Microsoft 365 Backup: what Microsoft secures and what it does not

Microsoft secures your data with the standard functions of Microsoft 365, that is, Recycle Bin, file versions, and retention policies, only to a limited extent and explicitly not in the sense of a complete backup. A true backup with long-term recovery independent of deletion policies is only offered by the separate, paid service Microsoft 365 Backup. Without this additional service, deleted SharePoint and OneDrive contents end up in the Recycle Bin after at most 93 days and are permanently deleted, and Microsoft explicitly explains in its own FAQs why standard versions, disaster recovery, and legal holds do not replace a true backup. As of August 2026.

What does Microsoft 365 Backup cover, and what does the service cost?

According to the product overview, Microsoft 365 Backup secures SharePoint sites, OneDrive accounts, and Exchange Online mailboxes with a retention period of one year each. Billing is usage-based at 0.15 US dollars per protected gigabyte per month, and restores themselves are free; it is therefore a pay-as-you-go model rather than a traditional per-user license. For OneDrive and SharePoint, recovery points are spaced ten minutes apart for the past two weeks, followed by weekly recovery points for up to 52 weeks back, while for Exchange Online the ten-minute interval applies for the full 52 weeks.

What happens to deleted data without the additional Backup service?

Without Microsoft 365 Backup, deleted SharePoint contents initially end up in the site Recycle Bin, from which they are permanently deleted after a total of 93 days across both Recycle Bin stages. For OneDrive accounts of deleted users, the standard retention is 30 days, which administrators can adjust to a value between 30 and 3,650 days. These time limits run independently of Microsoft 365 Backup and are the real reason why many companies only realize after an actual data loss that the standard Recycle Bin is not a backup replacement.

Why does Microsoft say file versions and disaster recovery are not sufficient as backup?

Microsoft addresses this in the FAQ for Microsoft 365 Backup with three clear distinctions. A disaster recovery copy holds only the current state of contents, not historical versions from the past. File versions do allow individual users to restore earlier states, but do not scale for a large-scale recovery case coordinated by an administrator and can be exhausted prematurely by a version limit set by the administrator. Legal holds, in turn, are optimized for export, for example within the context of eDiscovery, not for mass recovery. When asked whether Microsoft's fundamental position on shared responsibility for data protection has changed, Microsoft responds in the FAQ that the position remains unchanged, there are simply now more tools available to meet this responsibility.

How independent is the backup from deletion policies and deleted accounts?

According to Microsoft, retention and deletion policies from Microsoft Purview do not affect backup retention; it remains completely isolated from such policies and follows exclusively its own backup policy, which is fixed at one year. Additionally, there is a 90-day recovery period during which existing backups can still be restored after offboarding the service. If a user account is deleted in Microsoft Entra ID, the backup of the OneDrive account or mailbox according to the FAQ still remains for one year from the creation date of the respective backup. For companies that are already reworking their Microsoft 365 environment as part of a larger automation consulting initiative, it makes sense to review the backup strategy at the same time rather than catching up on it separately.

Frequently asked questions about Microsoft 365 Backup

What does Microsoft 365 Backup cost?

The service costs 0.15 US dollars per gigabyte of protected data per month for OneDrive, SharePoint, and Exchange Online, and restores themselves are free. It is a usage-based pay-as-you-go model, not a traditional per-user license.

Is the SharePoint Recycle Bin sufficient as a replacement for a true backup?

No. The site Recycle Bin holds deleted contents for a total of 93 days across both stages, after which they are gone forever. Unlike Microsoft 365 Backup, the Recycle Bin also does not provide administrator-coordinated recovery of large amounts of data after a ransomware incident.

Can I secure every SharePoint site with Microsoft 365 Backup?

No. According to Microsoft, some templates are excluded, including SharePoint Embedded containers, the Review Center, the Policy Center, the Tenant Admin site, and the MySite Host. However, most regular SharePoint templates are supported.

What happens to the backup when a user account is deleted?

If a user is deleted from Microsoft Entra ID, the associated OneDrive or mailbox backup according to Microsoft still remains for one year from the creation date of the respective backup. For Exchange, the affected mailbox can be reactivated via the inactive mailbox recovery process as long as the backup policy continues to run.