Your Microsoft 365 Isn't Being Backed Up — And Microsoft's Own Terms Confirm It

Most organizations that migrate to Microsoft 365 operate under the assumption that their data is protected. After all, they're paying Microsoft, and Microsoft is running the infrastructure. The assumption is understandable. It is also wrong — and Microsoft themselves make this explicit in their service documentation.

The Microsoft Services Agreement, which governs M365 usage, includes the following guidance:

"We recommend that you regularly backup your content and data that you store on the services or store using third-party apps and services."

This is Microsoft — the vendor — recommending you back up your Microsoft data. The reason is the shared responsibility model: Microsoft protects the infrastructure and guarantees service availability, but the responsibility for data protection rests with you.

What M365 actually retains — and for how long

M365 does retain data, but not in a way that functions as a backup. Understanding the distinction matters:

• Deleted emails move to Deleted Items (user-accessible), then to Recoverable Items (14 days by default, up to 30 with admin configuration). After that, they are permanently deleted.
• OneDrive files go to the OneDrive Recycle Bin for 93 days. After that, they are gone.
• SharePoint has a two-stage recycle bin totaling up to 93 days across both stages.
• Teams messages are governed by your retention policies. With no explicit policy, deleted messages can become unrecoverable immediately.

None of these are point-in-time backups. They are geo-redundant recycle bins — useful for accidental deletion caught quickly, useless for anything else.

Where the shared responsibility model breaks down in practice

The shared responsibility model is well-understood for infrastructure (AWS, Azure IaaS). It is far less understood for SaaS, where the platform manages everything and the data ownership question becomes invisible.

Microsoft's 2024 documentation on data retention in Microsoft 365 describes their data handling practices in detail — and the picture is consistent: Microsoft retains data for its own operational purposes, with retention windows measured in days to weeks, not the months or years that most businesses actually need for compliance, legal hold, or recovery purposes.

The scenarios where this gap becomes critical:

• Ransomware with OneDrive sync. If ransomware encrypts files on a synced device, those encrypted versions sync to OneDrive — potentially overwriting every version across every device. Recovering may require restoring from a third-party backup taken before the infection.
• Departing employees who clean their mailbox. If an employee permanently deletes mail before leaving, and more than 30 days pass before anyone notices, that data is gone from M365 entirely.
• Legal discovery requests covering historical data. If a lawsuit requires email records from 18 months ago, a recycle bin with a 30-day retention window is not a solution.
• Admin error at the tenant level. A SharePoint site collection deleted by an admin can be restored — but only within the recycle bin window. After that, Microsoft support cannot recover it.

The Veeam data point that changes the conversation

The Veeam 2024 Data Protection Trends Report surveyed 1,200 IT and business leaders globally. Among the findings: 45% of organizations reported losing data from SaaS applications in the prior year. Of those, the most common cause was not infrastructure failure — it was accidental deletion, followed by security incidents.

Microsoft's infrastructure did not fail. The data was lost because users or administrators took actions that exceeded what M365's native retention could recover from.

What proper M365 backup actually requires

A third-party backup solution covering M365 should do all of the following:

1. Cover all services — Exchange Online, OneDrive for Business, SharePoint Online, and Teams (chats, files, channels). Many solutions cover email but not Teams, which has become a primary communication and file repository for most organizations.
2. Store copies outside the tenant — in a separate cloud region or provider. A tenant-level compromise (such as a ransomware attack using a compromised admin account) cannot then also reach the backup.
3. Provide granular, point-in-time restore — the ability to recover a single email from six months ago, or a SharePoint document library as it existed on a specific date, not just "restore everything."
4. Retain data as long as your compliance requirements demand — for many regulated industries, this means seven years or more, far beyond any native M365 retention window.
5. Be tested. A backup that has never been successfully restored is not a backup — it is a hope. Recovery tests should be documented and run at regular intervals.

The cost comparison

Third-party M365 backup solutions typically run $3–6 per user per month. For a 100-person organization, that is $3,600–$7,200 per year.

IBM's 2024 Cost of a Data Breach Report puts the average total cost of a data breach at $4.88 million globally — and that figure accounts for businesses of all sizes. For SMBs, the Ponemon Institute has separately estimated average breach costs at $120,000–$180,000 when accounting for productivity loss, recovery effort, regulatory exposure, and client impact.

The math is clear. The gap is a policy decision, not a technology gap.