Most small businesses assume Microsoft backs up their email and files. It is an understandable assumption, because Microsoft 365 is a cloud service and the data is stored in Microsoft’s data centres. But keeping a service running and keeping a copy of your data that you can restore are two different things.
This guide explains what Microsoft looks after, what it leaves to you, and what a proper Microsoft 365 backup looks like for a small business.
What Microsoft looks after
Microsoft is responsible for keeping Microsoft 365 available. It stores your data across several data centres, so a hardware failure on Microsoft’s side does not take your email offline or lose your files. That protects you against problems Microsoft causes.
It does not protect you against problems your business causes, or problems that happen inside your account. If a staff member deletes a folder, an account is taken over and emails are wiped, or ransomware encrypts files that then sync to OneDrive, Microsoft’s systems faithfully keep the deleted or damaged version. Microsoft’s own guidance on the Essential Eight is clear that under the shared responsibility model, customers always keep responsibility for their information and data.
How long deleted items can be recovered
Microsoft 365 does keep deleted items for a limited time, which is helpful for quick mistakes but is not the same as a backup. By default:
- Emails that are permanently deleted can usually be recovered for 14 days, which an administrator can extend to a maximum of 30 days.
- Files deleted from SharePoint and OneDrive stay in the recycle bins for 93 days.
- A deleted user account, including its mailbox, can be restored within 30 days.
- A departed staff member’s OneDrive is kept for 30 days by default, unless an administrator changes the setting.
- OneDrive’s restore feature can roll files back to any point in the last 30 days, including files that were deleted, overwritten or infected by malware.
Microsoft also sells a separate paid product, Microsoft 365 Backup, which is a good sign that a standard subscription is not designed to be your backup.
Once those windows pass, the data is gone. Many problems are not noticed for weeks, such as a former employee’s mailbox that someone needs months later, or a folder deleted before a busy period.
Where the gaps usually are
- Staff who leave. When a departed staff member’s licence is removed, their mailbox and OneDrive are deleted after a short period unless someone has kept them.
- Accidental deletion. A shared folder deleted by mistake may not be noticed until someone goes looking for a file.
- Ransomware. Encrypted files on a computer can sync to OneDrive and SharePoint and overwrite the good copies.
- Compromised accounts. Someone who takes over an account can delete email and files, or set rules that move messages out of sight.
- Retention settings that were never set up. Retention policies can keep data for longer, but they have to be set up deliberately, and they are not the same as a separate copy you can restore from quickly.
What a proper Microsoft 365 backup looks like
A Microsoft 365 backup is a separate copy of your email, OneDrive and SharePoint data, stored outside your Microsoft 365 account and kept for as long as your business needs. For a small business, a good setup has a few features:
- It runs automatically, at least daily, without anyone needing to remember.
- It is stored separately from your Microsoft 365 account, so a compromised account or ransomware cannot reach it.
- It covers every user, including shared mailboxes and the accounts of staff who have left.
- It keeps history for long enough, so you can restore a file as it was weeks or months ago.
- Restores are tested, so you know the data comes back complete and how long it takes.
The Australian Signals Directorate lists regular backups as one of its Essential Eight controls, and expects backups to be stored securely, protected from deletion by ordinary user accounts and tested by restoring them. Its small business cyber security handbook also suggests checking that your backup plan covers the information held in your email and cloud accounts.
Our earlier guide to reliable backups covers backups more generally.
Questions to ask your IT provider
- Is our Microsoft 365 email, OneDrive and SharePoint backed up separately from Microsoft?
- How often does the backup run, and how far back can we restore?
- Are the mailboxes and files of staff who have left included?
- Who checks that the backup is working, and how would we know if it failed?
- When did we last test a restore, and how long did it take?
If the answers are unclear, it is worth finding out before you need a file back.
How Digitek helps
Digitek IT backs up Microsoft 365 email, OneDrive and SharePoint separately from Microsoft, so deleted, overwritten or encrypted data can be recovered. We check that backups are running, follow up when one fails and test restores rather than assuming they work.
If you are choosing a plan or moving to Microsoft 365, our guide to which Microsoft 365 plan a small business needs is a useful starting point. Find out more about our backup and disaster recovery service, or call 02 4504 8643 to check whether your Microsoft 365 data is covered.
