Does Microsoft back up my data? Protecting Microsoft 365

Many companies assume that Microsoft backs up their data in Microsoft 365. That is only partly true. Microsoft makes sure the service keeps running and that no data is lost through a fault in its data centres. If someone deletes an email, ransomware encrypts OneDrive or an admin account is compromised, recovery is only possible within short time limits. A backup in the real sense is not part of the package.

Sources: Microsoft Learn, as of October 2026.

Does Microsoft back up my data in Microsoft 365?

Microsoft stores your data several times and in several locations. That protects against the failure of a data centre, not against mistakes and attacks inside your own tenant, your Microsoft 365 environment. If someone deletes an email, overwrites a file or ransomware encrypts documents, Microsoft reliably replicates that change to every location.

Microsoft describes the split as shared responsibility. Microsoft states explicitly that Exchange Online does not support traditional mailbox backups. It also does not provide point-in-time restore.

Shared responsibility in Microsoft 365

A backup is not part of what Microsoft takes care of.

1. Data, user accounts, settingsthe customer’s responsibility, in the cloud as wellYour job
2. Running the serviceMicrosoft’s responsibility, data stored several times in several locations

What Microsoft 365 keeps on its own

You are not working without any safety net. Microsoft 365 has recycle bins, version history and retention periods. They help with small mishaps that are noticed quickly:

These time limits do not always help. A mistake may go unnoticed for months, an attacker with admin rights may delete data or ransomware may overwrite every file version through OneDrive synchronisation. A retention policy or a litigation hold keeps content longer, but it is meant for evidence and legal purposes. Neither offers a quick restore in place.

Microsoft 365 Backup: Microsoft’s own backup

For some time now Microsoft has offered its own backup. Microsoft 365 Backup protects mailboxes, OneDrive and SharePoint and creates restore points very frequently. It is billed through an Azure subscription by data volume, and everything counts, including recycle bins, archives and deleted items. For small and medium-sized businesses this quickly becomes expensive, usually much more expensive than a solution billed per user.

Microsoft 365 Backup also has gaps: Teams chats, Planner and Entra ID are not covered. Users cannot restore their own data, and the backup stays inside Microsoft 365. For large environments that need very short recovery times this can make sense. For small and medium-sized businesses I usually recommend a third-party solution.

What matters in a Microsoft 365 backup

Almost every solution backs up mailboxes, OneDrive and SharePoint. The differences lie in the details, and those are what count when something goes wrong:

• Teams chats: Most solutions back up channel messages, but not all of them back up one-to-one and group chats. In many companies that is exactly where things get agreed.
• Planner and OneNote: Some solutions leave out task plans and notebooks entirely or only capture them as a link.
• Entra ID and Intune: Rebuilding users, groups, policies and device settings often takes longer than restoring the data itself. Only a few solutions include them.
• Separate storage: The backup should sit outside your tenant and be immutable. An attacker with admin access must not be able to delete it.
• Frequency and retention: Back up several times a day and keep backups at least as long as a mistake can go unnoticed. I recommend unlimited or multi-year retention.
• Storage location: For companies in Germany the storage location should be in the EU, ideally in Germany. A data processing agreement is needed in any case.
• Restore by employees: Someone who can bring back a deleted email themselves does not have to call IT and wait.

The solutions compared

These are the solutions I come across most often with clients. The information comes from the vendors’ documentation, as of October 2026.

What is backed up	Hornetsecurity	AvePoint	Veeam	Synology	Microsoft 365 Backup
Email, OneDrive, SharePoint	✓	✓	✓	✓	✓
Teams channels	✓	✓	✓	✓	–
Teams one-to-one and group chats	✓	✓	–	–	–
Planner	✓	✓	◐	–	–
Entra ID	◐	+	+	–	–
Intune	–	+	+	–	–
Stored separately from Microsoft	✓	✓	✓	✓	–

✓ included · ◐ partly (Hornetsecurity: users and groups; Veeam: Planner only as a tab in a Teams channel) · + with an add-on product (AvePoint Cloud Backup for IaaS + PaaS; Veeam Backup & Replication or Veeam Data Cloud) · – not included. As of October 2026, according to vendor documentation.

Which solution I use

For context: I am a partner of Hornetsecurity and AvePoint and resell their licences. Which solution I recommend depends on what the client needs and already has.

Most often I use Hornetsecurity, usually as 365 Total Protection Plan 3. Backup, email security and email archiving are then covered by one product, and I manage all clients in one console. What that looks like in day-to-day work is described in the article Hornetsecurity or Business Premium for email security.

I recommend AvePoint when SharePoint and Teams are at the centre: many teams, a lot of collaboration with external partners, sharing that nobody keeps track of any more. Then monitoring permissions is often just as important as the backup itself.

What the EWS shutdown means for your backup

Since 1 October 2026 Microsoft has been gradually switching off the old Exchange Web Services (EWS) interface in Exchange Online, for good on 1 April 2027. Many backup solutions used EWS to back up mailboxes and are now moving to Microsoft Graph. Depending on the product, this requires a new consent in the tenant. Without it, mailbox backups may quietly fail without anyone noticing. So check whether your backup has still been running completely since October.

How I proceed

1. Assessment: What is stored in your Microsoft 365, what is backed up today, and how far do the built-in time limits go?
2. Selection: I recommend a solution that suits how you work and send you a non-binding quote.
3. Setup: I set up the backup, define retention and notifications, and show your employees how to restore data themselves.
4. Test: A backup is only worth something once a restore has worked. So I finish with a test restore and check the backup regularly afterwards.

Frequently asked questions

Isn’t it enough that OneDrive syncs everything to the computer?

No. Synchronisation mirrors every change, including deletions and encryption by ransomware. It is a copy for convenient access, not a backup.

Is a litigation hold a backup?

Only to a limited extent. A litigation hold, included in Business Premium, prevents mailbox content from being permanently deleted. But it can only be retrieved through a search and an export, not with a few clicks in place. It does not apply to OneDrive, SharePoint or Teams.

What does a Microsoft 365 backup cost?

It depends on the number of Microsoft 365 users and which data needs backing up. Email security and archiving also affect the choice. Third-party solutions are billed per user, usually with storage included. Microsoft 365 Backup is billed by data volume and is usually considerably more expensive for small businesses. In a free consultation I clarify your requirements and then send you a non-binding quote.

How long should backups be kept?

As long as a mistake can go unnoticed, and at least one year. The solutions from Hornetsecurity and AvePoint allow unlimited retention without extra charges for storage.

Sources

• Time limits in Exchange Online: Microsoft Learn – Recoverable Items folder in Exchange Online, Microsoft Learn – Back up email in Exchange Online (as of October 2026)
• SharePoint and OneDrive recycle bin, Restore files: Microsoft Learn – Restore deleted items from the site collection recycle bin, Microsoft Learn – SharePoint and OneDrive data resiliency (as of October 2026)
• Deleted users and OneDrive: Microsoft Learn – Restore a user, Microsoft Learn – Set the OneDrive retention for deleted users (as of October 2026)
• Teams chats: Microsoft Learn – Learn about retention for Microsoft Teams (as of October 2026)
• Shared responsibility: Microsoft Learn – Shared responsibility in the cloud, Microsoft Learn – Microsoft 365 Backup FAQ (as of October 2026)
• Microsoft 365 Backup: Microsoft Learn – Overview of Microsoft 365 Backup, Microsoft Learn – Microsoft 365 Backup pricing (as of October 2026)
• Hornetsecurity: Hornetsecurity – 365 Total Backup, Hornetsecurity – Release notes 16 February 2026 (Entra ID), 365 Total Backup data sheet (PDF, German), Hornetsecurity – Storage regions for backup (German) (as of October 2026)
• AvePoint: AvePoint Learn – Cloud Backup for Microsoft 365, AvePoint – Policies for Microsoft 365, AvePoint Learn – Data centres (as of October 2026)
• Veeam: Veeam Help Center – Supported objects, Veeam Help Center – Considerations and limitations, Veeam Data Cloud for Microsoft 365 (as of October 2026)
• Synology: Synology – Active Backup for Microsoft 365, specifications, Synology – EWS migration (as of October 2026)
• EWS shutdown: Microsoft Learn – Deprecation of Exchange Web Services in Exchange Online (as of October 2026)