Your Microsoft 365 data is not backed up by Microsoft, and what to do about it.

Microsoft and devices · 5 min · written 30 October 2026 · by the IT-360 team · sources at the end

Shared responsibility

Microsoft's service agreement is clear: it is responsible for the availability of the service, and you are responsible for your data. Recycle bins and retention policies help for a few weeks; they are not a backup. A leaver's mailbox deleted by mistake. A SharePoint library overwritten by a sync error. A ransomware attack that encrypts every file in OneDrive. All of these are outside what Microsoft will restore for you. That is why Microsoft 365 backup is your job, not Microsoft's.

The 3-2-1 rule, applied to the cloud

Three copies of the data, on two different kinds of storage, with one somewhere else. For Microsoft 365 that means three copies: the live tenant; a backup held by a separate provider in a separate cloud; and, for the business-critical sets, an offline or immutable copy that ransomware cannot reach. A proper Microsoft 365 backup runs several times a day and keeps versions for as long as your retention needs. For most businesses that is years, not weeks.

What a good Microsoft 365 backup covers

• Exchange mailboxes, including shared mailboxes and calendars.
• OneDrive for every user, including leavers.
• SharePoint sites and the files behind every Teams channel.
• Teams chat, where you need it for compliance.
• The settings and groups that make a restore usable, not just the files.

The restore test

A Microsoft 365 backup that has never been restored is a hope. Once a quarter we restore a mailbox and a SharePoint library for each client and record how long it took. The record goes in the monthly report, and it is the first thing an insurer or an auditor asks to see. The Backup and Recovery page shows what the report looks like.

Further reading on Insights: Passkeys and MFA and Cyber Essentials in 2026.

Sources

• Microsoft: Services Agreement and shared responsibility in the cloud.
• NCSC: offline backups in an online world, and the 3-2-1 principle.