By PC Madness ·
The short answer
Not in the way most people mean. Microsoft 365 keeps your email and files available, protects them against hardware failure in its data centres, and gives you a few safety nets for things that get deleted. What it doesn't give you is a separate copy of your data, outside your account, that you can restore from months later no matter what happened inside the account.
Those safety nets are called retention, and they are genuinely useful. But retention and backup solve different problems, and the gap between them is where Perth small businesses tend to lose data. Here's what Microsoft 365 actually keeps, where it stops, and how to decide whether you need a dedicated backup on top.
What Microsoft 365 keeps for you
Out of the box, Microsoft 365 has several ways to get back something that was deleted or changed:
- The recycle bin for OneDrive and SharePoint. Deleted files go to a two-stage recycle bin, and items are kept for a total of 93 days from when they were first deleted, according to Microsoft's recycle bin documentation.
- Recoverable deleted email. When someone empties their Deleted Items folder, the messages can still be recovered for 14 days by default in Exchange Online, and an administrator can raise that to a maximum of 30 days (Microsoft Learn).
- Version history. OneDrive and SharePoint keep earlier versions of a document, so an overwritten spreadsheet can usually be rolled back.
- A grace period when staff leave. When a user account is deleted, their OneDrive is kept for 30 days by default before it is cleaned up, a period an administrator can change (Microsoft Learn).
Microsoft also offers retention policies and holds as part of its compliance tools. These can keep content for longer, but they are designed for record-keeping and legal discovery, need to be set up deliberately, and recovering data from them is an administrator's job rather than a simple restore.
Why retention isn't the same as a backup
A backup is a separate copy of your data, kept somewhere a problem in your live system can't reach, that you can restore to a chosen point in time. Retention is different in a few important ways:
- It lives inside the same account. If an attacker takes over an administrator login, or the account is misconfigured, the same access that damaged your data can usually reach the retained copies too.
- It runs on a clock. Once the retention period ends, deleted items are gone for good. Problems that are only noticed months later, such as a folder someone deleted before going on leave, fall outside it.
- It keeps whatever you give it. If ransomware encrypts files on a laptop and those files sync to OneDrive, the encrypted versions sync too. Version history may help, but rolling back thousands of files one by one is slow and easy to get wrong.
- Restores are piecemeal. Retention is built for getting back individual items. Putting a whole mailbox or a shared library back the way it was last Tuesday is a different job.
Microsoft's own shared responsibility model says that for every type of cloud service, including software like Microsoft 365, the customer remains responsible for its data and its user accounts. Microsoft runs the infrastructure; protecting what you store in it is up to you.
Where the gaps show up in real businesses
Most data loss in Microsoft 365 isn't dramatic. The common situations look like this:
- A staff member leaves, their account is deleted, and weeks later someone realises their OneDrive held the only copy of an important client folder.
- Ransomware on one laptop encrypts files in a synced SharePoint library that the whole office uses.
- A compromised email account is used to delete messages or set up rules that hide an attacker's activity, and the damage isn't spotted until well after the recovery window.
- Someone tidies up a shared folder, deletes the wrong subfolder, and nobody notices until end of financial year.
When built-in retention may be enough
A dedicated backup isn't essential for everyone. Built-in retention may be all you need if most of these are true:
- You're a sole trader or very small team, and you'd notice a missing file or email within days.
- Your critical records live in other cloud systems that keep their own history, such as your accounting or job management software.
- Losing a few months of email or documents would be inconvenient rather than costly.
- Staff rarely leave, and when they do, their files are moved before the account is deleted.
If that's you, make the most of what you already pay for: raise deleted email retention to its maximum, lengthen the OneDrive retention for deleted users, turn on multi-factor authentication for every account, and keep administrator logins separate from everyday ones.
What to look for in a dedicated backup
If your business can't afford to lose its email and files, a dedicated Microsoft 365 backup closes the gaps above. When comparing options, check that it:
- Stores copies outside your Microsoft 365 account, with separate credentials, so an attack on your account can't delete the backups.
- Runs automatically several times a day, without anyone needing to remember.
- Covers email, OneDrive and SharePoint, and ask whether Teams data is included.
- Encrypts data in transit and at rest.
- Restores at any level, from a single email or file to a full mailbox or library, to a point in time you choose.
- Keeps backups for as long as your business and record-keeping obligations need.
- Is actually tested. A backup that has never been restored is a hope, not a plan.
It's also worth backing up the laptops and desktops your team works on, since not everything ends up in the cloud.
How PC Madness can help
Our Microsoft 365 and Google Workspace backup service keeps automated, encrypted cloud backups of your emails, documents and files, plus your endpoint devices, so you can restore anything from a single file to an entire system. It's managed by our team from Midland, alongside EDR and MDR with ransomware rollback and email security that stops many of the threats behind data loss in the first place.
Not sure whether your retention settings are enough? Send us a message to book a free, obligation-free IT security audit and we'll check what your Microsoft 365 account keeps today and whether a backup is worth it for your business.
