Your expert in backup and data protection!The solution tailored to your needs
Home›Guides›Microsoft 365 and Google Workspace
Microsoft 365 and Google Workspace
Should you back up Microsoft 365?
Yes, if the messages or files stored in Microsoft 365 could not be rebuilt after a deletion, a compromised account or too short a retention period. That is the case for almost every SME whose email and team folders live in that tenant. No, only if another system already holds a complete, tested historical copy, which is rare.
Key points
- Microsoft’s safety nets last days or weeks: 14 to 30 days for a purged message, 30 days to restore a deleted account, 93 days for the SharePoint recycle bins.
- A hacked admin account can purge mailboxes and sites: redundancy replicates the destruction.
- Not backing up a particular component (test tenant, distribution list) is acceptable if it is written down.
- Typical setting: daily copy, kept for 30 to 90 days, a period to be justified under the Data Protection Act 2017.
Cases where having no backup comes at a cost
- An employee deletes a folder, empties the recycle bin, and the need resurfaces two months later. Exchange Online keeps a permanently deleted message for only 14 days by default, 30 at most.
- An admin account is hacked. The attacker purges mailboxes, sets up forwarding and deletes sites.
- A retention policy is set too aggressively and erases more than intended.
- The account of an employee who has left is deleted and the 30-day window during which Microsoft allows it to be restored with its mailbox is exceeded.
- Ransomware encrypts synchronised files (OneDrive, SharePoint via the workstation) and versions are no longer enough.
In each of these cases, Microsoft keeps the service running. The business data, however, is missing.
| Situation | Built-in Microsoft safety net | After this period |
|---|---|---|
| Message purged from the mailbox | 14 days by default, configurable up to 30 | Lost |
| User account deleted | 30 days | Account and mailbox lost |
| SharePoint file or site deleted | 93 days in recycle bins, then 14 days via support | Lost |
| Purge by a compromised admin | None beyond the periods above | Lost |
Cases where you can decide not to back up a component
- A distribution list mailbox with no useful history.
- Purely conversational Teams teams, if it has been written down that these exchanges are not part of the company’s records. The files, however, must still be covered.
- A test tenant.
Deciding not to back up is acceptable if it is written down. “We’ll see” is not a decision.
What it costs to do it
The price depends on the number of mailboxes and the volume kept, plus the length of history. A daily backup kept for 30 to 90 days is the most common setting. Extending it further should be justified by a business need, not by fear: mailboxes contain personal data, and the Data Protection Act 2017 (section 27) requires it to be destroyed once its purpose has been fulfilled. The retention period is set according to the purpose, after which the data is deleted.
Comparing it with the cost of a week of unrecoverable email (unanswered customers, contract attachments, order threads) makes the choice simpler than the unit price.
What not to buy instead
A higher Microsoft licence (E5, for example) adds security and compliance. It is not equivalent to a copy outside the tenant. Microsoft’s paid Microsoft 365 Backup offering, on the other hand, is a genuine backup of Exchange Online, OneDrive and SharePoint, billed by volume, and Microsoft states that the data remains within its Microsoft 365 boundary. It meets part of the need. It does not meet the wish for a copy held by another provider, nor does it back up servers that are not in Microsoft 365. The comparison is in Does Microsoft 365 really include a backup?.
At WeDoBack
Backing up Microsoft 365 email, calendars and contacts is supported: one agent per address, plus the terabytes of volume, under SMART (€49.99 excl. VAT per TB per month, support billed per intervention) or INTEGRAL (from €100 down to €65 excl. VAT per TB per month depending on volume, two hours of support per month). It is the same principle as for a server: the copy leaves the original environment and remains encrypted with a key held by the customer. SharePoint and OneDrive are covered too: a single quote can combine email, files and servers in the same storage volume.
Frequently asked questions
How long does Microsoft keep the account of an employee who has left?
After a user is deleted, the administrator has 30 days to restore the account and its data, mailbox included. After that, the account and its mailbox can no longer be restored this way. What must remain accessible should therefore be decided before deletion: backup, or retention in the tenant.
How long should email backups be kept?
Thirty to ninety days cover most errors and compromises discovered late. Beyond that, you need a reason. Mailboxes contain personal data: the Data Protection Act 2017 (section 27) requires it to be destroyed once its purpose has been fulfilled, so the retention period must follow the purpose.
Is Microsoft 365 Backup enough?
It is a genuine backup of Exchange, OneDrive and SharePoint, paid for and hosted in the Microsoft cloud. It meets the need to roll back. It does not meet the wish for a copy held by another provider, nor does it cover servers and workstations outside Microsoft 365.
Further reading
Sources
Documents consulted in October 2026.
- Restore a user — Microsoft Learn
- Change how long permanently deleted items are kept for an Exchange Online mailbox — Microsoft Learn
- SharePoint data deletion in Microsoft 365 — Microsoft Learn
- Overview of Microsoft 365 Backup — Microsoft Learn
- Data Protection Act 2017 (section 27: retention period) — Data Protection Office (Mauritius)
- Offers and prices — WeDoBack
Planning a backup, DRP or BCP project?
More than 20 years of experience protecting business data.
Request a quote+33 9 72 50 78 28Protect your data with WeDoBack
Encrypted offsite backup, immutable storage, DRP and BCP: tell us about your servers and we will recommend the right combination.