Does Microsoft 365 back up your data? What small businesses get wrong

Not in the way most businesses assume. Microsoft 365 keeps the service available and replicates data against its own hardware failures, but under the shared responsibility model, protecting your data from deletion, ransomware, and departed users is your responsibility. Recycle bins and retention policies have time limits and are not true backups.

If you've ever asked, "Does Microsoft 365 back up my data?" you're already ahead of most business owners. Most never ask. They assume.

"We're in the cloud, so it's backed up" is one of the most expensive assumptions a small business can make. It usually falls apart in one of three ways.

• A deleted SharePoint folder nobody notices is missing until four months later.
• A OneDrive full of files encrypted by ransomware, with the encrypted versions synced right up to the cloud.
• A departed employee's mailbox that disappeared when someone removed the license.

In each case, Microsoft did exactly what it promised. The data still wasn't recoverable.

What is the Microsoft 365 shared responsibility model?

The shared responsibility model splits the job between Microsoft and you. Microsoft is responsible for the infrastructure, uptime, and physical security of the service. You are responsible for your data, your user identities, who has access, and recovering from user error or attack. Microsoft's consumer Services Agreement recommends that you regularly back up your content.

MFA, or multi-factor authentication, is the second sign-in step (like a code on your phone) that stops most password theft. It sits squarely on your side of the table.

Microsoft's uptime promise, its SLA (service level agreement), is about whether the service is available. It says nothing about whether last Tuesday's version of your file can be brought back.

That's the core distinction. Availability is not recoverability.

Microsoft does replicate your data. It copies it across multiple servers and data centers, called geo-redundancy, so one failed drive or building doesn't take you down.

But replication copies everything, including your mistakes. Delete a folder, and the deletion replicates. Ransomware encrypts a file, and the encrypted version replicates.

A backup is different. It's a separate, point-in-time copy you can roll back to after something goes wrong.

This is also where expectations with an MSP (managed service provider) need to be clear. "We manage your Microsoft 365" can sound like "your data is protected," so confirm in writing whether backup is included or an add-on.

How long does Microsoft 365 keep deleted data?

Not long. By default, Exchange Online keeps permanently deleted email items for 14 days, configurable up to 30. SharePoint and OneDrive keep deleted files in a two-stage recycle bin for 93 days. After those windows close, the data is permanently gone unless a retention policy or a separate backup is in place.

Sources are Microsoft Learn on Exchange Online deleted item retention, SharePoint data deletion, and OneDrive retention and deletion.

The clock starts when something is deleted, not when someone notices it's gone. That's why "we found it missing after four months" is such a common story.

Someone cleans up a SharePoint library in March. Nobody opens that folder again until a client asks for a contract in July, roughly 120 days later and well past the 93-day window.

The recycle bin isn't a vault, either. If someone empties the second-stage recycle bin, those items are purged immediately.

Google Workspace runs on similar limits. Files in Drive trash are deleted after 30 days, and once the trash is emptied, an admin has 25 days to restore the data before Google purges it. Google Vault can keep data longer, but only if retention rules were set up ahead of time.

Are Microsoft 365 retention policies the same as backups?

No. A retention policy or litigation hold keeps data for compliance and eDiscovery (electronic discovery, the process of finding data for legal cases). Neither is designed for fast, point-in-time restores of whole sites, mailboxes, or folders. They also live in the same tenant as your data, so a compromised admin account can affect both.

In Microsoft 365, these compliance tools live in Microsoft Purview. In Google Workspace, the equivalent is Google Vault.

Both are good at what they were built for, preserving data so it can be found later for a lawsuit, audit, or investigation. Neither was built to put a deleted SharePoint site back exactly the way it looked last Tuesday at 5 p.m. That's a point-in-time restore, and it's a backup's job.

Here's the plain version. Retention is a legal tool. Backup is a recovery tool. You need to know which one you're relying on.

What are the biggest data loss risks in Microsoft 365 and Google Workspace?

The biggest risks are accidental deletion, ransomware that encrypts synced OneDrive or Google Drive files, malicious insiders or departed employees, compromised admin accounts, sync errors, and data removed when licenses are taken away. Notice the pattern. Most data loss is caused by people, not by Microsoft or Google.

1. Accidental deletion. An office manager tidies up a shared folder and deletes the wrong subfolder. Nobody notices until someone needs a file from it months later.
2. Ransomware. One employee opens a malicious attachment. The files on their laptop get encrypted, and OneDrive dutifully syncs the encrypted versions to the cloud.
3. Malicious insiders and departed employees. Someone leaving on bad terms deletes client files or a year of email on the way out the door.
4. Compromised admin accounts. An attacker phishes an administrator's password and gets the keys to the whole tenant, including the ability to delete data and tamper with retention settings.
5. Sync errors. A sync conflict or misconfigured sync client overwrites good files with old or empty versions, and the bad copies spread to every device.
6. License removal. Someone removes a departed user's license to save money, starting the countdown on that person's mailbox and OneDrive.

Ransomware deserves a closer look, because this is where "it's in the cloud" hurts the most.

Sync is a convenience feature, not a safety feature. When ransomware encrypts files in a synced OneDrive or Google Drive folder, the sync client sees changed files and uploads them, so the cloud copy gets encrypted too.

Departed users are the other quiet risk. The fix is simple. Back up the person's mailbox and OneDrive before anyone touches the license.

What does a real Microsoft 365 backup and restore plan look like?

A real backup and restore plan includes an independent third-party backup stored outside your tenant, daily or more frequent backups of email, OneDrive, SharePoint, and Teams, defined RPO and RTO targets, retention long enough to catch late discoveries, and restore tests run on a schedule. A backup you haven't tested is just an assumption.

Your backup checklist

• An independent third-party backup, stored outside your Microsoft 365 tenant
• Coverage for every workload, email, OneDrive, SharePoint, and Teams (plus Gmail and Drive if you use Google Workspace)
• Backups that run daily or more often
• Written RPO and RTO targets that leadership has signed off on
• Retention long enough to catch late discoveries, well past the 93-day recycle bin
• Scheduled restore tests, with every backup success and failure logged and reviewed

A mini restore drill

1. Pick a target, such as a single file, a mailbox folder, or a SharePoint library. Rotate it each time.
2. Write down the start time.
3. Restore it to an alternate location so you don't overwrite live data.
4. Open the restored items and confirm they're complete and readable.
5. Record how long it took and compare it to your RTO.
6. Log the result and fix any gaps before the next drill.

Two more terms worth knowing. An immutable backup is a copy that can't be changed or deleted for a set period, which protects it from ransomware and compromised admins. The 3-2-1 rule means three copies of your data, on two different types of storage, with one copy off-site.

What are RPO and RTO?

RPO (recovery point objective) is how much data you can afford to lose, measured as the time since your last good backup. RTO (recovery time objective) is how long you can afford to be down before the business takes real damage.

If your backup runs nightly, your RPO is up to a full day of work. Decide whether that's acceptable before an incident decides for you.

How often should you test restores?

Test at least quarterly. Your environment changes constantly, with new users, new SharePoint sites, and new Teams, and a quarterly test catches coverage gaps before a real incident does.

Test both a granular restore (one file or one email) and a larger one (a whole mailbox or site). Knowing one works tells you nothing about the other.

Backup success and failure should be logged and reviewed, not assumed. A green checkmark in a console nobody opens is not a backup strategy.

At Headway, we back up all Microsoft 365 data, including mailboxes, contacts, calendars, tasks, notes, OneDrive, Teams messages, and SharePoint Online sites. For Google Workspace, we back up Gmail, contacts, calendars, and Google Drive. We also run nightly backups of physical servers.

Every backup job is logged as a ticket, and failures are fixed by the next business day. We test restores, not just job logs.

It's all included in our per-user price, not sold as an add-on. You can see how it fits together on our continuity page.

Frequently asked questions

So who's actually protecting your data?

The cloud keeps the lights on. You keep the data.

Microsoft and Google do a very good job keeping their services available. Making sure your data is recoverable is your job, or your IT provider's job if you're paying one to do it.

Here's the simplest test I know. Ask your IT provider when they last tested a restore. If they have to think about it, call us.

Or see how backups fit into our continuity services.