Microsoft 365 backup: what Microsoft covers, and what you do

If you're trying to work out whether Microsoft 365 already backs up your data, the most useful document Microsoft publishes on the question isn't written as an answer to it. Microsoft's Service Assurance page on data resiliency describes what Microsoft does to keep OneDrive, SharePoint, and Exchange Online running when infrastructure fails — not what happens when your own admin deletes the wrong site, a departing employee empties a mailbox on the way out, or ransomware syncs encrypted files across a OneDrive account. Those are different problems. This post draws the line between them using only Microsoft's own documentation — resiliency, shared responsibility, subscription-end retention, and what Microsoft 365 Backup covers, restores, and costs.

What "data resiliency" actually protects

Microsoft's Service Assurance documentation opens with a design philosophy, not a feature list: "Microsoft is mindful that it's not a case of if things go wrong, but rather when." Most of its five resiliency principles — separating customer data across fault zones and datacenters, protecting data from corruption — describe protection against Microsoft's own infrastructure failing, not against a customer's own actions. The one that does address customer-caused loss is stated plainly: "Most data loss results from customer actions, so allow customers to recover on their own by using a GUI that enables them to restore accidentally deleted items." That's the built-in answer — a self-service recycle bin and version history reached through the product's own interface. It's real, but it's a different thing from an admin restoring an entire mailbox, site, or OneDrive account to a chosen point in time across a whole organization at once, which is what a ransomware attack or a malicious insider actually requires.

Whose responsibility is your data, exactly?

Microsoft's Azure shared-responsibility documentation — general cloud guidance that lists Microsoft 365 as an example of software as a service (SaaS) — answers this directly. Microsoft 365 is, in our own words, a SaaS product; in that matrix — across every deployment type — "Customer data," "Configurations and settings," and "Identities and users" sit on the customer's row, not Microsoft's: "For all cloud deployment types, you own your data and identities. You're responsible for protecting the security of your data and identities, on-premises resources, and the cloud components you control." Microsoft's own FAQ for Microsoft 365 Backup confirms shipping a backup product didn't change that. Asked "Has Microsoft's stance on shared responsibility of data protection changed?" it answers: "No, we still have the same point of view, but are now offering more tools to help organizations achieve those goals and responsibilities." Backup is a tool for a responsibility that was already yours — not a change in whose job it is.

What happens to your data if the subscription ends

Microsoft's data retention, deletion, and destruction documentation describes a subscription ending as a "Passive Deletion" scenario, distinct from "Active Deletion" (a user or admin deleting data while the subscription is active, where Customer Content is retained "at most 30 days"). For passive deletion, Customer Content retention is "at most 180 days," and Microsoft spells out the mechanics: "If a paid subscription ends or is terminated, Microsoft retains customer data stored in Microsoft 365 in a limited-function account for 90 days to enable the subscriber to extract the data. After the 90-day retention period ends, Microsoft disables the account and deletes the customer data. No more than 180 days after expiration or termination of a subscription to Microsoft 365, Microsoft disables the account and deletes all customer data from the account." Once that window closes, the data is "rendered commercially unrecoverable" — Microsoft's default policy for what happens after you stop paying, not a substitute for a recovery window you chose.

Microsoft 365 Backup: what it covers

Microsoft's overview page describes Microsoft 365 Backup as covering "all or select SharePoint sites, OneDrive accounts, and Exchange mailboxes," with backup granularity at the level of a OneDrive account, a SharePoint site, or an Exchange user account. The recovery window is configurable per policy at 3 months, 6 months, 1 year, or 2 years (existing policies default to 1 year). Recovery points: OneDrive and SharePoint get 10 minutes for the trailing two weeks, then weekly snapshots from 2 to 52 weeks back; Exchange gets 10 minutes across the entire prior 52 weeks — those figures cover full-account and full-site restore. Granular file-and-folder restore points run on a separate cadence: "(Roughly) Daily," per Microsoft's restore page.

Granular file-and-folder restore for OneDrive and SharePoint — browsing and searching a restore point for specific files and folders — is now generally available per Microsoft's restore page (updated September 2, 2026). Microsoft's overview page (updated August 21, 2026) hasn't caught up — its table still lists file restore as "coming soon"; we're going with the newer page. Restoring to the same URL rolls back to the prior state, "overwriting all content and metadata since that prior point in time" — a true rollback; a new URL instead copies data back without overwriting what's currently live. Exchange restores full or item-level and touches only modified or deleted items — unchanged and new items "aren't restored, reverted, or overwritten." Drafts aren't backed up or restorable, and items already moved to Deleted Items aren't restored by Backup — the mailbox owner can move those back themselves.

Isolation, immutability, and who can delete a backup

Backups use append-only storage: SharePoint "can only add new content blobs and can never change old ones until they're permanently deleted," and Exchange items likewise "can't be accessed by a client process (such as Outlook, OWA, or MFCMAPI)." Microsoft's own definition: "Immutability is formally defined as storage that can't be altered, deleted, or overwritten for a specified period of time. Microsoft 365 Backup follows that definition except for disallowing deletion" — deletion is possible only by the "Backup tool admin via product offboarding," with three built-in defenses: a 90-day recovery grace period after offboarding, retention/deletion policies such as Purview that don't affect the backup recovery window, and a multi-admin notification on any potentially harmful action. On testing: "You should limit restores for testing purposes to no more than twice a month per protection unit." Restore session history is retained for 366 days.

What it costs

Per Microsoft's pricing page, as of September 18, 2026, Backup is a pay-as-you-go, consumption-based service at a list price of $0.15 per GB per month of protected content. Microsoft's overview page states separately that "Restores are free." Billed storage sums live data (OneDrive/SharePoint size including the first-stage recycle bin; live mailbox size including any online archive) plus deleted and versioned data held for recovery. Example given: a 1-GB site with 0.5 GB in its second-stage recycle bin, plus a 1-GB mailbox with a 1-GB online archive, bills as 3.5 GB. Using a partner (ISV) application instead of the first-party tool, "you'll be charged solely by them for their application. You won't receive a separate bill or charge directly from Microsoft for the Backup Storage consumption."

When a third-party tool may fit better

Three boundaries come from Microsoft's own scope statements, not from comparison to any specific alternative. Recovery window options top out at 2 years — a longer retention requirement sits outside the policy options listed. Microsoft's own coverage statement names three workloads — SharePoint sites, OneDrive accounts, Exchange mailboxes — worth checking against, not assuming, whatever else needs protecting. And there are gaps within those workloads: five unsupported SharePoint site templates (SharePoint Embedded container, Review Center, Policy Center, Tenant admin site, MySite Host), plus draft mailbox items and anything already in Deleted Items, all fall outside what Backup restores.

We don't resell backup software, Microsoft's or anyone else's. We configure whichever tool fits your retention window, covered workloads, and admin/deletion controls — Microsoft 365 Backup or a third-party tool you choose.

Questions to decide before you pick either

• What must be restorable — a whole mailbox or site, or specific files and items?
• How far back — inside Microsoft 365 Backup's 3-month-to-2-year window, or beyond it?
• Who can delete a backup, and would you know? Backup restricts deletion to the tool admin via offboarding, with a 90-day grace period and a multi-admin notification.
• When was your last test restore? Microsoft permits testing restores up to twice a month per protection unit — an unused allowance isn't a tested one.

Related reading

Two related posts worth a look before you decide:

• Cyber-insurance readiness for the mid-market (2026) — recoverability is a question underwriters ask.
• Microsoft 365 outage, August 2026: what the SLA pays — an uptime credit and a data restore are different things, under different agreements.
• Backup & disaster recovery implementation service page.

Sources

• Microsoft Learn — Overview of Microsoft 365 Backup
• Microsoft Learn — Frequently asked questions about Microsoft 365 Backup
• Microsoft Learn — Pricing model for Microsoft 365 Backup
• Microsoft Learn — Restore data in Microsoft 365 Backup
• Microsoft Learn — Data resiliency in Microsoft 365 (Service Assurance)
• Microsoft Learn — Data retention, deletion, and destruction in Microsoft 365 (Service Assurance)
• Microsoft Learn — Shared responsibility in the cloud

The 30-second version

Resiliency protects against infrastructure failure; customer-caused loss is meant to be self-recovered through the recycle bin and version history, not an admin-orchestrated rollback. "Customer data" sits on your side of the shared-responsibility matrix, and Backup is "more tools," not a shift in whose job it is. Cancel a subscription and Microsoft retains data in a limited-function account for 90 days, then disables the account and deletes the data — no more than 180 days after termination in any case — after which it's commercially unrecoverable. Microsoft 365 Backup covers SharePoint, OneDrive, and Exchange, with a 3-month-to-2-year recovery window, 10-minute-to-weekly recovery points for full-account/site restore (granular file-and-folder restore points run roughly daily), append-only storage deletable only by the Backup admin, and pay-as-you-go billing at $0.15/GB/month with free restores. Outside those boundaries, a third-party tool may fit better.

If you want help deciding which one, and configuring it, the project intake form takes about three minutes.

We don't resell hardware or software. When a project needs procurement, we recommend the right products, work with the vendor of your choice on quoting, and handle install, configuration, and integration. No margin in either direction. This post reflects Microsoft's published documentation as of September 18, 2026.