In summary
No, Microsoft does not back up your Microsoft 365 data. This is one of the most dangerous misconceptions in business IT. Microsoft operates on a «shared responsibility model»: it guarantees platform availability, but The responsibility for protecting your data lies with you.. The native recycle bins and retention policies (14 to 93 days depending on the service) are not backups: they are temporary, limited and can be emptied by ransomware or a malicious employee.
- Microsoft spells it out in black and white in its service agreement: back up your data with third-party applications.
- The Exchange recycle bin retains items for 14 to 30 days; the SharePoint and OneDrive recycle bin retains items for 93 days. After this, the data is permanently deleted.
- Geographic redundancy protects against a datacenter failure, not against deletion or encryption.
- Human error is the primary cause of data loss; ransomware, which empties the recycling bins first, is the second.
- The correct answer: an independent, immutable, off-platform third-party backup, with point-in-time restore.
The common misconception that proves costly: «It's in the cloud, so it's backed up»
Most companies that use Microsoft 365 They assume that their data is fully protected by Microsoft. This is one of the most widespread – and riskiest – misunderstandings in cloud computing.
The reality: Microsoft operates on a shared responsibility model, and the protection of your actual data is your responsibility, not theirs. If a collaborator permanently deletes a critical SharePoint library, if ransomware encrypts your Exchange mailboxes, or if a departing employee erases their OneDrive, Microsoft has no obligation to recover this data for you.
It's not a lack of platform reliability. It's simply that Availability and recoverability are two fundamentally different things. Microsoft guarantees the first; the second is yours.
Quel est le modèle de responsabilité partagée ?
The shared responsibility model means that Microsoft manages the platform's infrastructure and availability, while the customer is responsible for protecting their data within it. Concretely, the border is broken down as follows:
| Microsoft is responsible for… | You are responsible for… |
|---|---|
| The physical and logical infrastructure | Backing up and restoring your data |
| Service availability | Identity and Access Management (MFA, conditional access) |
| Redundancy between datacentres | The configuration of compliance and retention |
| Platform certifications | External sharing governance and endpoint security |
This breakdown covers the five Microsoft 365 workloads: Exchange (email), SharePoint (sites and documents), OneDrive (personal files), Teams (conversations and files) and Entra ID (identities). Teams and Entra ID are also the most often forgotten in protection strategies.
The most telling: Microsoft itself recommends it. The Microsoft Services Agreement explicitly states to regularly back up your content using third-party applications and services.
What Microsoft really keeps (and for how long)
Microsoft 365 includes native retention features, but they are limited in scope and duration. Here are the actual windows before permanent deletion:
Native retention period before permanent deletion
Number of days files are kept in the recycle bin, by department
Beyond these windows, the data is permanently purged – including for Microsoft support.
The recycle bin is a short-term safety net for recent «oops, I deleted that by mistake» moments. This is not a backup. When an employee leaves, mailbox data is deleted after 30 days, and OneDrive data is retained for 30 days by default for the administrator.
Why native retention is NOT a backup
1. Retention is temporary; backup is durable
After the window expires (14 to 93 days), Microsoft deletes the content from its systems. A backup creates independent copies, which can be kept for years and restored to a specific point in time.
2. Replication is not a backup
Microsoft's geographic redundancy protects against datacenter failure. But deleted or corrupted data is replicated as deleted or corrupted across all copies within minutes. Redundancy does not protect you from human error, ransomware, or misconfiguration.
3. The bin can be emptied
It can be done accidentally… or intentionally. During a ransomware attack, emptying the recycle bins is one of the attackers« first actions. A malicious employee who »double-deletes" the content eliminates any native recourse.
The 4 scenarios that Microsoft does not cover
Accidental deletion
The most frequent scenario. A user deletes a mailbox, a site, or a folder without measuring the consequences. Anything outside the retention window is lost. Human error remains the primary cause of data incidents.
Ransomware
It spreads via OneDrive and SharePoint synchronisation and can deplete version history. Retention then preserves the encrypted version. Only a backup allows a return to a healthy, unencrypted state.
An employee's departure
License removal, account deleted: data disappears within short windows. Without a rigorous offboarding process or backup, company knowledge leaves with the employee.
The incorrect configuration
Retention policies are complex. A rule conflict or an accidental purge can delete data necessary for a compliance audit – and that will be your problem, not Microsoft's.
What you risk in concrete terms
A colleague has lost a week's worth of deleted emails and has to manually reconstruct their correspondence.
A project document library is mistakenly deleted and discovered after the 93-day window — permanently lost.
One ransomware encrypts Exchange boxes and synchronised files, without a clean restore point. Operations stop, every minute of downtime is costly.
In Belgium, certain obligations (GDPR, sectoral requirements, NIS2impose retention periods that Microsoft's default settings do not cover.
The solution: a real backup strategy
The good practice of reference is the rule 3-2-1 three copies of your data, on two different types of media, including one off-site copy — in the case of the cloud, on a different cloud from your primary data.
A Microsoft 365 backup solution suited to an SME must offer:
- A Full coverage of the five workloads: Exchange, SharePoint, OneDrive, Teams and Entra ID.
- One independent and immutable storage (off Microsoft platform), protected from ransomware encryption.
- A Granular and at a specific point in time restoration : from a simple email to the entire tenant.
- A long-term retention, configurable according to your regulatory obligations.
- Some Regular restore tests A backup is only as good as its ability to be restored.
Good to know: Microsoft has launched its own product, «Microsoft 365 Backup». In 2026, it still only covers some workloads and has notable retention and granularity limitations compared to specialised third-party solutions. It does not, on its own, fulfil your share of the shared responsibility model.
How GVISION protects your Microsoft 365 data
At GVISION, we deploy for Brussels and Belgian SMEs Microsoft 365 standalone backup solutions, covering all your workloads, with immutable storage and granular restoration. We regularly set up, monitor, and test restorations — so that the day you need them, they really work.
Beyond the tool, we help you define the strategy tailored to your size, your sector, and your compliance obligations: what needs to be backed up, how long to keep it, and how quickly you need to be able to restore it.
Are your Microsoft 365 data truly backed up?
Enjoy our free audit: we'll check your real exposure and propose a clear roadmap, without jargon and without commitment.
Request my free audit Contact usFAQ — Microsoft 365 Backup
Does Microsoft back up my Microsoft 365 data?
Is Microsoft 365 retention the same as a backup?
How long does Microsoft keep deleted emails and files?
Do the recycle bin or version history protect against ransomware?
Do I need a backup if I already have Microsoft 365 Backup from Microsoft?
La première cause de perte de données dans Microsoft 365 est la suppression accidentelle par les utilisateurs.
This article is for informational purposes only. Microsoft 365 retention windows and features are evolving; the information reflects the state of the platform in 2026. Sources: Microsoft documentation and service agreement, Microsoft 365 shared responsibility model. For an assessment of your situation, please contact our experts.
French
Dutch
English