Does Microsoft 365 Back Up Your Data? Backup vs Retention and Litigation Hold

No, not in the way most business owners assume. Microsoft is responsible for keeping the Microsoft 365 service running, but responsibility for your data — protecting it from accidental deletion, corruption, ransomware or a rogue member of staff — sits with you.

This is one of the most common misunderstandings we come across when we talk to businesses in Hertfordshire and North London about their IT setup. People assume that because their email, SharePoint and OneDrive live "in the cloud," Microsoft must be backing it all up somewhere. It's an easy assumption to make, and it's wrong — and it matters, because the gap only becomes visible after something has already gone wrong.

The shared responsibility model

Microsoft is very clear about this in its own documentation, even if it doesn't shout about it. Microsoft's role is to guarantee the availability, security and resilience of the Microsoft 365 platform — the data centres, the uptime, the underlying infrastructure. Your role, as the customer, is to look after the data you put into that platform. Microsoft calls this the shared responsibility model, and it applies across Exchange Online, SharePoint Online, OneDrive and Teams.

In practice this means:

• If Microsoft has an outage, that's their problem to fix.
• If an employee deletes a folder of client files, or a phishing email leads to files being encrypted, or someone accidentally overwrites a spreadsheet that hasn't been touched in years — that's your problem.

What Microsoft 365 actually gives you

Microsoft 365 does include some data protection features, and it's worth understanding what they do and don't cover.

Recycle bins and version history

Deleted items in Exchange, SharePoint and OneDrive typically sit in a recycle bin for a limited period (commonly around 93 days, though Microsoft can and does adjust these defaults, so it's worth checking current guidance on learn.microsoft.com rather than relying on a fixed number). SharePoint and OneDrive also keep file version history. These are useful safety nets for quick "I deleted the wrong file yesterday" situations, but they are not backup — they have fixed retention windows, they can be emptied or exceeded, and they don't protect against every kind of data loss.

Retention policies

Retention policies (configured in Microsoft Purview) let you say "keep everything in this mailbox or site for X years" or "delete anything older than Y." They're a compliance and information-governance tool, not a backup tool. Retention preserves data for a set period, in place, largely for legal and regulatory reasons — it isn't designed to let you restore your entire tenant to a point in time last Tuesday.

Litigation hold

Litigation hold (and the related "preservation hold") is narrower still. It's designed to preserve mailbox content that might be relevant to litigation or an investigation, and it stops that content being permanently deleted even if a user or admin tries to remove it. It's a legal safeguard, not a disaster recovery mechanism, and it's usually applied to specific mailboxes for a specific reason rather than as blanket protection for the business.

Why the difference matters

Feature	Purpose	Protects against accidental deletion?	Protects against ransomware/corruption?	Point-in-time restore?
Recycle bin / version history	Short-term undo	Partially, within time limits	Limited	No
Retention policy	Compliance / governance	No	No	No
Litigation hold	Legal preservation	No	No	No
Third-party backup	Data protection	Yes	Yes	Yes

If a member of staff falls for a phishing email and a piece of malware starts working through a OneDrive-synced folder, retention and litigation hold won't help you recover clean copies of everything that was affected. A proper backup, taken regularly and stored independently of the live Microsoft 365 environment, will.

A worked example

Imagine a 20-person accountancy firm using SharePoint for client files. A well-meaning member of staff "tidies up" a document library and permanently deletes a folder, then empties it from the recycle bin without realising what was in it. Three months later, someone asks for a document from that folder. Without a backup that goes back further than the SharePoint recycle bin window, that data may simply be gone — and the firm may only find out at the worst possible moment, in front of a client.

What we recommend

In our experience, most SMEs using Microsoft 365 benefit from adding a dedicated backup solution that:

1. Takes regular, independent copies of Exchange, SharePoint, OneDrive and Teams data.
2. Stores those copies outside the live Microsoft 365 tenant, so a tenant-wide problem doesn't take out the backup too.
3. Allows restoration of individual files, whole mailboxes, or a point-in-time snapshot.
4. Retains data for a period that matches your business, legal and insurance needs — not just Microsoft's defaults.

This sits alongside, not instead of, good configuration of Microsoft's native tools such as version history and retention policies for compliance purposes. Get the licensing tier right too — our guide to Business Standard vs Business Premium covers where backup and security features sit across the plans.

Common mistakes

• Assuming "it's in the cloud" means "it's backed up."
• Confusing litigation hold with backup because both involve "keeping" data.
• Relying solely on the SharePoint or OneDrive recycle bin, which has a fixed window and can be bypassed.
• Not testing restores — a backup you've never tried to restore from is a hope, not a plan.

Related questions

• SharePoint in the browser vs OneDrive/File Explorer: which should your team use?
• Microsoft 365 Business Standard vs Business Premium
• Is Microsoft Defender enough for a small business?

If you're not sure what's actually protecting your Microsoft 365 data today, it's worth finding out before you need it. Our Microsoft 365 team can review your current setup, or you can get in touch to talk it through.