Your expert in backup and data protection!The solution tailored to your needs
Home›Guides›Microsoft 365 and Google Workspace
Microsoft 365 and Google Workspace
Backing up Microsoft 365: what you need to know
Microsoft ensures that Exchange, OneDrive, SharePoint and Teams are available. Going back to a mailbox or a site as it was three weeks ago, after a deletion, a compromised account or a badly configured retention policy, remains the customer’s responsibility. Standard plans do not provide that independent copy.
Key points
- Microsoft guarantees the service, not the ability to roll back your data: redundancy replicates deletions too.
- The built-in safety nets are short: 14 days by default (30 at most) for a permanently deleted message in Exchange Online, 93 days for the SharePoint and OneDrive recycle bins.
- Microsoft 365 Backup is a separate paid product, billed by volume, whose copies remain in the Microsoft cloud.
- Minimum scope for an SME: named and shared mailboxes, OneDrive, SharePoint sites (and therefore Teams files).
Two responsibilities
Microsoft commits to the infrastructure: redundant data centres, platform integrity, service continuity if it suffers an outage. The customer manages accounts, permissions, retention policies and third-party applications. An administrator, or someone who has stolen their access, can delete a mailbox, empty a site or create a rule that forwards mail outside. Microsoft’s redundancy replicates that state. It does not rewind it for you.
It is the same split as for a server: the manufacturer guarantees the RAID disk, not your deleted files.
| Who handles what | Microsoft | The customer |
|---|---|---|
| Service availability, data centres | Yes | No |
| Accounts, permissions, multi-factor authentication | No | Yes |
| Configuring retention and recycle bins | Provides the tool | Configures and checks |
| Restoring to a chosen date, outside the tenant | No (except paid product, in its own cloud) | Yes, through a backup |
What the built-in tools actually do
- Recycle bins and recoverable items. They catch a recent deletion. In Exchange Online, a permanently deleted message remains recoverable for 14 days by default; the administrator can extend this to a maximum of 30 days. In SharePoint and OneDrive, a deleted item stays in the recycle bins for 93 days; Microsoft then keeps 14 days of internal backups, which can only be restored through a support request, for an entire site collection or subsite.
- Retention policies and litigation hold. They prevent certain messages from disappearing within the tenant. They serve audits or litigation. They remain under the authority of the tenant’s administrators, and they do not restore a SharePoint site “as it was on Tuesday”.
- File versions in OneDrive and SharePoint. Useful for an overwritten document. Limited in number and duration, and of no use if the entire library is deleted beyond the recycle bin.
- Microsoft 365 Backup, a separate paid product, billed on consumption according to the volume protected. It backs up Exchange Online, OneDrive and SharePoint, with frequent restore points and retention configurable from three months to two years. Microsoft states that the data does not leave its Microsoft 365 trust boundary. It is not included in Business Standard or E3. Details are in Does Microsoft 365 really include a backup?.
What a proper backup adds
A copy outside the tenant, at a chosen frequency (this is the RPO), kept for N days, restorable to a test mailbox, ideally impossible to delete during the anti-ransomware period. It covers human error, a stolen account and the case where you do not want your only copy to depend on the same administrator and the same vendor.
It applies to the cloud a principle recalled by CERT-MU (off-site copy, regular restore tests) and set out by the French cybersecurity agency (ANSSI) for any information system: several distinct copies, on different media, one of them offline, and a backup infrastructure that does not share authentication with production.
It does not remove the need for multi-factor authentication on admin accounts, nor for monitoring forwarding rules.
Minimum scope for an SME
Personal mailboxes, shared mailboxes, OneDrive, SharePoint sites (and therefore Teams files). Forgetting shared mailboxes is the most common mistake, because billing and inventory follow named users.
Checklist before signing:
- List of mailboxes, including shared ones and those of former employees to be kept.
- List of SharePoint sites and Teams teams actually in use.
- Written backup frequency and retention period.
- Where the copies are stored, and who can delete them.
- Date of the first restore test.
At WeDoBack
WeDoBack supports Microsoft 365 for email, calendars and contacts, with one agent per email address, plus storage for the volume, under SMART or INTEGRAL. Copies are encrypted before they are sent, with a key held by the customer, and kept outside the tenant, on servers dedicated to backup. SharePoint and OneDrive are also covered, with the same encryption and the same customer-held key. The email and SharePoint and OneDrive pages cover each topic in detail, as they are not restored in the same way.
Frequently asked questions
Doesn’t Microsoft already back up my data?
Microsoft replicates data to keep the service running. It also keeps deleted items for a limited time: 14 days by default in Exchange Online, 93 days in the SharePoint recycle bins. Beyond that, or after a purge, there is nothing left to restore, unless you have subscribed to Microsoft 365 Backup or a third-party backup.
Is an E5 licence enough?
No. E5 adds security and compliance features (retention, eDiscovery). These features keep certain content inside the tenant, under the authority of its administrators. They do not provide a dated copy, outside the tenant, that can be restored to a chosen date.
Which mailboxes are most often forgotten?
Shared mailboxes such as accounts@ or contact@. They do not always have a licence, and inventories follow named users. Yet they are often the most useful to the business.
Further reading
Sources
Documents consulted in October 2026.
- Overview of Microsoft 365 Backup — Microsoft Learn
- Change how long permanently deleted items are kept for an Exchange Online mailbox — Microsoft Learn
- SharePoint data deletion in Microsoft 365 — Microsoft Learn
- Backing up information systems – The fundamentals (ANSSI-BP-100, v1.1, 27 November 2025, in French) — ANSSI (French cybersecurity agency)
- Offers and prices — WeDoBack
Planning a backup, DRP or BCP project?
More than 20 years of experience protecting business data.
Request a quote+33 9 72 50 78 28Protect your data with WeDoBack
Encrypted offsite backup, immutable storage, DRP and BCP: tell us about your servers and we will recommend the right combination.