Microsoft 365 Backup: The Gap That Loses Your Files

A senior employee leaves. Three months later, someone needs an email thread and a folder of client files from their mailbox and OneDrive. IT checks, and the data is gone. Nobody deleted it on purpose. The account was simply removed, the retention clock ran out, and there was no separate backup.

This happens in Indian offices every month, and it usually comes as a surprise, because most teams assume that "it's in the cloud" means "it's backed up". Microsoft 365 is very reliable, but reliability and backup are not the same thing. If a file is deleted, overwritten or encrypted by ransomware, Microsoft 365 will faithfully keep the damaged version.

This guide explains where the gap is, what Microsoft's built-in tools can and cannot do, and how to close the gap with a simple Microsoft 365 backup plan.

The Shared Responsibility Gap Most Businesses Miss

Cloud services work on a shared responsibility model. Microsoft is responsible for the platform: data centres, hardware, uptime and replication of the service. You, the customer, remain responsible for your data, your user accounts and who can access what.

In practice this means Microsoft protects you from its own hardware failing. It does not protect you from your own people or attackers. A user who deletes a folder, an admin who removes the wrong licence, or malware that encrypts synced files are all on the customer side of that line.

Where Built-in Retention Falls Short

Microsoft 365 does include recovery features, and they are useful. They are just not a backup.

• Recycle bins are time-limited. In SharePoint and OneDrive, deleted items move through a two-stage recycle bin and are kept for 93 days in total. After that, they are gone.
• Deleted email has a short window. In Exchange Online, recoverable deleted items are kept for 14 days by default, which an admin can extend to 30 days.
• Departed users are a trap. When a user is deleted, their OneDrive is kept for 30 days by default and then moves to the recycle bin for 93 days. Miss that window and the files are lost.
• Retention policies are for compliance, not recovery. Retention and litigation hold can preserve content, but restoring a whole mailbox or site to a clean point in time from them is slow and awkward.
• Everything sits in one place. If an admin account is compromised, the attacker can reach both your data and the settings meant to protect it.

4 Ways Businesses Lose Microsoft 365 Data

1. Accidental deletion noticed too late

A folder is deleted during a clean-up. Nobody notices until an audit or a client dispute months later, well past the recycle bin window.

2. Ransomware on a synced laptop

Ransomware encrypts files on a laptop, and OneDrive syncs the encrypted versions to the cloud. OneDrive for business can restore a library to an earlier point within the last 30 days, which helps if you spot the attack quickly. Slow detection turns this into a much bigger problem.

3. Employee exits and licence clean-ups

To save licence costs, accounts are removed soon after staff leave. Their mail and files follow the retention clock, not the business's need for them.

4. Malicious or careless insiders

A departing employee with access can delete or overwrite shared content. Without an independent copy, you depend entirely on how quickly someone notices.

The Fix: Build a Microsoft 365 Backup Plan in 6 Steps

1. List what matters. Cover Exchange mailboxes, OneDrive, SharePoint sites and Teams files at minimum. Note which departments hold contracts, finance records and client data.
2. Set recovery targets. Decide how far back you need to go (for example one year or seven years) and how quickly a restore must happen. These targets decide the tool and the cost.
3. Choose an independent backup. Options include Microsoft's own paid Microsoft 365 Backup service and several established third-party backup tools. Whichever you choose, make sure copies are stored separately from your production tenant, with their own admin credentials.
4. Protect the backup itself. Turn on multi-factor authentication for backup admins, limit who can delete backups, and prefer immutable or locked copies where the tool supports them.
5. Fix your leaver process. Before any account is deleted, confirm its mailbox and OneDrive are in the backup, or convert the mailbox to a shared mailbox where that fits your licensing. Our IT onboarding and offboarding checklist covers this step.
6. Test restores every quarter. Restore a single email, a folder and one full mailbox to a test account. Record how long each took. A backup you have never restored is a hope, not a plan.

What a Good Microsoft 365 Backup Should Include

Use this checklist when you compare options:

• Automatic daily or more frequent backups with no manual steps
• Coverage for Exchange, OneDrive, SharePoint and Teams files
• Point-in-time restore for single items and whole mailboxes or sites
• Retention that matches your business and legal needs
• Clear information on where backup data is stored, which matters for data protection obligations under India's DPDP Act
• Separate admin access, MFA and audit logs
• Simple reporting that shows failed jobs quickly

Microsoft 365 backup should also sit inside your wider plan for servers and laptops. Our guide to data backup solutions for small business covers the rest of the picture.

Backup vs Retention: A Quick Comparison

Question	Built-in retention	Independent backup
Main purpose	Compliance and short-term recovery	Fast, reliable restore of lost data
How far back	Limited by recycle bin and policy windows	As long as you choose to keep copies
Restore a whole mailbox to last Tuesday	Difficult and slow	A few clicks in most tools
Safe if an admin account is hacked	No, same tenant and same admins	Yes, if stored separately with its own access
Covers departed users after deletion	Only within the retention window	Yes, for your full retention period

The two work best together. Keep retention policies for legal and compliance needs, and rely on the backup when you need data back quickly.

Frequently Asked Questions

Does Microsoft back up my Microsoft 365 data?

Microsoft replicates the service to keep it available, and offers recycle bins and retention features. It does not keep an independent, long-term backup of your data that you control. That remains your responsibility.

Is OneDrive a backup?

No. OneDrive is a sync and sharing service. Deletions and changes, including ransomware encryption, sync across devices. It helps with recovery for a short period, but it is not a separate copy.

How long does Microsoft 365 keep deleted emails?

By default, recoverable deleted items in Exchange Online are kept for 14 days, and admins can extend this to 30 days. Retention policies can keep content longer, but they are designed for compliance rather than quick restores.

How much does Microsoft 365 backup cost?

It depends on the number of users, the amount of data and how long you keep backups. For most SMEs it costs far less per user than the Microsoft 365 licence itself.

How Affix Center Helps

Affix Center helps businesses in Mumbai and across India protect their Microsoft 365 data properly. Our cloud and infrastructure team reviews your tenant, sets recovery targets with you, deploys an independent backup, and tests restores on a schedule. We can also tighten admin access and MFA through our cybersecurity services, so the backup cannot be wiped along with your data.

If you are not sure what would happen to a deleted mailbox today, find out before you need it. Contact Affix Center for a Microsoft 365 backup review.