Does Microsoft 365 back up our email and files, or do we need our own backup?
Short answer
Microsoft keeps the service running and holds deleted items for a limited time, but that isn't the same as a backup you control. If files are deleted past the retention window, encrypted by ransomware, or wiped by a departing employee, you need a separate backup. Microsoft now offers one as an add-on, and third-party options exist.
This is one of the most common misunderstandings about Microsoft 365. Microsoft is responsible for keeping the service available. You're responsible for your data.
What Microsoft does
- Keeps its data centers redundant, so an outage doesn't lose your data
- Keeps deleted email and files recoverable for a limited retention period
What it doesn't cover on its own
- Restoring data deleted beyond the retention window
- Rolling back everything after ransomware or a malicious insider
- Keeping a copy after an employee's account is removed
What to do
Add a backup for Exchange, OneDrive, SharePoint, and Teams, and test restoring from it, because a backup you've never restored from is only a hope.