Cybersecurity · Microsoft 365
Why recycle bins and retention policies are not a backup, what Microsoft actually protects, and how to pick a Microsoft 365 backup that fits a small business.
Retention is not the same as backup
Know your real recovery windows
Test a restore before you need it
30 minutes of data collection, your report the next day, yours to keep with no obligation. Or pick a time now. Or call 954-539-5678.
Yes, most businesses should back up Microsoft 365. Microsoft runs the service and keeps redundant copies of your data so its own hardware failures do not lose it. It does not promise to get back the files, mailboxes or sites that your own people, a ransomware attack or a compromised admin account delete or overwrite.
The built-in safety nets are short. As of 2026, deleted SharePoint and OneDrive files sit in the recycle bins for 93 days in total, and deleted Exchange mail stays recoverable for 14 days by default, which an admin can raise to 30. After that, the data is gone unless a retention policy or hold happens to cover it. A backup keeps separate, point-in-time copies for months or years, so you can roll back to a known good state.
Cloud services work on a shared responsibility model. Microsoft is responsible for the infrastructure: data centers, hardware, replication and keeping the service available. Microsoft’s own resiliency documentation describes replicated copies of SharePoint and OneDrive data that fail over automatically when something breaks on its side.
You are responsible for your accounts and your data: who has access, what they do with it, and whether you can recover from their mistakes. Replication does not help you here. If someone deletes a folder, the deletion is replicated too. If ransomware encrypts files synced to OneDrive, the encrypted versions sync back to the cloud.
Many owners assume retention policies in Microsoft Purview are a backup. They solve a different problem. Retention is about keeping content for compliance, so it cannot be deleted before a set date. Backup is about restoring a working state quickly.
Version history helps with a single overwritten file. It does not help when thousands of files change at once, which is what ransomware does.
Each one is recoverable in minutes with a good backup and painful or impossible without one. Our employee offboarding IT checklist covers how to keep a leaver’s data before the license is removed.
Use this list when you compare products.
There are two broad routes.
Microsoft 365 Backup. Microsoft now sells its own backup service for OneDrive, SharePoint and Exchange. According to Microsoft’s documentation, as of 2026 it is billed at $0.15 per GB per month for protected data, restores are free, recovery windows can be set from 3 months to 2 years, and restore points are kept at 10-minute intervals for the prior two weeks for OneDrive and SharePoint (with weekly snapshots after that) and for the prior year for Exchange. Backups stay inside Microsoft’s boundary in append-only storage. Its documentation lists OneDrive, SharePoint and Exchange, not Teams chats, and some admins prefer a copy held outside Microsoft altogether.
Third-party backup. Many independent vendors back up Microsoft 365 to their own cloud storage, usually priced per user. Some build on Microsoft’s backup storage platform, and others copy data to a separate cloud entirely. A separate copy protects you if your tenant itself is locked or compromised.
For most 25 to 100 person businesses, the right answer depends on how much data you hold, whether you need Teams chats, and whether your cyber-insurance carrier or clients expect a copy outside Microsoft.
Not sure whether your Microsoft 365 data could be restored today? Our free Technology Health Assessment takes about 30 minutes of data collection. The next day you get a plain-language report rating your IT operations, cybersecurity, business continuity and more as controlled, needs attention, significant exposure or unknown, with a short list of next steps in order. It is yours to keep, with no obligation. Book your assessment.
If the answers are vague, treat the data as unprotected until proven otherwise. For the wider picture, including servers and laptops, see our guide to backup and disaster recovery for small businesses.
JLB USA’s cybersecurity services include monitored backups and tested restores, multi-factor authentication, access reviews, same-day removal of leavers and a written recovery plan. We administer Microsoft 365 and Google Workspace for businesses with roughly 25 to 100 employees and reply within 5 minutes by email or phone. We can also work alongside an existing IT person.
Book it now
Choose a slot that suits you. We’ll confirm by email, collect the data with you on the call, and send your report the next day. It’s free, and the report is yours to keep with no obligation.
Prefer to talk first? Call 954-539-5678, or send the form and we’ll contact you.
Microsoft replicates your data to protect against its own hardware and data center failures. It does not keep long-term, point-in-time copies you can roll back to after deletion, ransomware or account compromise unless you buy a backup service such as Microsoft 365 Backup.
As of 2026, deleted SharePoint and OneDrive items stay in the recycle bins for 93 days in total. Deleted Exchange mail is recoverable for 14 days by default, and an admin can extend that to 30 days.
No. Retention policies keep content for compliance so it cannot be deleted early. Restoring from them means searching and exporting, not rolling back a site or mailbox, and a compromised admin account can change them.
According to Microsoft’s documentation, as of 2026 Microsoft 365 Backup costs $0.15 per GB per month for protected data, and restores are free. Third-party products are often priced per user, so compare totals for your tenant size.
Quarterly is a sensible rhythm for most small businesses. Restore a mailbox and a SharePoint folder to a test location, time it, and write down the steps.
