Here’s the short version: Microsoft 365 backup is a separate, restorable copy of mail, OneDrive, and SharePoint. The recycle bin is not that. Microsoft keeps the cloud up. You are still responsible for the data.
This surprises people who just bought Business Premium. They heard “Microsoft backs it up.” What they heard was uptime. What they need is undo.
We already covered general backup and disaster recovery and the cost of IT downtime. This page is only the Microsoft 365 question: do you need a product, or is retention enough?
Recycle bin is an undo button, not a backup
Deleted items and files sit in a recycle bin or recoverable-items folder for a limited time. That saves you from “I deleted the wrong folder this morning.” It does not save you from:
- A user who emptied the bin last month
- Ransomware that encrypted everything OneDrive synced
- An admin who deleted a SharePoint site
- A tenant-level incident where the same credentials can change retention
If your restore plan is “Microsoft still has it,” ask someone to show you the setting and the last successful restore. If they cannot, you do not have a plan.
Shared responsibility, said plainly
Microsoft runs the service. You own the content and most of the configuration. That split is why a healthy Microsoft 365 tenant can still lose a matter file.
Microsoft now sells a first-party product, documented in Microsoft 365 Backup. That exists because customers asked for faster, larger restores than recycle bins and eDiscovery exports. The product is optional. The problem is not.
Retention and legal hold are a different tool. Microsoft explains them in Learn about retention policies. Hold is for investigations. Backup is for “put the library back.” Confusing the two is how firms find out during a bad week.
What Microsoft already keeps (and what it does not)
In a typical tenant you already have:
- Deleted-item recovery for mail, for a default window
- Recycle bins for OneDrive and SharePoint, with a second-stage bin
- Optional retention labels and policies
- Optional litigation hold / eDiscovery
You do not automatically have:
- A point-in-time restore of a whole site from 90 days ago
- A copy an attacker cannot reach with a stolen Global Admin
- A restore drill anyone has run this year
CISA’s ransomware guide still comes back to backups you can restore, including copies the attacker cannot encrypt. OneDrive sync is a common way ransomware leaves the laptop and lands in the cloud. The recycle bin will not look friendly after that.
OneDrive sync is the quiet risk
A partner laptop gets malware. Files sync. SharePoint versions may help. They may not, depending on how the attack wrote the files and how versions were configured. A separate backup is how you stop arguing with version history at 11 p.m.
First-party Microsoft 365 Backup versus a specialist tool
Microsoft 365 Backup is built into the admin experience and is aimed at fast restore of Exchange, OneDrive, and SharePoint. Read Microsoft’s overview before you buy a third name just because the last MSP sold it.
Specialist tools (several vendors do this well) often add longer retention options, extra isolation, or restores that your staff already know from file-server work. None of that matters if nobody has restored a mailbox this year.
Pick with three questions:
- What will we restore, and how fast?
- Who can delete the backup copies?
- When was the last restore test, and who watched it?
If the answer to 3 is “never,” the brand on the box is decoration. NIST’s SP 800-34 is old and still right: contingency planning includes knowing what you must get back, and in what order.
What to include
Minimum for a professional office:
| Workload | Why |
|---|---|
| Exchange mailboxes | Mail is still the system of record for a lot of firms |
| Shared mailboxes | Billing, info@, and intake die quietly |
| OneDrive | Matter drafts live here more than anyone admits |
| SharePoint sites | Intranet, client sites, the “official” folders |
| Teams files | Those files are SharePoint. Back up the sites |
Teams files versus Teams chats
Teams files live in SharePoint. If you back up the site, you back up the files. Teams chats are a different store. Many backup products added chat later, or still treat it as extra. Decide in writing. Most firms can survive lost chat. They cannot survive a wrecked client document library.
Shared mailboxes
Info@, billing, and intake are where money and clients actually sit. Restore tests that only use the owner’s mailbox miss the box everyone shares. Include shared mailboxes in the product and in the drill.
Chats, Planner, and Loop are a second conversation. Do not skip mail and files while you debate chat retention.
Size the copy with the backup retention calculator if you also run a file server. Microsoft 365 is usually licensed per seat, not per terabyte, so do not use that tool as a Microsoft 365 quote.
How long to keep Microsoft 365 backups
Ask counsel and your insurer, then write a number.
- Operational restore: 30 to 90 days covers “I wrecked a library.”
- Ransomware: you want copies old enough that they predate the quiet week before encryption.
- Legal / tax: some mail and files have multi-year rules. That may be archive plus backup, not backup alone.
Keeping everything forever feels safe and is usually wrong. It also gets expensive. Split the policy: long on finance and matters, shorter on the junk site nobody uses.
Immutability, or a copy a single admin cannot wipe, is how you keep the second copy when the admin account is the incident. Microsoft 365 Backup and several vendors offer lock options. Use one.
How to run a restore test that counts
Pick one shared mailbox and one SharePoint library that is not the entire intranet. Restore to a test location, not on top of production. Time it. Write down who had to approve it and which admin role they used.
If the product cannot restore without the same Global Admin who would be compromised in a real incident, you have a design problem. Split the role. Microsoft documents the product in the Microsoft 365 Backup overview and related restore articles on Learn. Use those, or your vendor’s equivalent, as the script. Do not improvise during ransomware week.
A restore that takes six hours is still a plan. A restore nobody has tried is a rumor. Put the next drill on a calendar invite with a name on it.
Exchange also has a Recoverable Items folder. Know what it covers so you do not confuse dumpster diving with a backup product.
CISA Cross-Sector Cybersecurity Performance Goals put tested backups next to identity. A green job list is not a test.
A decision you can make this month
If you have no product and no restore test, you are hoping. Hope is not an RPO. Write the RPO in a sentence a partner can read: “We can put last night’s mail and SharePoint back by lunch.” If you cannot say that out loud today, you are not done.
If you have retention only, you have a compliance tool. Add backup if a bad delete or ransomware would stop the firm.
If you already pay for a Microsoft 365 backup product, run a restore this quarter. Restore one shared mailbox and one SharePoint library to a test place. Write down how long it took. That number is the one that matters in an incident, not the brochure. We wrote that drill up as a backup restore test before tax season.
Ransomware protection without a restorable Microsoft 365 copy is a plan with a hole. Price that hole with the ransomware cost calculator if you need a number for the partners. Microsoft 365 for business without backup is the same hole with better branding. Pair it with a written business continuity note so someone owns the restore, not “IT in general.”
Backup and disaster recovery is the service when you want the jobs watched and the drill on the calendar.
If you want the copy configured and tested, contact Secure Techies. We treat Microsoft 365 as production data, not as “the cloud has it.”
Frequently Asked Questions
