Does Microsoft back up your Microsoft 365 data?

No, not in the way most people mean. Microsoft keeps Microsoft 365 running with replicated copies of your data, and gives you recycle bins and retention features that recover recent deletions, but it does not keep an independent, point-in-time backup that you control unless you pay for one. Under Microsoft’s shared responsibility model, protecting the data inside your tenant is your job.

This matters for every Kenyan organisation that has moved email and files to Microsoft 365, from a SACCO’s member records to a law firm’s client correspondence. Below we set out what Microsoft actually keeps, citing its own documentation (checked on 4 October 2026), why that falls short of a backup, the situations where the gap shows, and your options.

Who is responsible for your data: the shared responsibility model

In Microsoft 365, Microsoft runs the datacentres, servers, network and software, and you remain responsible for your data, your users and your settings. Microsoft’s own shared responsibility page puts customer data, configurations and identities on the customer’s side for every type of cloud service, including software as a service such as Microsoft 365 (Microsoft Learn, checked 4 October 2026).

Put simply: if a Microsoft datacentre fails, that is Microsoft’s problem. If your accountant deletes the audit folder, or an attacker signs in as your finance manager and empties a mailbox, that is yours.

What Microsoft does keep

Microsoft does a lot to keep your data available, and it is worth understanding before you decide what else you need. It falls into three groups.

1. Service resilience

Microsoft designs Microsoft 365 so that hardware failures do not lose data. Its data resiliency documentation describes keeping separate copies of customer data in different fault domains, such as different datacentres, and monitoring data for corruption (Microsoft Learn, checked 4 October 2026). These copies protect against Microsoft’s failures. They mirror your data as it is now, so a deletion or encryption in your tenant is reflected in them.

The same page notes that most data loss results from customer actions, which is why Microsoft gives you self-service recovery tools for recent deletions.

2. Recycle bins and deleted-item recovery

• Exchange Online email. Items deleted from Deleted Items move to a hidden Recoverable Items folder. Microsoft states the default deleted item retention period is 14 days, which admins can raise to a maximum of 30 days, after which the item is removed (Microsoft Learn, checked 4 October 2026).
• SharePoint and OneDrive files. Deleted files go to the site recycle bin and then the second-stage recycle bin. Microsoft gives the retention time for SharePoint as 93 days from the original deletion, and says the same applies to OneDrive for work or school (Microsoft Support, checked 4 October 2026).
• A departed user’s OneDrive. When you delete a user, their OneDrive is kept for a default retention period of 30 days, which admins can change, and then moves to the recycle bin for 93 days. Microsoft also archives OneDrive accounts automatically on their 93rd unlicensed day (Microsoft Learn, checked 4 October 2026).

3. Retention policies and holds

Microsoft Purview retention policies and labels let you retain content, delete it, or retain it for a period and then delete it. When someone edits or deletes content covered by a policy, Microsoft keeps a copy: in the Preservation Hold library for SharePoint and OneDrive, in the Recoverable Items folder for Exchange, and in a hidden folder for Teams messages (Microsoft Learn, checked 4 October 2026). Litigation Hold in Exchange goes further and preserves everything in a mailbox, including items users try to purge.

Microsoft also sells a separate, pay-as-you-go service called Microsoft 365 Backup, which keeps point-in-time restore points for OneDrive, SharePoint and Exchange Online inside the Microsoft 365 boundary, billed by the amount of data protected. You choose a recovery window of 3 months, 6 months, 1 year or 2 years, and Microsoft says the backups honour your tenant’s data residency and cannot be altered, only deleted by the backup admin (Microsoft Learn, checked 4 October 2026). You have to set it up and pay for it separately from your licences, and its overview does not list Teams chats among the services it covers.

Why that is not a backup you control

Recycle bins and retention policies are recovery and compliance tools, not a backup. A backup is a separate copy of your data, kept on your terms, that you can restore from quickly to a known point in time. The built-in features fall short in four ways.

• They run out. Deleted email and files are kept for a fixed period. A problem noticed after that is a problem you cannot fix.
• They live in the same tenant. An attacker or a disgruntled admin with enough rights can change policies, purge recycle bins and delete users from the same console you would use to recover.
• They are slow to restore in bulk. Retained copies are mainly reached through eDiscovery search and export. That works for finding evidence, but rolling a whole department’s files back to last Tuesday is hard work.
• They depend on settings. A retention policy only protects the locations and content it covers, and none is in place until someone creates it.

Four situations where the gap shows

Each of these happens regularly to organisations of every size. The question is whether you can get the data back.

• Accidental deletion. A clerk at a school clears out a “2024” folder to free space, not realising it held the fee records. Nobody notices until the auditors ask months later, after the recycle bin has emptied.
• Departed staff. A logistics company removes a sales manager’s account when she leaves. Her OneDrive is cleaned up after the retention period. A year later a client disputes a contract she negotiated by email, and the thread is gone.
• Ransomware. An infected laptop at a clinic encrypts files that then sync to OneDrive and SharePoint, overwriting good copies across the practice. Restoring file by file is not realistic; you need the whole library as it was before the attack.
• Legal hold. An NGO receives a request from a donor’s auditors, or a law firm is drawn into litigation, and must produce years of email for specific people, including staff who have left.

Retention policies and Litigation Hold help with the fourth case if they were in place before the data was deleted. A backup kept outside the reach of everyday admin accounts helps with all four.

Your options: retention policies or a backup

Most organisations need retention policies for compliance and a backup for recovery. They solve different problems.

Need	Retention policies and holds	Independent backup
Keep records for a set period	Yes, this is their purpose	Yes, for as long as backups are kept
Restore a deleted mailbox or site quickly	Limited, mostly through eDiscovery	Yes, to the original or a new location
Roll back after ransomware	Not designed for it	Yes, to a point before the attack
Keep a leaver’s data without a licence	Partly, depending on settings	Yes
Survive a compromised admin account	No, it is in the same tenant	Better, when access is separate
Covers Teams chats and channels	Retention, yes	Depends on the product

For backup, you can use Microsoft 365 Backup or a third-party product. We use Veeam Backup for Microsoft 365, run as a managed service, which protects Exchange Online, OneDrive, SharePoint and Teams. We connect it to your tenant with a dedicated, least-privilege account, check that jobs complete, and restore anything from a single email to a whole site on request. Read more about our Microsoft 365 backup service.

Backup works best alongside prevention. Multifactor sign-in, conditional access and Defender stop many of the attacks that lead to data loss, and Microsoft 365 security covers how we switch them on. Many of these controls come with Microsoft 365 Business Premium.

The Data Protection Act 2019 angle

If you hold personal data about clients, members, patients, students or staff, the Data Protection Act 2019 expects you to protect it with appropriate safeguards, so losing it permanently can become a compliance problem as well as an operational one. Being able to restore personal data after an incident is one of the safeguards that supports your obligations.

• Know where copies live. The Act sets rules for transferring personal data outside Kenya, so record where both Microsoft 365 and your backup store data.
• Keep data only as long as you need it. Set retention to match your records schedule, not “forever”, and make sure backups follow the same thinking.
• Test restores. A backup you have never restored from is a hope, not a control.

Technology is only part of compliance; you also need policies, processes and, where appropriate, legal advice. Our article on Microsoft 365 and the Data Protection Act in Kenya covers the wider picture.