Microsoft 365 Backup: Why Native Retention Isn't Enough

"Microsoft backs up Microsoft 365" is one of the most expensive misconceptions in SMB IT. Microsoft replicates data for service resiliency — that's not the same as backing it up for you. Here's what the shared responsibility model actually says and what a real backup gives you.

What Microsoft is responsible for

• Infrastructure uptime and physical hardware
• Service-level data replication across Microsoft datacentres
• Short-term recovery from Microsoft-caused incidents

What you are responsible for

• Accidental or malicious deletion by users
• Ransomware encrypting OneDrive/SharePoint files
• Long-term retention for legal or compliance reasons
• Recovery of data after an account is deleted (Microsoft purges after 30 days)
• Granular point-in-time restores of mailboxes, sites, and Teams chats

The 30-day cliff

Microsoft's native retention for a deleted user is 30 days. After that, the mailbox, OneDrive, and personal SharePoint data are gone. If a disgruntled staff member resigns on the 1st and your finance team doesn't realise until the 35th that they wiped a folder before leaving, native retention won't help you.

What a third-party M365 backup gives you

• Daily backups of Exchange, OneDrive, SharePoint and Teams
• Configurable retention — typically 1 year, 7 years, or indefinite
• Granular restore — a single email, a single document version, a single Teams chat
• Restore to a different user (essential after staff turnover)
• Immutable storage that ransomware cannot encrypt

What it costs

Australian SMBs typically pay $4–$8 per user per month for a managed M365 backup (Datto SaaS Protection, Veeam, AvePoint, Acronis). For a 25-seat business that's $1,200–$2,400/year — significantly less than one day of business disruption.

If you're not sure what your current retention setting is, log into the Microsoft 365 admin centre > Settings > Org settings > Security & privacy and check. If it says 30 days, you have a backup gap.