because disconnected backups can’t be reached or deleted by malware on your network.
• Test your backups and your restore process. It suggests a regular schedule, with monthly given as an example.
• Scan backups before restoring them, and restore into a clean, isolated environment first.
• If you use a vendor for off-site storage, check its security measures, incident handling, and recovery plans, and whether your data needs to stay in Canada.

Five questions to ask yourself, or your IT provider

1. What exactly is backed up, including email, SharePoint, OneDrive, and Teams files?
2. How far back can we restore, and who decides that?
3. Where do the copies live, and could ransomware on our network reach them?
4. Who holds the encryption keys for off-site copies?
5. When did we last restore something, and how long did it take?

If the answers are “we think so,” “not sure,” or “we’ve never tried,” you’ve found your first priority. And if you already have an IT provider, these are fair questions to ask them. A good one will be glad you did.

A 20-minute exercise for this week

1. Open your Microsoft 365 admin settings and write down your current retention settings.
2. Pick one file from three months ago. Could you get it back?
3. Write a one-line answer to “who owns Microsoft 365 backup here?”
4. Put a restore test in the calendar.

How A2 SecureCloud helps

Our backup approach follows 3-2-1: your original data, a fast local copy on an in-office NAS, and an encrypted copy off site where only you hold the key, so the provider can’t read it. We include one recovery test each year, and more frequent testing is available as an add-on. If you already have an IT provider, we’re also happy to act as an independent second opinion: a restore check that shows what you could get back, and how fast.

Not sure where you stand? Our free IT assessment takes about three minutes and includes backup and recovery, or you can email us at info@a2securecloud.ca.

Take the assessment

A2 SecureCloud is a Canadian-owned managed IT and cybersecurity company serving small businesses across Canada, with on-site support in Durham Region, Ontario.

Sources: Microsoft: Deleted item retention in Exchange Online, OneDrive retention and deletion, Restore items from the SharePoint recycle bin, Microsoft 365 Backup FAQ, Microsoft 365 Backup (Tech Community). Canadian Centre for Cyber Security: Tips for backing up your information, Ransomware playbook.