Why your business needs to back up Microsoft 365

Here’s a belief that sinks businesses: “It’s in Microsoft 365, so it’s backed up.” It isn’t. Microsoft keeps some deleted things for a while, which is a different promise, and the difference only shows on the day you need something back.

The short answer: Microsoft 365 doesn’t include a backup of your data. Microsoft keeps the service running; under its shared-responsibility model, your data is your responsibility. Deleted email is kept for 14 days by default (30 at most) and deleted SharePoint files for 93 days. If nobody notices in time, it’s gone. A separate backup keeps a copy you control, for as long as you set.

Whose job is it?

Microsoft is clear about this. Its shared-responsibility model says that whatever cloud service you use, including Microsoft 365, you’re responsible for your data and your accounts, including who can access them. Microsoft looks after the datacentres and the software that runs the service.

So if Microsoft’s datacentre has a bad day, that’s Microsoft’s problem, and it keeps several copies to make sure it isn’t yours. If your own staff member, or someone using their password, deletes your files, that’s yours.

What Microsoft keeps, and for how long

Microsoft 365 does have safety nets. They’re time-limited:

What was deleted	How long Microsoft keeps it	Source
Email (after Deleted Items is emptied)	14 days by default; an admin can raise it to 30	Microsoft Learn
SharePoint and Teams files	93 days in the recycle bins	Microsoft
A whole OneDrive, rolled back	Any point in the last 30 days	Microsoft
A leaver’s OneDrive, after their account is deleted	30 days by default (an admin can change it), then 93 days in the recycle bin	Microsoft Learn

Checked against Microsoft’s pages in November 2026.

Those windows cover the everyday mistake that’s spotted the same week. They don’t cover the mailbox someone emptied before they left and nobody missed until the quarter-end, or the folder that was overwritten in March and found in July.

Retention isn’t backup

Microsoft also offers retention policies, and they get mistaken for backup. Microsoft describes retention as a way to keep what you need and delete what you don’t, often to meet rules on how long records are kept. It’s a compliance tool. It won’t hand you back a mailbox as it was last Tuesday.

A backup is a separate copy, outside the everyday reach of your accounts, that you restore from when something has gone wrong.

What a proper backup gives you

A Microsoft 365 backup keeps independent copies of your email, OneDrive, SharePoint and Teams, so a single file or a whole mailbox can be put back after it’s been deleted or encrypted. The things it’s there for:

• A file or mailbox is deleted, by accident or on purpose, and nobody notices until the safety nets have expired.
• Ransomware or a taken-over account encrypts or wipes data across the business.
• Someone leaves and takes, or wipes, what was in their mailbox and OneDrive.
• A restore needs to go back further than 30 or 93 days.

Microsoft now sells its own Microsoft 365 Backup, billed by how much data you protect rather than per user, and plenty of other providers offer one. Whichever you choose, check how far back it goes, and test a restore before you need one.

The cost of the backup

Nothing for nothing: a backup is a monthly cost on top of your Microsoft licences. Ours is priced per user (more on our cloud and Microsoft 365 services). We don’t sell it on its own; it’s part of a Jera agreement. Against that, set what one lost mailbox or one encrypted SharePoint site costs you in time.

How Jera can help

For the businesses we look after across Edinburgh, Glasgow and Aberdeenshire, we keep a separate backup of your email, OneDrive, SharePoint and Teams, and we monitor it, so a backup that fails gets fixed long before the day you need it. Book a call and we’ll check what your Microsoft 365 would let you recover today.