Microsoft 365 includes retention, versioning and service resiliency, but those are not the same thing as a dedicated backup. Microsoft now also offers Microsoft 365 Backup as a separate paid service, alongside third-party backup products. Either way, deciding how your data is protected from accidental deletion, corruption, ransomware or a rogue member of staff sits with you.
This is one of the most common misunderstandings we come across when we talk to businesses in Hertfordshire and North London about their IT setup. People assume that because their email, SharePoint and OneDrive live "in the cloud," Microsoft must be backing it all up somewhere. It's an easy assumption to make, but the built-in features aren't a backup on their own — and it matters, because the gap only becomes visible after something has already gone wrong.
The shared responsibility model
Microsoft is very clear about this in its own documentation, even if it doesn't shout about it. Microsoft's role is to guarantee the availability, security and resilience of the Microsoft 365 platform — the data centres, the uptime, the underlying infrastructure. Your role, as the customer, is to look after the data you put into that platform. Microsoft calls this the shared responsibility model, and it applies across Exchange Online, SharePoint Online, OneDrive and Teams.
In practice this means:
- If Microsoft has an outage, that's their problem to fix.
- If an employee deletes a folder of client files, or a phishing email leads to files being encrypted, or someone accidentally overwrites a spreadsheet that hasn't been touched in years — that's your problem.
What Microsoft 365 actually gives you
Microsoft 365 does include some data protection features, and it's worth understanding what they do and don't cover.
Recycle bins and version history
Deleted items in Exchange, SharePoint and OneDrive typically sit in a recycle bin for a limited period (commonly around 93 days, though Microsoft can and does adjust these defaults, so it's worth checking current guidance on learn.microsoft.com rather than relying on a fixed number). SharePoint and OneDrive also keep file version history. These are useful safety nets for quick "I deleted the wrong file yesterday" situations, but they are not backup — they have fixed retention windows, they can be emptied or exceeded, and they don't protect against every kind of data loss.
Retention policies
Retention policies (configured in Microsoft Purview) let you say "keep everything in this mailbox or site for X years" or "delete anything older than Y." They're a compliance and information-governance tool, not a backup tool. Retention preserves data for a set period, in place, largely for legal and regulatory reasons — it isn't designed to let you restore your entire tenant to a point in time last Tuesday.
Litigation hold
Litigation hold (and the related "preservation hold") is narrower still. It's designed to preserve mailbox content that might be relevant to litigation or an investigation, and it stops that content being permanently deleted even if a user or admin tries to remove it. It's a legal safeguard, not a disaster recovery mechanism, and it's usually applied to specific mailboxes for a specific reason rather than as blanket protection for the business.
Microsoft 365 Backup (separate paid service)
Microsoft 365 Backup is a separate, pay-as-you-go product that you switch on and pay for on top of your normal licences. It can protect selected or all Exchange mailboxes, SharePoint sites and OneDrive accounts, and lets you restore them to an earlier point in time. Because it runs inside Microsoft's own platform it's quick to restore from, but it isn't included by default and it doesn't cover every Microsoft 365 workload. Check Microsoft Learn for what it currently covers and how it's billed.
Third-party backup
Independent backup products copy your Microsoft 365 data to storage outside Microsoft's platform. They vary in what they cover, how long they keep data and how restores work, and some businesses prefer keeping a copy entirely separate from their live tenant.
Why the difference matters
| Feature | Purpose | Protects against accidental deletion? | Protects against ransomware/corruption? | Point-in-time restore? |
|---|---|---|---|---|
| Recycle bin / version history | Short-term undo | Partially, within time limits | Limited | No |
| Retention policy | Compliance / governance | No | No | No |
| Litigation hold | Legal preservation | No | No | No |
| Microsoft 365 Backup (paid add-on) | Data protection | Yes | Yes | Yes |
| Third-party backup | Data protection | Yes | Yes | Yes |
If a member of staff falls for a phishing email and a piece of malware starts working through a OneDrive-synced folder, retention and litigation hold won't help you recover clean copies of everything that was affected. A proper backup, taken regularly and stored independently of the live Microsoft 365 environment, will.
A worked example
Imagine a 20-person accountancy firm using SharePoint for client files. A well-meaning member of staff "tidies up" a document library and permanently deletes a folder, then empties it from the recycle bin without realising what was in it. Three months later, someone asks for a document from that folder. Without a backup that goes back further than the SharePoint recycle bin window, that data may simply be gone — and the firm may only find out at the worst possible moment, in front of a client.
What we recommend
Which approach is right depends on your business requirements: how much data you could afford to lose, how quickly you'd need it back, how long you must keep it, and what your insurers or clients expect. Not every business needs a third-party product. Microsoft 365 Backup can be the right answer for some; others prefer an independent copy. Whichever you choose, a dedicated backup should:
- Take regular copies of the Exchange, SharePoint and OneDrive data you need to protect (and Teams, where your chosen product covers it).
- Be protected from the same mistakes or attacks that could affect your live data.
- Allow restoration of individual files, whole mailboxes or sites, or a point-in-time snapshot.
- Retain data for a period that matches your business, legal and insurance needs — not just Microsoft's defaults.
Common mistakes
- Assuming "it's in the cloud" means "it's backed up."
- Confusing litigation hold with backup because both involve "keeping" data.
- Relying solely on the SharePoint or OneDrive recycle bin, which has a fixed window and can be bypassed.
- Not testing restores — a backup you've never tried to restore from is a hope, not a plan.