Does Microsoft 365 Back Up Your Data? Not by Default

We hear a version of this fairly often: "our data's in Microsoft 365, so it's backed up." It's a reasonable-sounding assumption. It's also not correct, and Microsoft says so plainly in its own terms.

Microsoft 365 runs on what's called a shared responsibility model. Microsoft is responsible for keeping the platform up and running: data centre uptime, infrastructure security, geo-redundancy so a hardware failure in one location doesn't take the service down. The customer, meaning your practice, is responsible for the data itself, including protecting it, retaining it, and being able to recover it if something goes wrong. Microsoft's own recommendation is that customers regularly back up their content and data stored on its services.

What Microsoft 365 actually gives you natively

There are genuinely useful recovery features built into Microsoft 365. They're just narrower than most people assume.

• Exchange Online keeps deleted email in a recoverable state for 30 days by default before it's permanently purged
• SharePoint and OneDrive recycle bins retain deleted files for roughly 93 days
• Version history lets you roll a document back to an earlier saved version
• Retention policies and litigation hold preserve content for compliance purposes

Each of these solves a specific, narrow problem. None of them is a backup in the sense that term is normally used. Retention policies exist to satisfy a compliance obligation, not to give you a clean, restorable copy of your tenant at a specific point in time, and content held under a retention policy or litigation hold can't always be restored to its original location. Recycle bins have a hard time limit and require someone to notice and act within that window. If a piece of ransomware syncs through OneDrive and encrypts files, or a compromised admin account is used to delete user accounts and mailboxes outright, or a retention policy is misconfigured and content ages out before anyone catches it, these native tools often can't fully undo the damage.

Microsoft's own actions are a useful signal here too. In 2024, Microsoft launched a paid Microsoft 365 Backup add-on specifically to give organisations a genuine restorable copy of their Exchange, SharePoint and OneDrive data, which is effectively an admission that the built-in retention and recycle bin features were never meant to serve that purpose.

Where this becomes a compliance problem, not just an inconvenience

For a health practice, this isn't only about convenience. If your practice is following the standard retention guidance covered in our patient record retention guide, that's a minimum of 7 years for adult records and considerably longer for records relating to minors. A 93-day SharePoint recycle bin doesn't come close to covering that. Under APP 11, you're expected to take reasonable steps to protect personal information for as long as you hold it, and "we assumed Microsoft handled that" isn't a defensible position if a practice ends up unable to recover patient records it was still required to have on file.

Teams data is worth calling out specifically, since it's one of the most commonly overlooked workloads. Chat messages, meeting recordings and channel files often aren't covered by whatever backup arrangement a practice already has for email and files, simply because nobody thought to check.

What proper backup actually looks like

A genuine backup solution, whether that's Microsoft's own paid add-on or a third-party product, creates a separate copy of your Microsoft 365 data that exists independently of your live tenant. That separation is the entire point. If your tenant is compromised, misconfigured, or has content deleted from it, whether by a person, a piece of malware, or an automated policy doing exactly what it was told to do, the backup sits outside that blast radius and can be restored from.

At minimum, that means coverage for Exchange Online, SharePoint, OneDrive and Teams, with the ability to restore an individual mailbox, file, or Teams channel to a specific point in time, not just a full-tenant restore as the only option.

The short version

If nobody in your practice can answer, with confidence, "what would we actually recover if a staff member's OneDrive got hit with ransomware tomorrow," that's worth finding out before it becomes the day you're trying to find out for the first time. Checking what backup coverage genuinely exists for your Microsoft 365 tenant, separate from what Microsoft provides by default, is a short piece of work with a fairly obvious payoff.