In short: Microsoft 365 backup is an independent, point-in-time copy of your Exchange Online, OneDrive, SharePoint and Teams data that you can restore whenever you need to. Recycle bins and retention policies are time-limited and not designed as backup, so most organisations add Microsoft's own Backup service or a third-party product.
Shared responsibility: what Microsoft does and does not do
Microsoft runs a resilient service, with replicated copies of data across its data centres so that hardware failures do not lose your mail or files. What it does not do is protect you from changes made through your own tenant. If a user deletes a folder, a sync client overwrites files with encrypted copies, an attacker with a compromised admin account purges mailboxes, or a retention policy is set up wrongly, Microsoft's service faithfully carries out the change.
That is the shared responsibility model: Microsoft is responsible for the platform, and you are responsible for your data, accounts and configuration. Our Microsoft 365 security guide covers the configuration side; this page covers getting data back.
Retention and the recycle bin are not backup
Microsoft 365 has useful recovery features, but each has limits that matter in a real incident:
| Feature | What it does | Why it is not a backup |
|---|---|---|
| SharePoint and OneDrive recycle bins | Keep deleted items for up to 93 days | Time-limited, and an attacker or admin can empty them |
| Exchange Online recoverable items | Keep deleted mail for 14 days by default, extendable to 30 | Short window; leavers' mailboxes are removed when licences go |
| OneDrive Restore and file versions | Roll a OneDrive back to an earlier point within 30 days | Only covers recent changes, one account at a time |
| Microsoft Purview retention policies and litigation hold | Preserve content for compliance and eDiscovery | Built to preserve evidence, not for fast bulk restores; a policy change can remove protection |
Retention is still worth configuring, especially for regulated email, and our Microsoft Purview page explains how. But a backup is a separate, protected copy with its own history, held where a compromised tenant cannot reach it, that you can restore at the level you need: one email, one site or the whole organisation.
Microsoft 365 Backup: Microsoft's own service
Microsoft now sells its own Microsoft 365 Backup service, managed from the Microsoft 365 admin center. According to Microsoft Learn it:
- Backs up all or selected SharePoint sites, OneDrive accounts and Exchange Online mailboxes
- Keeps restore points for a recovery window you choose in each backup policy: 3 months, 6 months, 1 year or 2 years
- Restores whole OneDrive accounts and SharePoint sites to an earlier point in time, and Exchange mail, contacts, calendar and task items individually
- Stores backups in append-only storage inside the Microsoft 365 boundary, so existing restore points cannot be modified, and respects your tenant's data residency
- Is billed pay-as-you-go on the amount of data protected, through an Azure subscription, rather than per user
Its main strength is restore speed at scale, because the backup sits next to the live data. Its main trade-off is that it sits inside Microsoft's cloud and your tenant: it is not a separate platform in the 3-2-1 sense, it does not cover Teams chats, Entra ID or Google Workspace, and backups are not fully immutable: a Backup admin can delete them by offboarding the tool, although Microsoft keeps a fixed 90-day grace period in which they can still be recovered. Microsoft also lets independent vendors build applications on the same Microsoft 365 Backup Storage platform, managed and billed through the vendor's own product.
Third-party Microsoft 365 backup compared
Third-party products keep the backup copy in their own cloud, outside your tenant, and usually add wider coverage and simpler per-user licensing.
| NinjaOne SaaS Backup | Acronis | Axcient x360Cloud | Microsoft 365 Backup | |
|---|---|---|---|---|
| Where the copy lives | Vendor cloud, outside your tenant | Acronis Cloud, service-provider or supported public cloud storage | Axcient cloud | Inside Microsoft 365 |
| Exchange, OneDrive, SharePoint | Yes | Yes | Yes | Yes |
| Teams | Yes, including channel messages | Ask us to confirm current scope | Yes | No (Teams files sit in SharePoint and OneDrive) |
| Google Workspace | Yes | Yes | Yes | No |
| Entra ID backup | With the + Entra editions | Yes | Not listed by the vendor | No (see Entra ID below) |
| Licensing | Per user, unlimited storage | Per workload or per gigabyte | Flat fee with pooled storage | Pay-as-you-go on data protected |
| Best fit | Simple SaaS backup and compliance archiving | Backup and security for devices and Microsoft 365 together | Organisations already using x360Recover for servers | Large tenants that prioritise in-place restore speed |
Of the three third-party options, NinjaOne SaaS Backup is the one with a journaling email archive, in its + Archiver editions.
See our pages on NinjaOne SaaS Backup, Acronis and Axcient x360 for detail. Other platforms we supply include Keepit, which keeps immutable copies of Microsoft 365, Entra ID and many other SaaS apps in its own independent cloud; Redstor, which scans backups for malware; Commvault Cloud for larger hybrid estates; and Hornetsecurity 365 Total Backup, often bought alongside Hornetsecurity email security.
Do not forget Entra ID
Microsoft Entra ID (formerly Azure Active Directory) holds your users, groups, app registrations and Conditional Access policies. After an incident, knowing what an attacker changed and putting it back can matter as much as the data. Microsoft provides two native safety nets:
- Soft delete: deleted users, Microsoft 365 groups, cloud security groups, app registrations, service principals, Conditional Access policies and a few other objects can be restored for 30 days. Every other object type is deleted permanently and has to be re-created by hand
- Microsoft Entra Backup and Recovery: for tenants with Entra ID P1 or P2, Microsoft backs up supported objects once a day and keeps seven days of history, so you can compare changes and roll objects back. It cannot recover objects that have been permanently deleted
Seven days is short if an attacker goes unnoticed for weeks, and that history stays inside your own tenant. Third-party Entra ID backup keeps a longer, independent history: NinjaOne SaaS Backup + Entra keeps 12 months, for example, and Keepit also protects Entra ID. Pair it with good identity practice: phishing-resistant MFA, few standing admins and regular reviews of Conditional Access, covered in our Microsoft Entra ID P1 and P2 guide.
How to choose, and how we help
Most small and mid-sized organisations are well served by a per-user third-party backup with storage outside Microsoft's cloud. Add Entra ID backup if your directory is complex, archiving if you must keep email for a set period, and look at Microsoft 365 Backup if your tenant is very large and in-place restore speed is the priority. Whichever you choose, protect the backup console with its own MFA and limit who can delete backups or change retention.
We check your current retention, recycle bin and backup settings as part of a Microsoft 365 security assessment, recommend an option, connect it to your tenant, agree retention with you and run a test restore before we hand over. Pricing depends on users and the edition you choose, so ask us for a quote.
Contact us to protect your Microsoft 365 data.
How Forever Systems helps with cloud security
We are an independent UK IT and cyber security provider. We supply and support a wide range of security platforms, so we recommend what fits your organisation rather than one vendor's answer to everything.
- Assess first: we review what you already own, especially your Microsoft 365 licences, before suggesting anything new
- Vendor-aware advice across secure access, email, identity, data protection, endpoint, MDR, cloud infrastructure, browser, AI and backup, including Cisco Secure, Check Point Harmony and Sophos
- Deployment and migration from a UK team, from tenant hardening to replacing a VPN or an endpoint product
- Ongoing support: policy tuning, alert handling, renewals and regular reviews
- People and certification too: security awareness training and Cyber Essentials
We work with businesses, schools, charities and public sector organisations.
Want an independent view of your cloud security?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Does Microsoft back up Microsoft 365 data?
Microsoft replicates data to keep the service available, and offers recycle bins and retention policies, but these are not an independent backup you control. Microsoft also sells a separate Microsoft 365 Backup service, billed on usage. Without one of these or a third-party product, deleted or encrypted data may be unrecoverable once retention windows pass.
How long does Microsoft 365 keep deleted files and emails?
SharePoint and OneDrive recycle bins keep deleted items for up to 93 days. Exchange Online keeps deleted mail in recoverable items for 14 days by default, which admins can extend to 30. After that, data is gone unless a retention policy, hold or backup preserved it.
Is Microsoft 365 Backup enough on its own?
It gives fast, append-only restore points for Exchange, OneDrive and SharePoint inside Microsoft 365. Because the copy stays within Microsoft's cloud and your tenant's admin model, and does not cover Teams chats, Entra ID or Google Workspace, many organisations still prefer an independent third-party copy, or use both.
Do I need to back up Microsoft Teams?
Yes. Teams files live in SharePoint and OneDrive, so backing those up covers them, but channel messages and team structure need a product that supports Teams specifically. Check what each product restores before you buy.
What happens to a leaver's mailbox if I remove their licence?
Microsoft deletes the mailbox after a short grace period once the licence is removed, unless it is on hold or converted to an inactive mailbox. A third-party backup that keeps leavers' data after the seat is removed avoids paying for licences only to preserve old mail.