Microsoft 365 Backup: Why Retention Alone Is Not Enough
Your emails, files, SharePoint sites and Teams data may be recoverable today.
The real question is whether they would still be recoverable next month after a ransomware attack, accidental deletion or compromised account.
Microsoft provides retention and recovery tools. A backup gives you a separate copy of your data and the ability to restore it when things go wrong.
Microsoft 365 keeps the service running. Backup gets your data back.
Retention, recycle bins and version history are useful, but they are not the same as a proper Microsoft 365 backup.
If emails, OneDrive files, SharePoint sites or Teams data are deleted, encrypted or changed, you need to know what can actually be restored.
Retention gives you a window
Microsoft 365 retention can help recover deleted or changed items within set limits. Useful, but not the same as a full backup.
Backup gives you a copy
A proper backup keeps a separate copy of your data and lets you restore to a specific point in time.
Recovery needs testing
A backup is only useful if it restores. That means checking Exchange, OneDrive, SharePoint and Teams before an incident.
Do you need Microsoft 365 backup?
Usually, yes.
Microsoft 365 includes useful retention and recovery features, but they are not designed to replace a dedicated backup solution. The difference matters when data has been deleted, encrypted, corrupted or changed weeks or months ago.
Where the confusion comes from
Most people hear “cloud” and assume backup is included.
Microsoft does protect the Microsoft 365 service. It runs the infrastructure, keeps the platform available and replicates data across data centres.
That protects against Microsoft-side failure. It does not automatically protect your business from accidental deletion, ransomware, malicious insiders, misconfigured retention policies or account compromise.
Retention vs backup
Retention keeps information inside Microsoft 365 for a defined period.
Backup creates a separate recoverable copy of your data.
| Scenario | Retention | Backup |
|---|---|---|
| User deletes a single email | Usually, within the retention window | Yes |
| User empties deleted items | Sometimes, depending on policy | Yes |
| Ransomware encrypts OneDrive or SharePoint files | Limited. Version history may help | Yes |
| Admin deletes a SharePoint site | Limited recovery window | Yes |
| Restore to a specific point in time | No | Yes |
| Recover after a serious tenant compromise | No | Yes, if properly configured |
What Microsoft is responsible for
Microsoft’s shared responsibility model is the bit many businesses miss.
Microsoft is responsible for the Microsoft 365 platform. Your organisation is responsible for its users, access, configuration, retention settings and data recovery.
You can read Microsoft’s own explanation here: Microsoft shared responsibility in the cloud .
Microsoft protects the service. You protect the data.
What happens during a real incident?
Most Microsoft 365 data loss is not caused by Microsoft.
It is usually caused by normal business problems:
- A member of staff deletes an important folder.
- A departing employee removes files before leaving.
- A compromised account deletes or changes data.
- Ransomware encrypts SharePoint and OneDrive files.
- An admin removes the wrong Microsoft 365 group or SharePoint site.
At that point, the question is not “is Microsoft 365 online?”
The question is: Can we get our data back exactly as it was before the incident?
Does Microsoft offer backup?
Yes. Microsoft has its own paid Microsoft 365 Backup product.
It can be useful for some organisations, but it is not bundled into standard Microsoft 365 subscriptions. It is a separate service with its own pricing and limitations.
Many small businesses still choose a specialist third-party Microsoft 365 backup product because they want predictable pricing, separate storage, longer retention and more flexible restore options.
At Black Swan Cyber Security Solutions, we typically recommend solutions based on your recovery requirements, compliance needs and budget. This may include ConnectWise Cloud Backup, Redstor or Axcient x360Cloud.
What good Microsoft 365 backup looks like
Different backup platforms take different approaches. Some organisations prefer the simplicity of ConnectWise Cloud Backup, others need the flexibility of Redstor, while businesses looking for wider cloud backup coverage may choose Axcient x360Cloud.
A backup is only useful if it restores
This is the bit that often gets missed.
You cannot trust a backup just because a dashboard says it is green. You need to test it.
We recommend testing Microsoft 365 restores at least quarterly using real examples from Exchange, OneDrive, SharePoint and Teams.
When is retention enough?
For some very small organisations, retention may cover most day-to-day risks.
That might be true if you have very little data, low staff turnover, no regulated information and a clear retention policy.
The risk changes when your organisation grows, stores sensitive data, relies heavily on Microsoft 365, or needs to prove it can recover after a cyber incident.
Three questions worth asking
- If someone deleted everything in their OneDrive a year ago, could you restore it today?
- If ransomware encrypted your SharePoint sites tomorrow, what would you restore from?
- When did you last test a Microsoft 365 restore properly?
If the answers are “probably not”, “not sure” or “we haven’t”, retention may be doing a job that backup should be doing.
Which Microsoft 365 backup solution is right for your organisation?
There is no single best Microsoft 365 backup platform. The right choice depends on your budget, recovery objectives, compliance requirements and existing IT environment.
A straightforward managed Microsoft 365 backup option for Exchange, OneDrive, SharePoint and Teams.
Learn more →A strong option where Microsoft 365 backup needs to sit alongside broader cloud data protection.
Learn more →Useful for Microsoft 365, Google Workspace and shared cloud data backup, search and restore.
Learn more →Backup is about resilience, not just technology
Most organisations do not discover the value of backup until they need it.
Whether the cause is ransomware, accidental deletion, a disgruntled employee or a simple mistake, recovery is ultimately a business issue rather than a technical one.
This is one reason why recovery planning fits naturally with SMB1001 certification and why many organisations pursuing Cyber Essentials also review their backup and recovery arrangements.
Good cyber security reduces risk. Good backups reduce consequences.
If you are not sure whether SMB1001 or Cyber Essentials is the better starting point, we can help you compare both routes in plain English.
Microsoft 365 retention vs backup FAQs
Does Microsoft 365 include backup?
Microsoft 365 includes retention and recovery features, but dedicated backup is not included in most standard Microsoft 365 subscriptions. Microsoft also offers a separate paid backup product.
What is the difference between retention and backup?
Retention keeps data for a defined period inside Microsoft 365. Backup creates a separate recoverable copy that can be restored to a chosen point in time.
Can Microsoft recover permanently deleted emails?
Sometimes, depending on your retention settings and recovery window. Once data has aged out of retention, recovery may not be possible without a backup.
Does Microsoft 365 backup protect SharePoint and OneDrive?
A proper Microsoft 365 backup should protect Exchange Online, OneDrive, SharePoint and Teams-related data.
Do small businesses need Microsoft 365 backup?
Many do. If your business relies on Microsoft 365 for email, files, client work, compliance or daily operations, backup is worth serious consideration.
Does backup help with Cyber Essentials or SMB1001?
Backup is not a replacement for security controls, but it supports resilience, recovery planning and evidence of sensible risk management. That makes it relevant when reviewing Cyber Essentials, SMB1001, cyber insurance and client assurance requirements.
Want to know what your Microsoft 365 setup can actually recover?
We can check your current Microsoft 365 retention and backup position, then produce a simple one-page recovery map covering Exchange, OneDrive, SharePoint and Teams.
No scare tactics. No jargon. Just a clear view of what happens if you need your data back.