Your expert in backup and data protection!The solution tailored to your needs
Home›Guides›Microsoft 365 and Google Workspace
Microsoft 365 and Google Workspace
Backing up Microsoft 365: what you need to know
Microsoft ensures the availability of Exchange, OneDrive, SharePoint and Teams. Rolling a mailbox or a site back to how it was three weeks ago, after a deletion, a compromised account or a misconfigured retention policy, remains the customer’s responsibility. Standard subscriptions do not provide that independent copy.
Key points
- Microsoft guarantees the service, not the ability to roll back your data: redundancy replicates deletions too.
- The built-in safety nets are short: 14 days by default (30 at most) for a permanently deleted message in Exchange Online, 93 days for the SharePoint and OneDrive recycle bins.
- Microsoft 365 Backup is a separate paid product, billed by volume, whose copies stay in the Microsoft cloud.
- Minimum scope for an SME: named and shared mailboxes, OneDrive, SharePoint sites (and therefore Teams files).
Two separate responsibilities
Microsoft commits to the infrastructure: redundant data centres, platform integrity and service continuity if it suffers an outage. The customer administers accounts, permissions, retention policies and third-party applications. An administrator, or someone who has stolen their access, can delete a mailbox, empty a site or create a rule that forwards mail outside the company. Microsoft’s redundancy replicates that state. It does not rewind it for you.
It is the same split as for a server: the manufacturer guarantees the RAID disk, not your deleted files.
| Who takes care of what | Microsoft | The customer |
|---|---|---|
| Service availability, data centres | Yes | No |
| Accounts, permissions, multi-factor authentication | No | Yes |
| Configuring retention and recycle bins | Provides the tool | Configures and checks |
| Restoring the state of a chosen date, outside the tenant | No (except with a paid product, in its own cloud) | Yes, with a backup |
What the built-in tools really do
- Recycle bins and recoverable items. They cover a recent deletion. In Exchange Online, a permanently deleted message remains recoverable for 14 days by default; the administrator can extend this to 30 days at most. In SharePoint and OneDrive, a deleted item stays in the recycle bins for 93 days; Microsoft then keeps 14 days of internal backups, which can only be restored through a support request, for an entire site collection or subsite.
- Retention policies and litigation hold. They prevent certain messages from disappearing within the tenant. They serve audits and legal disputes. They remain under the authority of the tenant’s administrators, and they do not restore a SharePoint site “as it was on Tuesday”.
- File versions in OneDrive and SharePoint. Useful for an overwritten document. Limited in number and duration, and of no help if the whole library is deleted beyond the recycle bin period.
- Microsoft 365 Backup, a separate paid product, billed on consumption according to the volume protected. It backs up Exchange Online, OneDrive and SharePoint, with frequent restore points and retention configurable from three months to two years. Microsoft states that the data does not leave its Microsoft 365 trust boundary. It is not included in Business Standard or E3. Details are in Does Microsoft 365 really include a backup?.
What a proper backup adds
A copy outside the tenant, at a chosen frequency (this is the RPO), kept for N days, restorable to a test mailbox, and ideally impossible to delete during the anti-ransomware retention period. It covers human error, stolen accounts and the case where you do not want your only copy to depend on the same administrator and the same vendor.
It applies to the cloud a principle that the ANSSI, France’s national cybersecurity agency, sets for every information system: several separate copies, on different media, one of them offline, and a backup infrastructure that does not share authentication with production.
It does not replace multi-factor authentication on admin accounts, nor the monitoring of forwarding rules.
Minimum scope for an SME
Personal mailboxes, shared mailboxes, OneDrive, SharePoint sites (and therefore Teams files). Forgetting shared mailboxes is the most common mistake, because billing and inventory follow named users.
Checklist before signing:
- List of mailboxes, including shared ones and those of former employees that must be kept.
- List of the SharePoint sites and Teams teams actually in use.
- Backup frequency and retention period, in writing.
- Where the copies are stored, and who can delete them.
- Date of the first restore test.
At WeDoBack
WeDoBack covers Microsoft 365 for emails, calendars and contacts, with one agent per email address plus storage for the volume, under the SMART or INTEGRAL offer. Copies are encrypted before they are sent, with a key held by the customer, and kept outside the tenant, on servers dedicated to backup. SharePoint and OneDrive are also covered, with the same encryption and the same customer-held key. The pages on emails and SharePoint and OneDrive cover each topic in detail, as they are not restored in the same way.
Frequently asked questions
Doesn’t Microsoft already back up my data?
Microsoft replicates data to keep the service running. It also keeps deleted items for a limited time: 14 days by default in Exchange Online, 93 days in the SharePoint recycle bins. Beyond that, or after a purge, there is nothing left to restore, unless you have subscribed to Microsoft 365 Backup or a third-party backup.
Is an E5 licence enough?
No. E5 adds security and compliance features (retention, eDiscovery). These features keep certain content inside the tenant, under the authority of its administrators. They do not provide a dated copy, outside the tenant, that can be restored to a chosen date.
Which mailboxes are most often forgotten?
Shared mailboxes such as accounts@ or contact@. They do not always have a licence, and inventories follow named users. Yet they are often the most useful to the business.
Further reading
Sources
Documents consulted in October 2026.
- Overview of Microsoft 365 Backup — Microsoft Learn
- Change how long permanently deleted items are kept for an Exchange Online mailbox — Microsoft Learn
- SharePoint data deletion in Microsoft 365 — Microsoft Learn
- Information system backup – The fundamentals (ANSSI-BP-100, v1.1, 27 November 2025, in French) — ANSSI
- Offers and prices — WeDoBack
Planning a backup, DRP or BCP project?
More than 20 years of experience protecting business data.
Request a quote+33 9 72 50 78 28Protect your data with WeDoBack
Encrypted offsite backup, immutable storage, DRP and BCP: tell us about your servers and we will recommend the right combination.