Microsoft 365 Doesn’t Back Up Your Email. You Do.
The sentence buried in your service agreement
Microsoft says it plainly in their own documentation, and almost nobody reads it. They’re responsible for keeping the service running. You’re responsible for your data. It’s called the shared responsibility model, and the short version is that Microsoft guarantees the lights stay on, not that your stuff will still be there tomorrow.
I bring this up because I’ve had this conversation with three business owners in the last few months, and every one of them thought the opposite. Their reasoning made sense too. It’s in the cloud. Microsoft is a trillion dollar company. There’s a recycle bin. Somebody has to be backing this up.
Somebody isn’t.
What Microsoft actually keeps, and for how long
There is some safety net in there. It’s just a lot shorter and thinner than people assume.
- Deleted email: lands in Deleted Items until it’s emptied, then sits in Recoverable Items for 14 days by default. An admin can stretch that to 30. After that it’s gone.
- Deleted files in OneDrive and SharePoint: 93 days in the recycle bins, then gone. And that clock starts the moment it’s deleted, not the moment you notice.
- A deleted user account: 30 days in the soft-deleted state. Remove the license instead of deleting the account and the mailbox can be purged in as little as 30 days too.
- Teams chats and channel files: messier than you’d hope. Chat history and the files behind it live in different places with different retention.
Notice what’s missing. There’s no point-in-time restore. You can’t say ‘put my mailbox back the way it was last Thursday at 3 p.m.’ You can only fish individual items out of a bin before the timer runs out.
The four ways this actually bites people
1. Somebody deletes something and nobody notices for months
This is the boring one and it’s also the most common. An employee cleans up a SharePoint folder, or empties a mail folder to free up space, or drags something to the wrong place. Six months later you need it for a client dispute or an audit. It’s been gone for three.
2. An employee leaves and you cancel their license
Reasonable move. You’re paying per user and they’re gone. Then in March you need the contract they emailed a client in October, and the mailbox went with the license. This one hurts because it’s a decision you made on purpose, for a good reason, without knowing what it cost.
3. Ransomware syncs right up into the cloud
Here’s the one people don’t see coming. If a laptop gets hit and OneDrive is syncing that folder, the encrypted files sync too. The cloud copy is now encrypted, obediently, in real time. Microsoft has a Files Restore feature that can roll a OneDrive library back 30 days, and it’s genuinely useful, but it’s clunky at scale and it only covers OneDrive and SharePoint. Your email isn’t in that story at all.
4. Someone gets in and burns the evidence
Business email compromise, wire fraud, that whole family of attack. When the attacker is finished, they often delete the thread so you can’t reconstruct what happened. Now you’re explaining to your insurance carrier and your client why you have no record.
What a real backup looks like
Third party backup for Microsoft 365 runs somewhere around three to six dollars per user per month, depending on the vendor and how long you keep things. For a ten person shop that’s a rounding error against the cost of one bad afternoon.
What you’re paying for:
- Multiple restore points per day, kept for years, not weeks.
- Coverage across Exchange, OneDrive, SharePoint, and Teams, since real work is spread across all four.
- Restore granularity that’s actually usable. One email, one folder, one whole mailbox, into the original account or a different one.
- Storage that lives outside your tenant. If your Microsoft account itself gets compromised, the backup isn’t sitting in the same locked room.
- Retention you control, which matters if you’re in healthcare, finance, or legal and someone can ask you for records from four years ago.
Retention policies and litigation hold inside Microsoft 365 are worth turning on too, and they’re included in a lot of plans. They’re not a backup though. They’re a legal preservation tool. They keep things from being purged, but they don’t give you a clean ‘restore this account to Tuesday’ button, and they don’t help at all if the tenant itself is the problem.
The part everybody skips
Buying backup is the easy half. The half that gets skipped is proving it works.
Once a quarter, pick a random mailbox and restore something from ninety days ago into a test account. Time it. Write down how long it took and whether the person doing it had to call support. That’s your real recovery capability, not whatever the dashboard claims.
I’ve seen backup systems that had been reporting green for over a year and could not produce a usable restore. A backup you’ve never restored from is a hope, not a plan. Hurricane season down here is a decent annual reminder to check.
Where to start this week
Three things, in order. Find out whether you have Microsoft 365 backup at all (ask your IT provider directly, and ask them to show you a restore, not a screenshot of a dashboard). Second, stop deleting the accounts of departed employees until you’ve either archived the mailbox or converted it to a shared mailbox, which is free and keeps everything. Third, put a quarterly restore test on the calendar with a real name attached to it.
We handle Microsoft 365 backup and recovery for small businesses from Delray Beach to West Palm Beach, and the first thing we do on any new account is find out what would actually be recoverable if today went sideways. If you’re not sure what the answer is for your business, that’s worth thirty minutes of your time. Always happy to troubleshoot.