Is Microsoft 365 backed up?

Microsoft is clear about this in their own terms, but it surprises people every time: Microsoft 365 operates on a shared responsibility model. Microsoft keeps the service running and the infrastructure resilient. Recovering your data after someone deletes, overwrites or encrypts it is your side of the line.

What you actually get

There is retention, and it is useful, but it is not backup:

• Deleted items sit in the recycle bin, then a second-stage recycle bin, then they are gone. For SharePoint and OneDrive that is 93 days in total.
• A deleted mailbox is retained for 30 days by default.
• Version history helps with an overwritten file, until someone exhausts the versions or deletes the file entirely.
• Retention policies can hold data longer, but they are a compliance tool. Restoring thousands of items from a hold is not a recovery process anyone wants to run under pressure.

The scenarios retention does not cover

A departing employee who clears their mailbox before handing back the laptop. A ransomware infection that syncs encrypted files up through OneDrive. A misconfigured retention policy that deletes more than intended. A compromised account used to wipe a shared mailbox. In each case the damage is discovered weeks later, well past the window.

What proper backup looks like

An independent copy of Exchange, SharePoint, OneDrive and Teams, held outside the tenant, with retention set against how far back you would genuinely need to go rather than the vendor default. We use NinjaOne SaaS Backup, powered by Dropsuite.

The part that matters more than the product is the restore. A backup nobody has tested is a report, not a recovery plan. We run restores and confirm the data comes back in a usable state, because the first time you find out otherwise should not be the day you need it.

If you run servers as well, physical or virtual, the same logic applies — those need cloud or offsite backup with tested restores, not a drive in the same office as the server.