How to Back Up Microsoft 365 (and Why Native Retention Is Not a Backup)

Most small business owners assume that because their email, files, and Teams chats live “in the cloud,” Microsoft is backing them up. It is one of the most expensive assumptions in small business IT — and it is wrong. Microsoft keeps your service running and your data available, but recovering your data after you lose it is your job, not theirs.

That gap has a name, and once you understand it, the case for a real Microsoft 365 backup is obvious. Here is what Microsoft actually protects, what it does not, and how to close the hole.

The Shared Responsibility Model

Microsoft is refreshingly clear about this in its own Services Agreement, even if nobody reads it: Microsoft is responsible for the infrastructure; you are responsible for your data. This is the “shared responsibility model,” and it is standard across every major cloud provider.

What Microsoft handles for you:

Keeping the service online and globally redundant across data centers.
Protecting against hardware failure on their end.
Defending the platform itself from attack.

What Microsoft explicitly does not guarantee:

Recovering data you deleted after the retention window closes.
Restoring files a ransomware attack encrypted through your own synced accounts.
Undoing a malicious or careless bulk deletion by an employee.
Recovering the mailbox of an ex-employee whose license you removed.

Microsoft’s own documentation recommends third-party backup for exactly these scenarios. The platform is built to be available, not to be your backup.

Why “Retention” Fools People

Microsoft 365 does have features that look like a backup, which is why the myth persists. They are useful, but they are not a backup, and the differences matter when you are in a crisis.

The Recycle Bin and Retention Windows Expire

When someone deletes an email or a file, it goes to a recycle bin or “deleted items” and is recoverable — for a while. Default windows are short: typically 30 days for deleted items, 93 days for a deleted SharePoint or OneDrive item in the second-stage recycle bin. After that, it is gone. Many data losses are not discovered for months — an ex-employee’s project files, a contract nobody noticed was deleted, records you only need at tax time. By then the retention clock has run out.

Retention Policies Are Not Point-in-Time Restore

You can configure longer retention and legal holds, and you should for compliance. But retention is designed to prevent permanent deletion, not to let you roll an entire mailbox or site back to how it looked last Tuesday before ransomware hit. Stitching data back together out of retention after a real incident is slow, painful, and incomplete.

Ransomware Syncs Right Into the Cloud

This is the scenario that catches people. An employee’s laptop gets hit with ransomware. OneDrive and SharePoint are syncing that laptop. The encrypted files sync straight up to the cloud, overwriting the good copies. “It’s in the cloud” provided no protection at all — the cloud faithfully replicated the damage. OneDrive’s version history can sometimes help, but recovering thousands of files one version at a time is not a recovery plan.

What a Real 365 Backup Looks Like

A proper backup is an independent, separate copy of your data that you control and can restore from quickly. The key word is independent — stored outside the 365 tenant so that whatever harms the original cannot reach the backup.

A good backup covers all four major workloads:

Exchange Online — mailboxes, including calendars and contacts.
OneDrive for Business — every user’s files.
SharePoint Online — team sites and document libraries.
Teams — channels, chats, and the files behind them, which actually live in SharePoint and OneDrive.

And it should give you:

Point-in-time restore — recover data as it existed on a specific date, not just “the latest version.”
Granular recovery — restore a single email, file, or folder without rolling back everything.
Long or unlimited retention — keep backups for years, well past Microsoft’s default windows.
Fast, self-service restore — get data back in minutes, not by opening a support ticket and waiting.

How to Set It Up

You have two practical routes.

Option 1: A Dedicated SaaS Backup Service (Recommended)

The simplest and most reliable path for a small business is a purpose-built Microsoft 365 backup product. Several mature vendors specialize in this; well-known names include Veeam, Acronis, Datto, Dropsuite, and AvePoint, among others. The model is the same across most of them:

Sign up and connect the service to your 365 tenant, authorizing it with admin consent.
Select which workloads and users to protect — usually everyone.
Let it run automated backups on a schedule, typically several times a day.
Data is stored in the vendor’s cloud (or a destination you choose), independent of your tenant.

Pricing is generally per user per month, in the low single digits. For a 15-person business that is a small line item against the cost of permanently losing your records. If you work with a managed service provider, they very likely resell one of these and can bundle it.

Option 2: Self-Managed Backup to Your Own Storage

If you have in-house IT capability, tools and scripts can export 365 data to storage you own — a NAS or your own cloud bucket. This gives you maximum control and can lower per-seat cost, but you own the work: scheduling, monitoring, verifying restores, and securing the destination. For most small businesses the managed service is the better value once you account for staff time.

Whichever route you choose, store the backup with multi-factor authentication and separate credentials from your 365 admin account, so a compromise of one does not hand an attacker the other.

Test the Restore

A backup you have never restored from is a hope, not a plan. Once backups are running, do a test restore: recover a test mailbox or a folder of files and confirm the data comes back intact and complete. Put a reminder on the calendar to repeat it a couple of times a year. The day you actually need it — an angry ex-employee, a ransomware hit, a fat-fingered bulk delete — is the wrong day to discover the backup was misconfigured the whole time.

Bottom Line

Microsoft keeps Microsoft 365 running; keeping your data recoverable is on you. Native retention and recycle bins buy you days or weeks, not the years and the point-in-time recovery a real incident demands. For a few dollars per user per month, an independent backup closes the gap — and turns “we lost it” into “we restored it before lunch.”