Does Microsoft 365 back up your data? Read the contract.
An ex-employee's emails needed for a lawsuit, an account deleted eight months ago — and the discovery that "it's in the cloud" never meant "it's backed up." Here's what Microsoft 365 actually keeps by default, what its Services Agreement says in black and white, and how to close the gap before you need it.
On a Tuesday morning, the call comes from the accountant: a dispute with a former supplier is heading to lawyers, and counsel needs a project manager's emails to document the file. Small detail: the employee left the company eight months ago. His account was deleted two weeks after his departure — licence cleanup, a perfectly normal reflex. The answer from tech support lands like a brick: the mailbox no longer exists, neither does the OneDrive, and there's nothing left to restore.
"But... it's in the cloud, isn't it?"
That's exactly where the misunderstanding blows up. Yes, it was in the cloud. No, it wasn't backed up. Because Microsoft 365 guarantees one thing — that the service runs — and not the thing everyone assumes: that your data will be recoverable when you need it.
What Microsoft actually guarantees (it's in the contract)
The model is called "shared responsibility," and it's simpler than it sounds. Microsoft handles its half: the data centres, the infrastructure, service availability, platform security. Your half: the data itself — its access, its retention, its recovery and its compliance.
You don't have to take my word for it: it's in the Microsoft Services Agreement, section 6b. Microsoft writes that all online services suffer occasional disruptions, that it isn't liable for resulting losses — and it recommends, itself, that you regularly back up your content "using Third-Party Apps and Services." When a vendor recommends in writing that you back up elsewhere the data you store with them, the debate is pretty much settled.
What most SMBs mistake for a backup is actually a collection of recycle bins and grace periods. Useful — but short, and above all, not designed for you.
The default windows that surprise everyone
Here's what Microsoft 365 actually keeps, with no special configuration, according to Microsoft's own documentation:
A permanently deleted email goes through the Recoverable Items folder: 14 days by default, extendable to a maximum of 30. A deleted user account — our ex-employee's scenario — stays restorable for 30 days, after which the mailbox is gone. His OneDrive is kept 30 days by default as well (a SharePoint administrator can still fish it out during an additional window — if they know they need to). And a file deleted from SharePoint or OneDrive survives 93 daysacross the first- and second-stage recycle bins. After that, it's over: even Microsoft support can't help.
These windows can be extended with retention policies — but that requires deliberate configuration, the right licences, and someone who thought about it before the incident. By default, nobody has.
Notice the common thread: all these counters are measured in days and weeks. Real recovery needs, on the other hand, are measured in months and years — the lawsuit reaching back to last fall, the tax audit, the client request, the employee departure whose blind spots surface much later . The problem is almost never yesterday's deletion. It's the one from eight months ago.
What the recycle bin will never cover
Even inside the retention windows, several scenarios slip right through.
Ransomware that encrypts files synced to OneDrive and SharePoint: the encrypted version overwrites the good one, and the built-in restore rolls back 30 days at most — fingers crossed the attack was caught in time. An employee who leaves on bad terms and cleans house on the way out: empty the recycle bins, and the window shrinks dramatically. A compromised account whose attacker methodically deletes their traces. Or simply human error discovered too late — the folder overwritten in March that someone goes looking for in June.
In every one of those cases, the "we'll check the recycle bin" reflex gives the same answer as it did for our project manager: too late.
"But Microsoft now sells its own backup"
True — and it may be the most eloquent admission in the whole file. Since 2024, Microsoft has sold Microsoft 365 Backup, a paid product, on top of your licences. If backup were included in Microsoft 365, Microsoft would have nothing to sell you.
The tool has its merits (fast restores, native integration), but also a structural limit: the copies stay inside the Microsoft cloud. Your production data and its backups live with the same vendor, in the same ecosystem, reachable through the same tenant. That's precisely what the first rule of any backup strategy exists to avoid: keeping all your eggs in one basket — even an excellent basket.
And then there's compliance. Your retention obligations — tax, contractual, or the retention schedule Law 25 asks you to establish — don't vanish because the data lives in the cloud. Keeping a file for seven years means being able to produce it in seven years. A 93-day recycle bin will never sign that contract.
The four checks to run this week
1. Know what your tenant actually keeps. Not what you think, not what the salesperson said in 2021: what's configured today. Retention policies, OneDrive windows for deleted accounts, licences in place. It's a one-hour audit.
2. Define your needs by data type. Executive email, client files, financial documents and the coffee-machine Teams channel don't have the same value or the same lifespan. Your Law 25 retention schedule kills two birds with one stone here.
3. Add an independent backup, outside the Microsoft cloud. Automated, encrypted, with retention aligned to your real needs — and above all tested: a backup that's never been restored is a hypothesis, not a protection.
4. Build backup into the departure process. Before deleting an account, you capture: mailbox, OneDrive, shared access. Licence removal comes after preservation, never before.
Which leaves the Tuesday-morning question: if you were asked tomorrow to produce the emails of an employee who left last fall, would you have them — or would you discover the recycle bin has been empty for months?
At MMO Techno, independent, encrypted and tested Microsoft 365 backup is part of our managed services — including systematic capture before every employee departure and retention aligned with your obligations. If you're not sure what your tenant is keeping right now, that's exactly the conversation to have this week .