Does Microsoft 365 Actually Back Up Your Data?

Short answer: no — not in the way you think. Microsoft 365 replicates your data across data centres for uptime, but it does not keep long-term, restorable backups of your emails, files, Teams chats or SharePoint sites. Microsoft's own service agreement recommends you use a third-party backup. If a staff member deletes something and nobody notices for 60 days, it's gone.

This catches SA businesses off guard constantly. You've moved to the cloud, you're paying your monthly licences, and you assume Microsoft has the safety net. They don't — they have a shared responsibility model, and your data is your problem.

What does Microsoft actually protect for you?

Microsoft protects the platform. That means the servers, the physical data centres, the redundancy that keeps Outlook working when a data centre in Johannesburg has a wobble. If lightning takes out a hyperscale facility, your mailbox is still there because it's mirrored somewhere else.

What Microsoft does not promise is protection against the things that actually go wrong in a small business:

• A staff member deleting a folder of client files by mistake
• A departing employee wiping their own OneDrive on the way out
• A ransomware attack encrypting everything synced to SharePoint
• A retention policy quietly purging emails older than a set period
• An admin misconfiguring a Teams channel and losing the file library

Microsoft's built-in recycle bins and retention windows give you a short grace period — typically 30 to 93 days depending on the workload and your settings. After that, the data is unrecoverable through Microsoft. That's not a backup. That's a bin that empties itself.

Where does the confusion come from?

Two places. First, the word "cloud" makes people think everything is magically preserved forever. Second, Microsoft's own tooling — versioning in SharePoint, retention labels, litigation hold — sounds like backup if you don't read the fine print. It isn't. It's compliance and short-term recovery.

A proper backup means an independent, second copy of your data, stored separately, that you can restore from at a point in time of your choosing — a week ago, a month ago, six months ago. Microsoft 365 out of the box does not do that.

What are the real risks for SA businesses?

We see the same patterns across law firms, accounting practices and healthcare rooms:

Accidental deletion. Someone tidies up their OneDrive, deletes an "old" folder that turns out to hold three years of matter files, and nobody realises until the client asks. By the time you check the recycle bin, it's past the retention window.

Departing staff. An employee resigns badly, and before HR gets to the offboarding, they've cleared their mailbox and OneDrive. Without a backup, you're relying on whatever was shared into Teams or SharePoint — which is usually not enough.

Ransomware sync. Ransomware hits a laptop, encrypts local files, and OneDrive dutifully syncs the encrypted versions to the cloud. Version history helps, but only if you catch it fast and only for supported file types. A proper backup and recovery setup gives you a clean restore point regardless.

POPIA and client due diligence. If you handle client data — and if you're a professional-services firm, you do — you have an obligation to be able to restore it. Increasingly, tender questionnaires and client audits ask specifically about backup arrangements for cloud data. "Microsoft handles it" is not an answer that passes.

What should a proper Microsoft 365 backup cover?

At minimum, look for a solution that captures:

• Exchange Online — mailboxes, calendars, contacts
• OneDrive for Business — every user's files
• SharePoint Online — site content, document libraries, lists
• Microsoft Teams — channels, chats, files, and the underlying SharePoint sites

And the backup itself needs to be:

• Stored independently of Microsoft's tenancy (so a tenant compromise doesn't take the backups too)
• Retained for a period that suits your industry — typically years, not days
• Restorable at a granular level — a single email, a single file version, a whole mailbox
• Tested regularly, because an untested backup is a hope, not a plan

How does this fit with the rest of your IT?

Backup is one leg of a three-legged stool. The other two are prevention (endpoint protection, phishing training, patching) and response (a plan for when something does go wrong). All three sit inside a properly run managed IT support arrangement, which is why we bundle them rather than treat backup as a separate product.

If you're still on a break-fix arrangement where you only hear from your IT person when something's on fire, backup is almost certainly one of the gaps. It's worth understanding the difference between break-fix vs managed IT before your next crisis makes the choice for you.

Key facts

• Microsoft's shared responsibility model puts data protection on the customer, not Microsoft.
• Native retention windows in Microsoft 365 are typically 30 to 93 days depending on the workload.
• A proper backup keeps an independent copy, restorable at a point in time, for as long as you need it.
• MiBOT Support is ISO/IEC 27001:2022 certified — our backup and recovery processes are audited to an international standard.

Frequently asked questions

Isn't OneDrive's version history enough?

For a single accidentally-overwritten file, yes, it can rescue you. For a deleted folder past the retention window, a ransomware attack, or a departed employee's wiped account, no. Version history is a convenience feature, not a disaster recovery plan.

How much does a third-party Microsoft 365 backup cost?

It's usually charged per user per month, and it's modest compared to the cost of losing your data. The exact figure depends on how much you're storing and how long you need to keep it — we'd rather quote you honestly than throw a number here that turns out wrong.

Does this apply if we use Google Workspace instead?

Yes — the same shared responsibility model applies. Google protects the platform; your data is your responsibility. The backup conversation is identical.

What about POPIA — do we have to back up client data?

POPIA requires you to maintain the integrity and availability of personal information. If you can't restore data after a compromise or deletion, you have a problem. The Information Regulator (https://inforegulator.org.za/) expects reasonable safeguards, and backup is squarely one of them.

Ready to close the gap?

If you're not sure whether your Microsoft 365 data is actually being backed up — or you suspect the answer is "probably not" — that uncertainty is worth resolving before something forces the issue. A short conversation is usually enough to tell you where you stand.

When you'd like a second opinion, book a free consultation with the MiBOT Support team. We'll walk through your current setup, tell you plainly what's protected and what isn't, and let you decide from there.

Last reviewed: September 2026