Does Microsoft 365 Back Up Your Email and Files? What Businesses Need to Know

Most businesses assume that moving email and files to Microsoft 365 means everything is backed up and safe forever. It isn’t. Microsoft keeps deleted items for a short, fixed window, and once that window closes, the data is gone.

When a business moves to Microsoft 365, the assumption is usually the same: it’s the cloud, so it must be backed up. Microsoft runs the servers, Microsoft keeps the data safe, and if something goes missing, Microsoft can get it back.

That assumption is wrong, and it’s the kind of wrong that only becomes obvious at the worst possible moment. Microsoft 365 gives you excellent email, file storage, and collaboration tools. What it does not give you is a backup.

The Short Answer: No, It Doesn’t

Microsoft 365 has retention, not backup. Those are different things, and the difference is measured in days.

When someone permanently deletes an email in Outlook, it moves to a hidden Recoverable Items folder and stays there for 14 days by default. An administrator can extend that, but only to a maximum of 30 days. After that, it’s removed from Exchange entirely. Files deleted from OneDrive or SharePoint sit in the recycle bin for 93 days before permanent deletion.

Retention Is Not the Same as Backup

A retention window answers one question: “did someone delete this recently?” A backup answers a much bigger one: “can I get this back, in the state it was in, whenever I need it?”

Retention figures are Microsoft’s documented defaults for Exchange Online and SharePoint/OneDrive as of this writing; see the sources listed at the end of this post. Your tenant may be configured differently, worth checking.

Microsoft Says This Themselves

This isn’t a gap Microsoft hides. It’s spelled out in two places.

The first is the shared responsibility model. Microsoft’s own documentation is direct about where the line falls: for every type of cloud deployment, including software-as-a-service like Microsoft 365, customer data is the customer’s responsibility, not Microsoft’s. Microsoft’s list of “responsibilities you always retain” starts with data.

The second is the Microsoft Services Agreement, which puts it in plain language: “We recommend that you regularly backup Your Content and Data that you store on the Services.”

How Microsoft 365 Data Actually Goes Missing

Almost nobody loses data to a datacenter fire. They lose it to ordinary Tuesday-afternoon events:

• Accidental deletion. Someone clears out a mailbox folder or a SharePoint library and nobody notices for two months, long past both retention windows
• Ransomware and malware. Encryption spreads through synced folders, and the encrypted versions sync straight up to the cloud
• Overwrites. A shared document gets replaced with the wrong version and saved over the good one
• A compromised account. An attacker with mailbox access can delete or alter data before anyone realises the account is breached
• Employee turnover. A licence gets removed when someone leaves, and their mailbox and OneDrive go with it, usually before anyone has checked what was in there

Every one of these has the same shape: the loss happens quietly, and it’s discovered after the recovery window has already closed.

What a Proper Backup Covers

A real Microsoft 365 backup takes independent copies of everything the business actually runs on:

• Exchange Online, mail, contacts, calendars, tasks, in-place archives and public folders
• OneDrive, documents and version history
• SharePoint, site collections, document libraries, lists, permissions and pages
• Teams and Groups, conversations, channels, files, Planner and tabs

What We Use: Keepit

At Twilight I.T. we use Keepit for Microsoft 365 backup. Three things make it the right fit for small business:

1. It covers the whole environment. Exchange Online, OneDrive, SharePoint, and Teams/Groups are all protected in one system
2. The copies live outside Microsoft. Keepit stores backup data on its own independent cloud infrastructure, in a data centre region you choose, so a problem inside your Microsoft tenant can’t take the backup with it
3. The backups can’t be tampered with. Keepit stores data in an immutable format using a blockchain-like Merkle tree structure, specifically to stop attackers manipulating backups
4. Retention long enough to be meaningless as a limit. Keepit’s Enterprise Unlimited and Governance Plus plans carry unlimited data retention, no expiry on the backup copies at all. That’s what makes it a backup rather than a longer retention window, and it’s why Keepit is used to satisfy statutory retention mandates such as Germany’s 10-year requirement for financial records

Restores are granular, an individual email, a single file, a whole mailbox, or an entire dataset, restored back to its original location with its structure and metadata intact.

The Offboarding Problem It Quietly Solves

Here’s the one that saves the most money and the most hassle, and almost nobody thinks about it until they’re in the middle of it.

When someone leaves, you want their licence back, that’s a recurring cost for an employee who no longer works there. But you can’t just delete the account, because their mailbox and their OneDrive go with it, and you may need something from either one months later. A contract. A supplier thread. The only copy of a quote.

So the usual workaround is a scramble: export the mailbox to a PST, copy their OneDrive down to a folder somewhere, and hope you can find it again in two years. Multiply that by every departure and you end up with a pile of loose PST files and orphaned folders that nobody has indexed, nobody has backed up, and nobody wants to be responsible for.

Keepit’s own documentation describes exactly this: a deleted user is still there to be found, turn on the deleted-items view or open an earlier snapshot, then use the import feature to recover their data from the point in time you need.

And getting it back doesn’t require touching Microsoft 365 at all. Keepit’s mail folders “can be downloaded as PST files,” and “once you have downloaded the PST file, you can directly mount the data back into Outlook using Outlook’s import feature.” Files are the same idea, download them and drop them back into OneDrive or SharePoint wherever they belong.

You also don’t have to take everything. The search is granular: “locate items with ease using inclusive filters by type, date, and size”, and you can open an earlier snapshot to pull from a specific point in time. So if what you need is one quarter’s correspondence, or one supplier thread, that’s what you take.

No standing pile of PST exports. No archive folder on somebody’s desktop that nobody backs up. No paying for a licence purely to keep an ex-employee’s mailbox alive.