Is Microsoft 365 backed up?

Not in the way most people assume. Microsoft guarantees the service is available and protects its own infrastructure, but your emails, files and Teams content remain your responsibility under a shared responsibility model. The built-in retention windows are short and designed for accidents, not for ransomware, departed staff or a problem found months later.

This is one of the most consequential misunderstandings in small business IT, and it is entirely reasonable, because everything about the experience suggests otherwise. The data is in a Microsoft data centre, it survives your laptop being stolen, it appears on every device, and it never seems to go away. From the outside that looks exactly like a backup. What it actually is, is a well-run, highly available service, and availability and recoverability are different properties.

Microsoft states the split openly in its shared responsibility model: they run and protect the platform, you own and are accountable for your data. Read alongside their service terms, the recommendation to use third-party backup is not a loophole, it is the design. The platform will not lose your data to a hardware failure in their data centre. It will faithfully replicate your own mistakes, your departing employee's deletions, and an attacker's encryption, because from the platform's point of view those are legitimate instructions from authenticated users.

What the built-in features do cover is worth knowing precisely, because it is not nothing. Deleted items and deleted files sit in recycle bins for a limited period. Version history lets you roll a document back through recent edits. Retention policies, if someone has configured them, can hold content longer for compliance purposes. All of that is genuinely useful for the everyday case: the file deleted last Tuesday, the paragraph someone overwrote this morning. The limits are the point, though. The windows are measured in weeks, they vary by content type, they depend on nobody having emptied anything, and a compromise discovered in three months lands well outside them.

Four scenarios expose the gap, and each one is ordinary rather than exotic. Ransomware that reaches the tenant through a synced device or stolen credentials and encrypts what it finds in SharePoint and OneDrive. A departing employee whose mailbox disappears with their licence, six months before a dispute makes that correspondence important. A well-meaning tidy-up that deletes a Teams channel and takes its files with it. And the slow-burn one: an account quietly compromised weeks ago, with deletions nobody noticed until the trail is cold. In all four, the built-in retention has either expired or dutifully replicated the damage.

A proper Microsoft 365 backup answers this by keeping an independent copy outside the tenant, with its own access controls, its own retention, and restore granular enough to bring back a single mailbox or a single file rather than everything. That last property matters more than it sounds, because most real restores are small and specific. This is what we run for clients: Veeam backing up the entire tenant daily to a separate data centre, with thirty days of history across mail, files, Teams and SharePoint, so recovery does not depend on the platform's own safety net or on the attacker having missed something.

It also sits inside a bigger obligation. The Essential Eight counts regular, tested, protected backups among its eight controls, and it does not exempt data because it lives in someone else's cloud. If your business holds personal information, the Privacy Act's expectations follow the data rather than the server, and an insurer's renewal questionnaire asking whether your backups are independent of your production environment is asking exactly this question, whether or not it says Microsoft 365.

The honest caveats. Backup is not a substitute for the controls that stop the incident: multi-factor authentication and sensible permissions prevent more damage than any restore repairs. Third-party backup is an added cost, modest per user but real, and worth deciding deliberately rather than by default in either direction. And the same reasoning applies to every other cloud platform you rely on, your accounting system, your job-management tool, your clinical software, each of which has its own answer that somebody should have checked. If you want yours checked, the Cyber Security Scorecard covers it free, or call 1800 456 567.