How to Set Up Microsoft 365 Backup
- Sam Williams
- Mar 29
- 2 min read
Here's something most businesses don't realise: Microsoft 365 does not back up your data. If someone permanently deletes files, if a malicious script wipes a mailbox, or if ransomware encrypts your SharePoint — Microsoft's retention policies have limits, and after those limits, the data is gone.
This catches a lot of businesses off guard. Here's what's actually covered and how to protect yourself.
What Microsoft's retention covers
Deleted emails stay in the Recoverable Items folder for 14 days (configurable up to 30). After that, they're gone unless you have retention policies or litigation hold.
OneDrive keeps deleted files in the recycle bin for 93 days. After that, gone.
SharePoint recycle bin holds deleted items for 93 days. Version history keeps old versions of files, but only if versioning is enabled.
Teams chat is retained but can't be granularly restored to a specific point in time.
None of this is a backup. It's retention. There's a difference. Retention means Microsoft keeps deleted stuff for a while. Backup means you have an independent copy that you can restore from at any point.
Why you need proper backup
Accidental deletion beyond the retention window. Someone cleans out their mailbox and realises three months later they need an email that's gone.
Ransomware that encrypts your SharePoint files. Version history might help, but restoring thousands of files to previous versions is painful and sometimes impossible.
A departing employee who deletes everything before they leave. If you don't catch it within the retention window, it's gone.
Compliance. Many Australian regulations and insurance policies require you to retain data for years, with the ability to restore specific items.
Backup options
Third-party backup tools are the standard approach. Popular options for M365 include:
Veeam for Microsoft 365 — widely used, backs up Exchange, SharePoint, OneDrive, and Teams.
AvePoint — strong in SharePoint and governance-heavy environments.
Acronis — good for businesses that also need endpoint backup.
Datto SaaS Protection — popular with MSPs for managed backup.
What to back up
At minimum: Exchange mailboxes, OneDrive files, SharePoint sites, and Teams data.
Set daily backups with at least 12 months of retention. Some industries need longer.
Store the backups somewhere separate from Microsoft 365 — if your M365 tenant is compromised, you need your backups to be independent. Most third-party tools handle this by storing in their own cloud or your own Azure storage.
Test your restores
A backup you've never tested is not a backup. Once a quarter, pick a random mailbox and a random SharePoint file and restore them. Make sure it actually works.
Document your recovery process so that anyone on the team can do it in an emergency, not just the one person who set it up.
We include M365 backup as part of our managed services. If you're not currently backing up your M365 data, it's one of the quickest wins you can get. Reach out and we'll set it up.
