Most Perth businesses assume that because Microsoft 365 is cloud-based, their data is automatically backed up. It's one of the most common misconceptions we encounter - and one of the most dangerous.
Microsoft runs a highly redundant infrastructure. Your emails won't disappear because a data centre catches fire. But redundancy is not the same as backup. If you accidentally delete 3,000 emails, or ransomware encrypts your SharePoint, or a disgruntled employee wipes the shared mailbox on their way out - Microsoft's built-in tools may not save you.
What Microsoft actually provides
Microsoft 365 includes several retention mechanisms that many people mistake for backup:
- Deleted Items folder - items stay here until you empty it manually or automatically.
- Recoverable Items / Second-stage recycle bin - holds hard-deleted items for 14–30 days by default, up to 93 days with Microsoft 365 Backup or Litigation Hold.
- SharePoint and OneDrive Recycle Bin - deleted files sit in the recycle bin for 93 days before permanent removal.
- Version history - SharePoint and OneDrive store previous versions of files, but only up to the version limit set per library.
These are useful safety nets for accidental deletion of individual items within a short window. They are not backup in any meaningful sense.
What isn't covered
The built-in retention features won't protect you in these scenarios:
Ransomware
Modern ransomware targets cloud storage. When it encrypts your local files, OneDrive sync can push the encrypted versions to the cloud - overwriting good files with encrypted ones. SharePoint version history may preserve some prior versions, but the window is limited and recovery is painstaking file by file.
Permanent deletion by a user
If someone empties the recycle bin - or uses PowerShell to hard-delete items - and the retention window has passed, that data is gone. There is no way to recover it without a third-party backup.
Bulk accidental deletion
Migrating to a new system, running a cleanup script, or making a mistake in a bulk operation can wipe thousands of items at once. Individual recovery from the recycle bin is feasible for a handful of files. It's not feasible for an entire shared drive.
Malicious insiders
An employee leaving under bad terms has 30+ days of access if offboarding is delayed. Targeted deletion of emails, contacts, and files can go unnoticed until after the retention window closes.
App integrations gone wrong
Third-party apps connected to your Microsoft 365 tenancy can corrupt or delete data. If you grant a poorly-built integration write access to Exchange or SharePoint, the damage can be extensive.
What Microsoft 365 Backup (the paid add-on) covers
In 2024 Microsoft released a paid "Microsoft 365 Backup" add-on. It extends retention windows significantly and allows faster restore at scale. It's a step forward - but it still has limitations: it's controlled from within the Microsoft ecosystem, meaning a compromised admin account could potentially affect the backup too, and it doesn't meet some compliance requirements that call for an independent, air-gapped copy.
What a proper third-party backup covers
A dedicated third-party backup solution (tools like Veeam, Acronis, or Datto SaaS Protection) stores a separate copy of your Microsoft 365 data outside Microsoft's environment. Key differences:
- Point-in-time recovery - restore to a specific date and time, not just "before deletion"
- Unlimited or long-term retention - keep years of historical data, not 30–90 days
- Granular restore - recover a single email, an entire mailbox, a file, or an entire site
- Independent copy - not affected by changes to your Microsoft 365 tenancy or admin credentials
- Faster bulk recovery - restore thousands of items in minutes, not hours
What does it cost?
Third-party Microsoft 365 backup typically runs $3–8 per user per month, depending on what's covered (Exchange only, or Exchange + SharePoint + OneDrive + Teams). For most Perth SMBs with 10–50 users, that's $30–$400/month - a fraction of the cost of recovering from a data loss event.
What Perth businesses should do
- Assume Microsoft 365 does not back up your data in any way that will save you from a real incident.
- Enable the extended Recoverable Items retention window if you haven't - it costs nothing and buys more recovery time.
- Add a dedicated third-party backup that covers Exchange, SharePoint, OneDrive, and Teams.
- Test restores at least quarterly - knowing the backup runs is not the same as knowing it works.
Frequently Asked Questions
Does Microsoft 365 back up my emails automatically?
Not in any complete sense, Microsoft retains deleted items for a limited window, generally 30 to 93 days depending on your plan and settings, but this isn't a true backup. It won't protect against bulk deletion, ransomware encryption, or a departing employee deliberately wiping data.
What happens if someone permanently deletes emails or files in Microsoft 365?
Once an item is hard-deleted and the retention window has passed, it's generally gone for good within Microsoft's own tools. A third-party backup keeps a separate copy outside Microsoft's environment, which is the only reliable way to restore data at that point.
Is the paid Microsoft 365 Backup add-on the same as a third-party backup?
Not quite, it extends retention and speeds up restores, which is a genuine improvement, but it's still managed from within the Microsoft ecosystem, meaning a compromised admin account could potentially affect it too. A third-party backup keeps an independent copy that isn't tied to your Microsoft 365 tenancy or admin credentials.
How much does third-party Microsoft 365 backup typically cost?
Generally around $3 to $8 per user per month depending on what's covered, Exchange only versus Exchange plus SharePoint, OneDrive, and Teams. For a typical 10 to 50 person Perth business, that works out to roughly $30 to $400 a month, a small cost against the price of recovering from a genuine data loss event.
Not sure if your Microsoft 365 data is actually backed up?
We review Microsoft 365 backup coverage for Perth businesses and set up independent backup where it's missing. It's a quick check that can prevent a very expensive problem.
Talk to us about Microsoft 365 backup →For related reading, see our guides to How to Test Your Business Backup - A Guide for Perth Businesses and Microsoft 365 Security for Perth Businesses.