+44 (0)1482 770583
hello@systechitsolutions.co.uk
In short: What comes with your subscription is retention, not backup: recycle bins, version history and policies with finite windows, which cannot put a site or a mailbox back to how it looked before an incident. Microsoft does now sell a first-party product, Microsoft 365 Backup, which reached general availability in late 2024 and does provide point-in-time restore for OneDrive, SharePoint and Exchange Online. It is a paid add-on, it is not on by default, it retains for one year, and by design its copies stay inside the Microsoft 365 service boundary. Whether that is enough depends on whether you need an independent copy.
- You assumed Microsoft 365 was backed up and have just realised you are not sure
- You are being sold third-party backup and want to know whether you need it
- An insurer, auditor or customer has asked how you would recover your tenant
- You have retention policies configured and think that covers you
The gap is almost always found by the incident rather than by the audit. A file deleted in March and needed in September, a leaver's mailbox removed with the licence, or ransomware that encrypted files which then synced cleanly to the cloud. In each case the recycle bin has closed and the question becomes what you can prove you can restore.
The three layers, in one screen
- Native retention. Included. Recycle bins, version history, policies and holds. Time-bounded and item-level. Not a point-in-time restore.
- Microsoft 365 Backup. Paid add-on, generally available since late 2024. Real point-in-time restore, one-year retention, copies held inside the Microsoft 365 service boundary.
- Third-party backup. An independent copy outside the platform, with configurable retention and broader workload coverage.
Most businesses have the first and assume it is the second. The rest of this page is how to tell which you need.
What you get without buying anything
Microsoft's shared responsibility model is the thing worth understanding first, because everything else follows from it. Microsoft is accountable for keeping the service running, replicated and resilient. You are accountable for the data inside it. Those are different jobs, and the replication that keeps Exchange Online available is not protecting you from your own users.
What the platform gives you as standard is retention: recycle bins with finite windows, version history, retention policies for categories of content, and legal hold for material you have identified in advance. These are good controls designed for accidental deletion and legal preservation. They are not a restore.
The distinction that matters is this. Retention answers "is this item still somewhere". Backup answers "can I put things back the way they were". Recovering four thousand files individually from a recycle bin, assuming they are all still in one, is not a recovery plan.
Microsoft 365 Backup, the first-party product
This is the part most articles on this question have not caught up with, and it changes the answer materially. Microsoft 365 Backup reached general availability in late 2024. It is a real backup product with real point-in-time restore, sold as a pay-as-you-go add-on rather than bundled into any licence.
From Microsoft's own documentation: it covers OneDrive, SharePoint and Exchange Online; retention is one year across all three; recovery points are every 10 minutes for the two weeks prior and weekly from two to fifty-two weeks for OneDrive and SharePoint, with Exchange Online offering 10-minute granularity across the full year. Billing is $0.15 per GB per month for protected data, with restores free.
It is genuinely good at the thing it is designed for. Restores are fast, because the backup lives next to the data rather than in a remote location that has to be copied back over the wire. For ransomware or a mass deletion event, that speed is the whole point.
The three layers, compared
| Native retention | Microsoft 365 Backup | Third-party backup | |
|---|---|---|---|
| Included? | Yes, with the licence | No, paid add-on | No, separate product |
| Restores a point in time? | No, item-level only | Yes | Yes |
| Retention | Finite windows you configure | One year | Configurable, often years |
| Copy held outside the platform? | No | No, stays in the service boundary | Yes |
| Workloads | Most of the tenant | OneDrive, SharePoint, Exchange Online | Varies; usually broader |
| Pricing model | Included | Per GB of protected data | Usually per user |
| Best at | Accidental deletion, legal hold | Fast recovery from ransomware or mass deletion | Independence, long retention, breadth |
The pricing model inverts the usual comparison
This is worth a paragraph of its own because it catches people out in both directions. First-party backup is billed by volume of protected data. Third-party backup is usually billed per user. So the comparison is not a like-for-like rate, it depends entirely on the shape of your estate.
An organisation with many users and modest data tends to find the per-gigabyte model cheaper. An organisation with few users and large SharePoint libraries, which describes a lot of design, media, engineering and legal firms, can find it considerably more expensive. Work out your actual protected volume before assuming either way, and treat the published figure as a dollar list price rather than what you will pay in pounds.
So which do you actually need?
Native retention alone is defensible only for a business that could genuinely tolerate losing a workload and rebuilding it, which is fewer businesses than assume it.
First-party Microsoft 365 Backup is a reasonable stopping point if your concern is accidental deletion, a malicious insider or ransomware, your data volumes are modest, your retention requirement is under a year, and everything you care about lives in OneDrive, SharePoint or Exchange Online. For a lot of small and mid-sized businesses that is an honest yes.
Third-party backup earns its place when you need a copy that survives the tenant itself, when a regulator or contract requires retention beyond a year, when your data volumes make per-gigabyte pricing unattractive, or when an auditor, insurer or customer asks specifically for an independent copy. That last one is increasingly what decides it, and it is a procurement answer as much as a technical one.
We deliver all three positions and will tell you which one fits. What our backup and disaster recovery service adds beyond the product choice is the part that actually matters on the day: restores that have been tested rather than assumed, and a recovery point and recovery time objective agreed with the business rather than inherited from a default.
The question to ask instead
"Are we backed up" is the wrong question, because the answer is nearly always a technically true yes that means nothing. The question worth asking is: when did we last prove a restore, and how long did it take?
Untested backups fail quietly. The job that errored for months without anyone reading the report, the scope that never included the site everyone actually works in, the restore that turns out to take four days when the business assumed four hours. None of those are visible until the day they matter, and all of them are found in twenty minutes by testing.
Frequently asked
Does Microsoft 365 back up your data?
Partly, and only if you have turned it on and are paying for it. What comes as standard with a Microsoft 365 subscription is retention, not backup: recycle bins, version history, retention policies and legal hold, all designed for accidental deletion and legal preservation rather than for restoring a tenant to how it looked before an incident. Separately, Microsoft now sells a first-party product called Microsoft 365 Backup, which reached general availability in late 2024 and does provide real point-in-time restore for OneDrive, SharePoint and Exchange Online. It is a paid add-on billed by data volume, so it is not included in your existing licence and is not on by default.
Is Microsoft 365 backed up by default?
No. The protection you get without buying anything extra is retention with finite windows: items sit in a recycle bin for a limited period, retention policies keep what you have configured them to keep, and holds preserve what you have placed on hold in advance. None of that restores a site or a mailbox to a prior point in time, and once a retention window lapses the content is gone. Microsoft's shared responsibility model is explicit that Microsoft is accountable for keeping the service available and you are accountable for your data within it.
What is the difference between retention and backup?
Retention answers 'is this item still somewhere', backup answers 'can I put things back the way they were'. Retention is item-centric and time-bounded: a deleted file sits in a bin for a set period, a retention policy keeps a category of content for a set duration. Backup is point-in-time and state-centric: it restores a whole site, account or mailbox to how it looked at a specific moment, which is what you actually need after ransomware or a mass deletion. Recovering four thousand files individually from a recycle bin, assuming they are all still in one, is not a recovery plan.
Do I need third-party backup if I buy Microsoft 365 Backup?
It depends on whether you need an independent copy, and Microsoft's own documentation answers this more clearly than most vendor marketing. Microsoft 365 Backup creates its copies inside the Microsoft 365 service boundary; the docs state that data never leaves the Microsoft 365 data trust boundary. That makes it very fast to restore from, and means it is not a separate copy in a separate place under separate control. If your concern is accidental deletion, malicious deletion or ransomware, first-party covers it well. If your concern is tenant-level compromise, a requirement for a copy outside the platform, or a retention obligation longer than a year, it does not.
How much does Microsoft 365 Backup cost?
Microsoft publishes $0.15 per GB per month for all data protected, with restores charged at nothing, on a pay-as-you-go consumption basis rather than a per-user licence. That pricing model is the thing to pay attention to, because it inverts the usual comparison: third-party backup is typically priced per user, so first-party tends to look cheaper for organisations with many users and little data, and more expensive for organisations with few users and a lot of it. Work out your actual protected volume before assuming either way, and treat the published figure as a list price in dollars rather than what you will pay in pounds.
How long does Microsoft 365 Backup keep data?
One year, for OneDrive, SharePoint and Exchange Online. Within that, Microsoft documents 10-minute recovery points for the two weeks prior and weekly points from two to fifty-two weeks for OneDrive and SharePoint, with Exchange Online offering 10-minute granularity across the full fifty-two weeks. The one-year ceiling is the detail that decides it for some businesses: if you carry a regulatory or contractual obligation to produce data older than that, first-party backup alone does not satisfy it and you need either retention policies alongside it or a third-party product with configurable retention.
Is Microsoft 365 Backup immutable?
Append-only rather than strictly immutable, and Microsoft is unusually direct about the distinction. Existing restore points cannot be modified or overwritten, which is what protects them from malware and from service-side corruption. Deletion, however, is permitted, because blocking it entirely would conflict with obligations like GDPR erasure. Microsoft mitigates that with a 90-day recovery grace period after offboarding and multi-admin notifications on potentially harmful actions. If your compliance position specifically requires provably immutable storage, read that definition carefully against your obligation rather than assuming the words match.
What about Teams, Planner and the rest?
This is where scope gets missed. Microsoft 365 Backup covers OneDrive, SharePoint and Exchange Online. Teams is not a separate store so much as a presentation layer: files live in SharePoint, one-to-one chat lives in mailboxes, and both are therefore covered indirectly, but the shape of a restore is not the shape of a Team. Anything outside those three workloads is not covered by first-party backup at all. If Planner, Loop or a line-of-business app in the tenant matters to you, establish where its data actually lives before assuming a backup product touches it.
When did you last prove a restore?
Tell us what your tenant holds and what you have configured. We will tell you what you could actually restore today, and whether the gap is worth closing.