Cloud Backup for Microsoft 365: What Native Retention Doesn't Cover

The most dangerous myth: "Microsoft backs up my data"

This is probably the most expensive misconception in the Microsoft 365 world. Most IT directors assume that because their data is "in the cloud," Microsoft takes care of backing it up. This is false.

Microsoft operates under a shared responsibility model:

• Microsoft is responsible for: infrastructure availability (keeping the service running) and geographic redundancy (ensuring a datacenter disaster doesn't lose data).
• You are responsible for: protecting your data against accidental deletion, malicious deletion, ransomware, and regulatory retention compliance.

In Microsoft 365's service agreement, section 6b, Microsoft explicitly recommends that customers "maintain regular backup of your content and data." Microsoft is telling you they don't do it for you.

What M365 native retention covers

Microsoft 365 includes native retention, but it has important limits:

| Service | Native retention | Limit |

|---------|-----------------|-------|

| Exchange (email) | Deleted Items: 14 days, Recoverable Items: 14-30 days | After 30 days, permanently lost |

| OneDrive | Recycle Bin: 93 days | No configurable versioning by default |

| SharePoint | Recycle Bin: 93 days (site), 93 days (second stage) | Site deletion = permanent loss |

| Teams | Messages: no retention by default | Files in SharePoint follow its rules |

5 scenarios native retention doesn't cover

1. Accidental deletion after 93 days. An employee deletes a SharePoint file. Nobody notices until 4 months later. Native retention already purged it.

2. Ransomware that encrypts and overwrites. Modern ransomware doesn't just encrypt files — it overwrites previous versions in SharePoint and OneDrive. If the attack is discovered after the versioning retention period, there's no way to recover.

3. Malicious deletion by an insider. A disgruntled employee deletes their entire mailbox, empties the Deleted Items, and purges Recoverable Items. All in 5 minutes. Without external backup, that data is gone.

4. Failed migration. You're migrating from one tenant to another and something goes wrong. Without a backup independent of the source tenant, you can't recover.

5. Extended regulatory compliance. Mexico's NOM-151 requires 5-10 years of retention for financial documents. M365 native retention isn't designed for that without advanced compliance configuration.

How to design a backup strategy for M365

The 3-2-1 rule adapted for cloud

• 3 copies of data (production + 2 backups)
• 2 different media (cloud + independent storage)
• 1 copy outside the Microsoft ecosystem (in case an incident affects the entire tenant)

What to back up first

1. Exchange (mailboxes) — emails, contacts, calendars. Emails are the historical record of communication with clients, vendors, and regulators.

2. SharePoint and OneDrive — documents, versions, metadata. Shared documents are your company's intellectual assets.

3. Teams — channel messages and 1:1 conversations containing business decisions.

4. Microsoft 365 Groups — memberships, configurations, associated content.

Backup options for SMBs

| Solution | Approx. cost | Pros | Cons |

|----------|-------------|------|------|

| Veeam Backup for M365 | $2-4 USD/user/month | Mature, flexible | Requires separate storage |

| AvePoint Cloud Backup | $3-5 USD/user/month | SaaS, easy setup | Higher cost |

| Spanning Backup | $4 USD/user/month | Simple | Less granularity |

| Microsoft 365 Backup (native) | Included in E5 | Native integration | E5 only, limited functionality |

For most SMBs with 50-500 users, Veeam Backup for Microsoft 365 offers the best balance of cost, functionality, and reliability.

Recommended backup frequency

• Email: every 6 hours (minimum 3 times per day)
• SharePoint/OneDrive: every 12 hours
• Teams: every 24 hours
• Backup retention: minimum 1 year; 5 years if you have regulatory obligations

First step: assess your retention gaps

Before investing in a backup solution, you need to know what retention gaps your tenant has today. Our free scan evaluates the 155 Microsoft Graph rules of the 201-rule library, including retention configuration, deletion policies, and compliance settings. In 90 seconds you have a clear map of where you're vulnerable. The 46 Azure Resource Manager controls add on with admin consent.

Assess your retention gaps for free →