Microsoft 365 keeps your business email, files, calendars, and collaboration tools in the cloud. But having your data in Microsoft 365 does not automatically mean you have a complete, independent backup. That distinction matters when an employee deletes important email, ransomware encrypts files, or an account is compromised. For Minnesota businesses, understanding what Microsoft protects and what remains your responsibility can help prevent a small incident from becoming a major recovery problem.
Microsoft operates the cloud infrastructure and provides built-in protection and recovery features. But your organization remains responsible for its data, user accounts, access controls, and data protection decisions. (Microsoft Learn) In other words, Microsoft 365 is not a substitute for having a recovery plan.
What Microsoft’s 365 retention actually covers
Microsoft 365 includes several recovery and retention features, but they serve different purposes. Retention policies are primarily designed to preserve or manage content according to business or compliance requirements; they are not automatically the same thing as a traditional backup. (Microsoft Learn)
Microsoft also has defined data-retention periods for deleted customer data. For example, customer content in an active-deletion scenario may be retained for up to 30 days under Microsoft’s general data-handling policy. These periods should not be treated as a guaranteed long-term backup strategy. (Microsoft Learn)
5 Ways Companies Lose Microsoft 365 Data
Deleted employee accounts
When an employee leaves, their account may be deleted as part of normal offboarding. If important email or files are needed later, recovery can become much more complicated without an established backup and retention plan.
Ransomware syncing into OneDrive or SharePoint
If ransomware encrypts files on a user’s computer and those changes synchronize to OneDrive or SharePoint, the encrypted versions can spread through the cloud environment. Recovery depends on having the right protection and restore capabilities.
Retention policy misconfiguration
Retention settings can be useful, but they must be configured correctly. A policy that does not match the organization’s actual requirements can leave important information unavailable when it is needed.
Accidental deletion or overwriting
Employees do not need to be malicious to cause data loss. A deleted folder, overwritten document, or mistaken cleanup can remove information that the business still needs.
Compromised accounts
A compromised user or administrator account can result in intentional or accidental deletion, modification, or encryption of business data. Strong authentication and access controls should work together with backup and recovery.
What a Real Microsoft 365 Backup Includes
A Microsoft 365 backup strategy should provide more than simple access to deleted items. Depending on the solution, organizations may protect Exchange mailboxes, OneDrive accounts, SharePoint sites, and other Microsoft 365 workloads.
Look for point-in-time recovery, appropriate retention, protection against unwanted changes, and the ability to restore data efficiently. Microsoft’s own Microsoft 365 Backup service, for example, is designed to support recovery from deletion, overwriting, and encryption events. (Microsoft Learn)
The important question is: If critical data disappears today, can your team reliably restore it?
How to Choose a Microsoft 365 Backup Solution (Checklist)
Before selecting a solution, ask:
- What Microsoft 365 workloads are protected?
- How long are backups retained?
- Can individual mailboxes or files be restored?
- Can larger collections of data be restored after ransomware?
- Are backups protected from unauthorized changes?
- Where is backup data stored?
- Is restore testing included?
- Who monitors backup failures?
For organizations without dedicated IT staff, managed IT services can also provide ongoing monitoring and recovery planning instead of leaving backup management to an already busy employee.
Microsoft 365 Backup Pricing: What Does It Cost?
Microsoft 365 backup pricing varies by provider and by how much data is protected. Some third-party solutions charge per user, while Microsoft’s own Microsoft 365 Backup uses consumption-based pricing.
As of 2026, Microsoft lists its Microsoft 365 Backup service at $0.15 per GB per month of protected content. The actual cost depends on the amount of OneDrive, SharePoint, and mailbox data protected, including certain deleted and versioned content. (Microsoft Learn)
When comparing Microsoft 365 backup solutions, look at the total cost of protection, management, storage, retention, and recovery, not just the monthly license price.
How to Test a Restore and How Often
A backup that has never been tested is an assumption, not a recovery plan.
Organizations should periodically perform a controlled restore and verify that the recovered files, email, permissions, and other required information are usable.
A practical process is:
The appropriate testing schedule depends on the organization’s size, risk, and recovery requirements. The important part is making restore testing a planned business process rather than waiting for an actual data-loss event.
Your Questions, Answered
Does Microsoft 365 automatically back up my data?
Not in the traditional sense. Microsoft keeps its cloud infrastructure running and offers recycle bins, version history and retention policies. However, these features don’t give you an independent, long-term backup you control. Under Microsoft’s shared responsibility model, protecting your data is still your organization’s job.
How long does Microsoft 365 keep deleted emails and files?
It depends on the type of data:
- Deleted emails: recoverable for 14 days by default. Admins can extend this to 30 days.
- SharePoint and OneDrive files: stay in the recycle bin for up to 93 days.
- Deleted user accounts: can be restored for 30 days.
After these periods, the data may be gone for good unless you have a separate backup.
Is Microsoft 365 Backup included in my Microsoft 365 license?
No. Microsoft 365 Backup is a separate pay-as-you-go service and isn’t included in standard business plans. As of 2026, Microsoft lists it at $0.15 per GB per month of protected content. The total cost depends on how much OneDrive, SharePoint and Exchange data you protect.
Can OneDrive version history protect against ransomware?
Only partly. OneDrive version history and Files Restore can roll files back to an earlier point, usually within the last 30 days. But if ransomware goes unnoticed for longer, or the attacker gets admin access, these tools may not be enough. A separate backup with protected restore points is far more reliable.
Do small businesses really need a Microsoft 365 backup?
Yes, especially if email and files are critical to daily operations. Small businesses often have no dedicated IT staff to notice deleted accounts, misconfigured retention settings or ransomware in time. A managed Microsoft 365 backup with regular restore testing helps make sure you can actually recover data when something goes wrong.