Microsoft 365 retention versus real backup: what is actually protected

What Microsoft is responsible for

Microsoft runs the infrastructure. Your mail and files are stored in multiple copies across its datacentres, so a failed disk or even a lost building should not cost you data. That protects you against Microsoft's own failures. It does not mean Microsoft will restore a folder your office manager deleted, an inbox a departing employee emptied, or SharePoint files encrypted by ransomware that synced up from a laptop.

Microsoft's service agreement describes this split as shared responsibility. The provider looks after the platform; the customer looks after their data, accounts and settings. The built-in recovery tools, such as recycle bins and version history, exist, but they are time-limited and they live in the same tenant as the data they protect.

What retention policies actually do

Retention policies, set in Microsoft Purview, tell Microsoft 365 to keep content for a defined period even if someone deletes it, or to delete it after a period. A policy might keep all email for seven years to meet record-keeping needs, or keep every SharePoint document for a set time after it was last modified. Content deleted by a user is held in a hidden preservation area until the retention period ends.

That is valuable for compliance and for investigating what happened. But retention is not designed for fast recovery. Getting something back typically means an administrator running a content search and exporting results, not clicking restore. It does not put a folder structure back the way it was, it does not roll a mailbox back to last Tuesday, and it depends on the tenant itself remaining intact and under your control.

What a separate backup adds

A Microsoft 365 backup service copies mailboxes, OneDrive, SharePoint and Teams data to storage outside your tenant, usually several times a day, and keeps those copies for as long as you set. Restoring is a point-and-click job: pick a user, a date and the items, and put them back in place or download them. That speed matters when a director needs last month's version of a contract within the hour.

The independence matters even more. If an attacker gains global admin rights and deletes users, sites and retention policies, data held inside the tenant may be at risk. A backup held by a separate service with separate credentials is out of their reach. The same applies if a mistaken admin action removes a large amount of data at once.

Common gaps in small offices

The usual gap is the leaver. A staff member resigns, their licence is removed, and their mailbox and OneDrive are deleted after the standard holding period. Months later a client dispute needs an email they sent, and nothing is left. Converting the mailbox to a shared mailbox, applying a retention policy or keeping a backup would each have prevented that.

Other gaps include assuming the old on-premises backup still covers everything after the move to the cloud, backing up email but not SharePoint and Teams, and never testing a restore. A backup that has never been restored is a hope, not a plan, and failures often only come to light at the worst possible moment.

Choosing a backup approach

Look for a service that covers Exchange mailboxes, OneDrive, SharePoint and Teams, stores copies outside Microsoft 365, keeps data for at least as long as your record-keeping needs, and allows restores of single items as well as whole accounts. Ask where the backup data is stored, because some businesses prefer to keep copies in Australia or New Zealand. Pricing is usually per user per month; check current pricing and what counts as a user.

Microsoft also offers its own backup product for Microsoft 365 with fast restore of large volumes. It lives within Microsoft's ecosystem, so weigh the convenience against the independence of a third-party store. Some businesses use retention policies for compliance and a separate backup for recovery, which covers both needs without asking one tool to do the other's job.

Putting it together

A sensible arrangement for a small office has three layers. Version history and recycle bins handle day-to-day slips. Retention policies make sure records you are obliged to keep cannot simply be deleted. An independent backup covers deliberate deletion, account compromise, leavers and anything older than the recycle bin keeps. Each layer is cheap on its own; the expensive part is finding out which one was missing after the data has gone.

Write down what each layer covers and how long, then schedule a restore test every quarter. Pick a mailbox item, a SharePoint file and something from a former employee and bring them back. If the test fails, you have found the problem on a quiet Tuesday rather than in the middle of an incident.