Why Microsoft 365 Backup Is Necessary: The Shared Responsibility Model
Microsoft 365 backup is the practice of keeping a regular, independent copy of Exchange Online, OneDrive, SharePoint and Teams data outside your tenant. Microsoft guarantees platform uptime and infrastructure security; under the shared responsibility model, protecting the data itself against deletion, ransomware and misconfiguration is the customer's job.
What Is the Shared Responsibility Model?
The shared responsibility model defines how security and data protection duties are split between a cloud provider and its customer. In Microsoft 365, Microsoft is responsible for physical data centers, keeping the service running and platform-level security; the customer is responsible for its own data, user access and recovery after data loss.
Most organizations never notice this split when they sign the agreement. Microsoft's service-level commitments cover infrastructure: data center security, geographic replication, service availability and defense against attacks on the platform itself. A SharePoint library a user deletes by mistake, a OneDrive folder encrypted by ransomware, or a departed employee's mailbox that expires after the license is removed all fall outside that commitment.
The Microsoft Services Agreement sums up the line explicitly: "We recommend that you regularly backup Your Content and Data that you store on the Services." Enterprise subscriptions are additionally governed by product terms, but the principle is the same. Backup, in other words, is not an assurance the provider gives; it is a precaution the customer is expected to take.
| Area | What Microsoft provides | What the customer is responsible for |
|---|---|---|
| Infrastructure | Physical data center security, hardware, network, geographic replication | No customer duty at this layer |
| Service continuity | Platform availability, service-level commitments, platform recovery after outages | Business continuity plan during outages, alternative access paths |
| Platform security | Service-layer defense, blocking attacks against the infrastructure | Identity and access management, MFA, conditional access, privilege review |
| Data | Time-limited recycle bins, Recoverable Items folder, version history | Long-term, independent and immutable backup; restore testing |
| Threats | Threats against the platform and infrastructure | Ransomware, insider threats, account takeover, misconfiguration |
| Compliance | Certifications, data center audits, retention policy tooling | Retention that meets data protection and sector regulations, eDiscovery, audit evidence |
The right-hand column is the one most SMBs leave empty. Layers such as Defender for Office 365 make it harder for a threat to get in; once it is in, the only thing that brings data back is a backup that lives outside the tenant.
Doesn't Microsoft Already Back Up My Data?
Microsoft 365's built-in protections are replication and short-term retention mechanisms, not backups. Replication keeps data current across several data centers, so deleted or encrypted data propagates to every copy just as fast. Recycle bins and the Recoverable Items folder are purged permanently after a fixed number of days.
The sentence we hear most often in the field is "it's already in the cloud, it can't get lost." The infrastructure part is true: Microsoft replicates data geographically and keeps the service running through hardware failures. The false part is the assumption that replication lets you go back to a point in time. Replication only keeps the latest state in more than one place; a backup lets you return to a known good moment.
According to Microsoft Learn, the built-in retention limits are as follows:
| Service | Built-in mechanism | Default period | Limit |
|---|---|---|---|
| Exchange Online | Deleted item retention (Recoverable Items folder) | 14 days | Can be raised to a maximum of 30 days |
| SharePoint Online | First- and second-stage recycle bin | 93 days in total | Not extendable; items purge earlier if the quota fills |
| OneDrive | Recycle bin | 93 days in total | Same two-stage structure |
| OneDrive (departed user) | Retention after the account is deleted | 30 days | Can be extended by an admin setting |
| Teams | Chats live in Exchange, files in SharePoint and OneDrive | The underlying service's period | Channel and chat structure is not backed up separately |
Purview retention policies can extend these periods, but a retention policy is a compliance tool, not a backup. An administrator who misconfigures the policy, or an attacker who takes over an admin account, can remove the policy and open the path to deletion. Retention also keeps the data inside the same tenant: if you lose access to the tenant, you lose access to the retained data too.
For details, see Microsoft's documentation on the Recoverable Items folder and OneDrive retention and deletion.
Six Scenarios That Cause Data Loss in Microsoft 365
Data loss in Microsoft 365 rarely comes from platform failure. It comes from human error, malicious deletion, ransomware, license management mistakes, retention policy gaps and third-party app integrations. None of these scenarios is covered by Microsoft's infrastructure commitment.
- Accidental deletion and overwriting. A user deletes a folder, the recycle bin empties after 93 days, and the loss is noticed months later. Overwriting a document with the wrong version has the same effect; version history depends on the library settings.
- Malicious insiders. A departing employee cleans out their mailbox and OneDrive before the account is disabled. If they also empty the Recoverable Items folder, the built-in recovery path is closed.
- Ransomware and sync. Files encrypted on an endpoint are synchronized to the cloud through the OneDrive client, and the encrypted version replaces the healthy one. Version history helps partially, but rolling back thousands of files by hand takes days. For the role of the endpoint layer, see our article on the difference between EDR, XDR and MDR.
- License removal and account deletion. When a departed user's license is removed, the mailbox and OneDrive are deleted after a set period. When a legal request arrives eight months later, the data is gone.
- Retention policy and admin error. A deletion policy defined with the wrong scope, or a SharePoint site deleted by mistake, turns the mechanism built for protection into the cause of the loss.
- Third-party apps and scripts. A CRM integration, PowerShell script or migration tool connected to the tenant with overly broad permissions can cause mass deletion or corruption.
What these scenarios share is the gap between the time limit of built-in protection and the time it takes to notice the incident. In ransomware cases attackers can sit in the network for weeks, as we explained in our 10-step ransomware defense plan for SMBs; backup is the last and most critical step of that plan.
Microsoft 365 Backup or Third-Party Backup?
Microsoft 365 Backup is Microsoft's native backup service for Exchange Online, OneDrive and SharePoint, with one year of retention. It is designed for fast operational recovery; when you need longer retention, Teams chats, off-tenant storage or an immutable copy, a third-party solution steps in as a complement.
According to the Microsoft 365 Backup overview on Microsoft Learn, backups are retained for a year from the time an item was changed or a snapshot was taken. Restore points for Exchange are taken every 10 minutes; for OneDrive and SharePoint they are taken every 10 minutes for the first 14 days and weekly after that, up to one year. The restore point frequency is not something administrators can change; the service is billed pay-as-you-go through an Azure subscription, and backups stay inside the Microsoft 365 trust boundary.
This is a significant step forward and sufficient for many scenarios. Compare the following criteria when deciding:
| Criterion | Microsoft 365 Backup | Third party (e.g. Acronis Cyber Protect Cloud) |
|---|---|---|
| Covered workloads | Exchange Online, OneDrive, SharePoint | Exchange Online, OneDrive, SharePoint, Teams, OneNote |
| Retention period | One year (per Microsoft documentation) | Policy-driven; multi-year retention can be defined |
| Backup location | Inside Microsoft's trust boundary | Independent of the tenant, separate provider storage, region choice |
| If tenant access is lost | The backup is tied to the same tenant | Backup accessed with a separate identity; cross-tenant restore |
| Restore | In-platform, fast at high volume | Item-level search, preview and selective restore |
| Integration with endpoints and servers | Microsoft 365 only | Workstation, server and virtual machine backup from the same console |
| Billing model | Azure pay-as-you-go | Per-user or per-workload subscription |
In our projects we position the two approaches as layers rather than alternatives. For organizations with high volumes and a need for fast rollback, Microsoft 365 Backup takes the operational layer; for organizations that need multi-year retention for regulatory reasons, an independent off-tenant copy and a single console that also covers endpoints, a third-party solution becomes necessary. For where backup sits among the technical measures required by Turkish data protection law, see our KVKK technical measures checklist.
How Does Acronis Cyber Protect Cloud Back Up Microsoft 365?
Acronis Cyber Protect Cloud backs up Microsoft 365 data to Acronis storage cloud-to-cloud, without installing an agent. Exchange Online mailboxes, OneDrive, SharePoint Online, Teams and OneNote are protected under a single policy; new users, groups and sites are added automatically; restores are performed at the level of an email, file, site or attachment.
Setup consists of connecting the Microsoft 365 tenant to the Acronis console with admin consent. No server, virtual machine or client software is required. Once the policy is defined, backups run at the chosen frequency and are kept in storage independent of the tenant. According to Acronis product documentation, backups are searchable: mailboxes by subject, recipient, sender and date; Teams, OneDrive and SharePoint items by site item and file name, with a preview before restoring.
Three capabilities make the difference in practice:
- Point-in-time and cross-tenant restore. Rolling a OneDrive back to the day before it was encrypted, or restoring a mailbox to a user in a different tenant, is possible; this becomes critical during mergers and divestitures.
- Endpoint and server protection in one console. The same platform manages workstation, physical server and virtual machine backups, so there is no separate tool to learn for Microsoft 365. For patching and inventory, see our article on Acronis Advanced Management.
- Protection against attacks on the backup itself. Because the backup store sits outside the Microsoft 365 identity domain, a compromised tenant administrator does not automatically gain access to the backups.
For product scope and licensing options, see our Acronis Cyber Protect Cloud solution page and the vendor's Acronis Microsoft 365 backup page. If you want to review your Microsoft 365 license plans, our Microsoft 365 plans page will help.
Microsoft 365 Backup Checklist for SMBs
A Microsoft 365 backup strategy should be assessed under seven headings: scope, automatic coverage, frequency, retention period, backup location and immutability, restore testing and access control. If there is no written decision for each heading, the strategy is incomplete.
| Control | Question | Gap we see in the field |
|---|---|---|
| Scope | Are Exchange, OneDrive, SharePoint, Teams and shared mailboxes included in the policy? | Teams channels and shared mailboxes are usually forgotten |
| Automatic coverage | Are newly created users and sites backed up automatically? | Policies that need manual additions fall behind over time |
| Frequency | Has the recovery point objective (RPO) been agreed with the business? | One backup a day may not be enough for the finance team |
| Retention | Is the period required by regulation and contracts defined? | Default period is confused with the legal period |
| Location and immutability | Is the backup outside the tenant and locked against deletion? | Backup reachable with the same admin account |
| Restore testing | Was an item- and site-level restore tested in the last three months? | Backups are taken but never restored |
| Access | Does the backup console have MFA and a separate admin account? | Same identity as the tenant administrator |
The last two rows are the most neglected. What matters is not that a backup exists but that it can be restored; that is why in our projects we run a planned restore drill within the first month after go-live and document how long it took. When setting retention periods, verify the current text of the applicable data protection and sector regulations and official guidance.
Frequently Asked Questions
Does Microsoft automatically back up my Microsoft 365 data?
No. Microsoft replicates data for infrastructure continuity and offers time-limited recycle mechanisms; that is not a point-in-time backup. Microsoft's Services Agreement itself recommends that you back up your content regularly. Under the shared responsibility model, a long-term, independent copy is the customer's duty.
How long can a deleted email be recovered in Exchange Online?
According to Microsoft Learn, the deleted item retention period in Exchange Online is 14 days by default and can be raised to a maximum of 30 days. When it expires, the item is permanently removed from the Recoverable Items folder; it is kept longer only if a hold or retention policy applies.
How long are deleted files kept in SharePoint and OneDrive?
In the two-stage recycle bin structure, deleted items are kept for 93 days in total. The period cannot be extended; if the second-stage quota fills, the oldest items are purged earlier. After 93 days the file is permanently lost and can only be brought back from an independent backup.
Do I still need a third-party solution if I have Microsoft 365 Backup?
It depends on the organization. Microsoft 365 Backup delivers fast recovery for Exchange, OneDrive and SharePoint with one year of retention. If you need multi-year retention, Teams chats, off-tenant storage, cross-tenant restore or a single console that also covers endpoint backup, a third-party solution is needed as a complement.
Does a Purview retention policy replace a backup?
No. A retention policy is a compliance tool; it keeps data in the same tenant, can be changed by an administrator, and becomes inaccessible when tenant access is lost. A backup is a tenant-independent, point-in-time, restorable copy; the two complement each other.
Do I need to install a server to back up Microsoft 365 with Acronis?
No. Acronis Cyber Protect Cloud backs up Microsoft 365 data agentlessly, cloud-to-cloud, to Acronis storage. The tenant is connected to the console with admin consent, a policy is defined, and new users and sites are covered automatically. No local server, virtual machine or client software is required.
What determines the cost of Microsoft 365 backup?
The number of protected users, the volume of data to back up, the retention period, the chosen storage region, whether endpoint and server backup are included on the same platform, and the scope of managed services. For a budget specific to your organization, request a quote with your user count and data volume.
Conclusion
Microsoft 365 offers a strong foundation in infrastructure and platform security, but under the shared responsibility model, protecting, retaining and restoring the data is the customer's job. Built-in recycle periods run on a scale of days, while incidents are often noticed on a scale of months. Microsoft 365 Backup adds a one-year operational recovery layer; for multi-year retention, an independent off-tenant copy and endpoint protection in a single console, third-party solutions such as Acronis Cyber Protect Cloud come into play.
At Sora Yazılım we review your Microsoft 365 tenant's current retention settings, coverage gaps and restore scenarios together with you. For a free discovery call and a quote tailored to your organization, get in touch with us.