What it is
An independent copy of your emails, your OneDrive and SharePoint files, your Teams teams and your contacts, kept outside your Microsoft subscription and restorable one item at a time.
Backup and disaster recovery
Microsoft 365 backup: what Microsoft protects, and what it does not
Many organizations believe their email and files are backed up because they live in the cloud. Microsoft guarantees the availability of its service, not the recovery of your data after a deletion, a mistake or an attack. This page sets the record straight and explains what a Microsoft 365 backup adds.
The question is not whether Microsoft loses your data: its infrastructure is redundant. The question is what happens when you, an employee or an attacker deletes it. A Microsoft 365 backup is an independent copy of your mailboxes, files and Teams content, kept outside your subscription and restorable one item at a time.
In brief
Microsoft 365 backup in three points
The question is not whether Microsoft loses your data: its infrastructure is redundant. The question is what happens when you, an employee or an attacker deletes it.
Who it is for
Any organization that uses Microsoft 365 for its day-to-day work, especially those with retention obligations or a contract that requires being able to retrieve an old document.
What it changes
A mailbox deleted by mistake, a folder encrypted by ransomware, or a badly handled employee departure stop being permanent losses.
Understanding
Why Microsoft does not back up your data for you
Microsoft applies a shared responsibility model: it is responsible for the availability of the service, the infrastructure and redundancy, and you are responsible for your data, your accounts and your accesses. This split is written into the terms of service and the product documentation. It is not an omission: it is a deliberate boundary.
In practice, Microsoft 365 offers short-term recovery mechanisms, not archiving. An item deleted from SharePoint or OneDrive passes through the recycle bins and only stays there for ninety-three days in total, according to the Microsoft documentation consulted in 2026 on learn.microsoft.com. After that, the item is permanently deleted. Retention policies can extend that period, but they must be configured, and they do not behave like a backup you restore to a chosen date.
The real risk for a small business is therefore not a Microsoft outage. It is the accidental deletion discovered months later, the compromised account whose attacker empties the mailbox, the employee departure where the account is deleted too quickly, and the ransomware that encrypts synced files before they reach the cloud.
The distinction
What Microsoft covers and what a backup adds
The two do not compete: the backup fills the gaps the built-in mechanisms were not designed for. Here is the split, case by case.
| The situation | What Microsoft does | What a backup adds |
|---|---|---|
| Infrastructure outage | Microsoft replicates its services and is responsible for their availability. A hardware failure at Microsoft will not lose your data. | Nothing more on this specific point. It is the only case where the built-in mechanism is enough. |
| Recent deletion | The recycle bins let you recover a deleted item for a limited time, ninety-three days in total for SharePoint and OneDrive according to Microsoft’s 2026 documentation. | A restore well beyond that window, and without depending on someone noticing in time. |
| Deletion discovered late | Nothing, once the retention period has passed. The item is permanently deleted. | The copy exists independently of the subscription, so the item can be recovered long after the fact. |
| Compromised account | Microsoft logs actions and lets you block the account, but an attacker who empties a mailbox with permanent deletion leaves little to work with. | The mailbox contents can be restored to a date before the compromise. |
| Ransomware on synced files | Version history lets you roll back individual files, which helps in simple cases. | A bulk restore to a point in time, without bringing files back one by one, and a copy the compromised account cannot reach. |
| Employee departure | Deleting the account eventually deletes its contents, unless explicit retention is configured. | The content stays available even if the account was deleted too quickly, without paying a licence just to keep a mailbox open. |
What is covered
What we back up in a Microsoft 365 environment
A useful backup covers everything the work actually lives in, not just email. Here is the usual scope of a mandate.
- Mailboxes, including folders, calendar and contacts
- Shared mailboxes, often forgotten because no one owns them
- Each user’s OneDrive files
- SharePoint document libraries and team sites
- Teams files and conversations, within what Microsoft allows
- Item-level restore, to bring back a single email or a single file without restoring everything
- A periodic check that the restore actually works, not only that the job finished without error
The scope is drawn from the tenant itself, not from memory: the list of mailboxes, SharePoint sites and accounts comes out of the Microsoft 365 admin centre, then gets compared with what the backup covers. An account left active after a departure, or a shared mailbox created for a project, shows up there even though nobody would have thought to name it.
How it unfolds
How the backup is set up and verified
Setup is quick. What tells a good backup from a bad one is what happens after: the verification.
- Decide what must be kept, and for how longYour contractual, regulatory and internal obligations determine the retention period. This is a business decision, not a technical setting: we make it with you before configuring anything.
- Connect the subscription and cover the whole scopeThe backup is connected to your Microsoft 365 subscription and configured to include mailboxes, shared mailboxes, OneDrive, SharePoint and Teams. New accounts created later are picked up automatically, with no manual step.
- Watch the failures, not only the successesA failed job is flagged and treated as an incident. A backup no one reads the reports of is a backup you discover missing the day you need it.
- Test the restoreA restore is actually performed at regular intervals, on a chosen item, to confirm the copy is usable. The Standard package includes a verified backup with a test twice a year.
This backup completes our Microsoft 365 services, alongside Copilot governance, and is part of our backup and disaster recovery offer. Delivered across Quebec from Trois-Rivières, in the Mauricie, in Montreal and around Quebec City. Further reading: why Microsoft does not protect your data, SharePoint for small businesses and the IT disaster recovery plan.
Questions and answers
Frequently asked questions about Microsoft 365 backup
Does Microsoft 365 back up my email?
No, not in the backup sense of the word. Microsoft ensures the availability and redundancy of the service, and offers short-term recovery mechanisms such as the recycle bins and version history. These mechanisms do not restore a complete state to a chosen date several months later. The split of responsibilities between Microsoft and the customer is described in the terms of service and the product documentation.
How long is a deleted file recoverable?
For SharePoint and OneDrive, the Microsoft documentation consulted in 2026 indicates ninety-three days in total for both recycle-bin levels, from the moment of deletion. After that, the item is permanently deleted. Retention policies can change this behaviour, but they must be configured on purpose. The reference is published on learn.microsoft.com.
Does a retention policy replace a backup?
No. A retention policy prevents deletion for a given period, which is useful for compliance. It does not offer what a backup offers: an independent copy outside the subscription, a restore to a point in time, and a bulk recovery after an incident. The two answer different needs and complement each other.
Where are the backup copies kept?
Copies are kept in Canada. This is the default choice for all our clients, unless a documented request states otherwise. The location of the copies matters for Law 25 and for several client contracts: it is decided and written down before setup. We use Veeam Backup for Microsoft 365 when standards apply, or an alternative solution documented for the client’s setup.
What happens if an employee leaves the organization?
Their mailbox and files stay in the backup for the retention period chosen, even if the Microsoft 365 account is deleted and the licence released. This is what lets you recover a document months later without paying a licence only to keep a mailbox open. See our page on onboarding and offboarding an employee.
How long does a restore take?
Retrieving a specific email or file is quick, because the restore is item by item. Restoring a full mailbox or an entire library takes longer, depending on volume. What matters most is having rehearsed the operation before you need it.
Do we also need to back up the workstations?
If the work lives in OneDrive and SharePoint, workstations mostly hold configurations and software, and a clean reinstall is often faster than a restore. What matters is making sure no working folder lives only on a local desktop. This is one of the points our cybersecurity audit covers, and one of the reasons a ransomware attack causes so much damage.
Check what is really backed up at your organization
We look at what is covered, what is not, the retention period and the last tested restore. You receive a clear picture, and if there is a gap, what it takes to close it.