The question comes up at the end of every migration: we are in the cloud now, so Microsoft backs it up, right? Microsoft keeps the service running and your data replicated across data centers. It does not protect against an administrator deleting the wrong user, ransomware encrypting a synced OneDrive, or a mailbox needing to look the way it did three weeks ago.
This post explains what the platform does on its own, what retention and holds actually do, and what a backup adds.
What Microsoft 365 does without any configuration
Deleted items go to the Deleted Items folder, then to recoverable items for a default period, and a deleted user's mailbox is kept for 30 days after the account is removed. SharePoint and OneDrive have a two-stage recycle bin that holds files for 93 days in total. OneDrive and SharePoint document libraries keep version history and offer a Files Restore feature that rolls a whole library back to a point in the last 30 days.
All of that covers most day-to-day mistakes. What it has in common is a clock. Every one of those protections expires, and none of them stores a copy anywhere other than inside the same tenant, under the same administrators.
- Recoverable items: mail recoverable after deletion for a default period, longer if on hold.
- Deleted user mailbox: 30 days, then gone unless a hold or retention policy applies.
- SharePoint and OneDrive recycle bins: 93 days across both stages.
- Files Restore: whole-library rollback within 30 days, useful after ransomware in a synced folder.
- Versioning: previous versions of documents, subject to library settings.
What retention and holds do
Purview retention policies and litigation hold keep content from being permanently deleted for as long as the policy says, even if the user deletes it. They exist for compliance and discovery. If a retention policy says keep mail for seven years, a user can delete a message and an eDiscovery search will still find it.
It is not. Retention keeps a copy inside the same tenant with no way to restore a mailbox or a library to how it looked at a given time. A global admin with the right roles can remove the policy and then the content. If the tenant is compromised or the subscription lapses, the retained copies go with it. Recovering a whole mailbox from retained items means an eDiscovery export and an import, hours of work per mailbox.
Microsoft's own service terms recommend that customers use third-party backup for their content. That sentence answers the question on its own.
Connect-ExchangeOnline
Get-Mailbox user@domain.com | Format-List LitigationHoldEnabled, RetentionHoldEnabled, InPlaceHolds, RetainDeletedItemsFor
Connect-IPPSSession
Get-RetentionCompliancePolicy | Format-Table Name, Enabled, ExchangeLocation, SharePointLocationWhat a backup adds
A backup makes a copy at a point in time, keeps it somewhere the tenant's administrators cannot casually delete, and lets you restore a mailbox, a folder, a site or a single file to how it was at that moment. The scenarios where that matters are ordinary: a departed employee's mailbox was deleted before the manager asked for it, a shared library was overwritten by a bad sync, an account was compromised and the attacker purged mail to hide the trail.
Coverage differs by product, and Teams is where products differ most. Exchange, OneDrive and SharePoint are covered by everything. Teams chat and channel messages, Planner and Groups metadata are partial in most products.
Choosing: Microsoft 365 Backup or a third party
Microsoft now sells its own product, Microsoft 365 Backup, priced on the amount of protected storage and built into the admin center. It covers Exchange, OneDrive and SharePoint with frequent restore points and fast restores, because the copies never leave Microsoft's infrastructure. That is also its limitation: the backup lives in the same cloud as the data, under the same tenant. It is a strong choice for fast recovery and a weaker one if the requirement is an independent copy.
Third-party products from established backup vendors store the copy outside the tenant, in their cloud or in your own storage, and typically cover Teams more fully. They cost more per user, take longer to restore very large sites, and add one more console. Some now build on Microsoft 365 Backup storage, which combines the two models.
For most small and mid-size companies the decision is simple: pick one of the two, configure it in the same week as the migration, and run a test restore. Doing neither is the only wrong answer.
- Microsoft 365 Backup: fast, integrated, inside the tenant, priced by storage.
- Third-party: independent copy, broader Teams coverage, per-user pricing, another console.
- Either way: retention policies stay for compliance, backup is for recovery.
Test the restore
A backup that has never been restored is a hope. After the first full backup, restore one mailbox to an alternate location, restore one deleted file from OneDrive, and restore a folder in a SharePoint library. Protect the backup console with MFA and separate credentials, since a backup the attacker can delete is not a backup.
Frequently asked questions
Does litigation hold count as a backup?
No. It stops deletion of content in the tenant for compliance searches. It cannot restore a mailbox to a point in time, and it goes away with the tenant or the policy.
Is Microsoft 365 Backup good enough?
For fast recovery from deletions, overwrites and ransomware in OneDrive and SharePoint, yes. If your policy requires a copy outside the tenant or full Teams coverage, add or choose a third-party product.
How long do we need to keep backups?
That is a business and compliance decision, not a technical one. Common answers are one to seven years for mail and files, with retention policies covering the legal side and backup covering recovery.
Takeaway
Microsoft keeps the service up. Retention keeps content discoverable. Neither one restores a mailbox to last Tuesday. Choose Microsoft 365 Backup or a third-party product during the migration, not after the first loss, and prove it with a restore. If you want help picking one that fits your size, RackLedge can compare the options against your requirements.