Does Microsoft 365 back up my data?

No. Microsoft 365 operates under a shared responsibility model. Microsoft is responsible for the platform, the customer is responsible for protecting the data inside it. Native retention is not the same as backup.

Is OneDrive version history enough?

OneDrive keeps version history within a retention window. It does not protect against malicious deletion, account compromise, or events that occur before the retention window covers the change you need to roll back.

Does Microsoft 365 backup help with ransomware?

Yes. A managed backup stores data outside the M365 tenant, so a sync-propagated or admin-account ransomware event does not affect the backup.

How often does M365 backup run?

Daily on an automated schedule is the standard. Backup happens overnight without affecting users.

Microsoft 365 Published May 2026 By the Managed Backup Asia team

Microsoft 365 Backup Explained: Retention Is Not Backup

Microsoft 365 is one of the most reliable SaaS platforms in business. It also does not back up your data, in any meaningful sense of the word. This guide explains the shared responsibility model that catches most small businesses off guard, what Microsoft's native retention actually protects against, and what a dedicated M365 backup adds.

The Microsoft 365 shared responsibility model

Microsoft documents the M365 service under a shared responsibility model. Microsoft is responsible for the platform: keeping it running, patching it, protecting the underlying infrastructure, providing geo-redundant availability. The customer is responsible for the data: who has access to it, how it is configured, how it is protected from loss caused by user actions, account compromise, or malicious activity.

This is not unusual. Every major SaaS platform — Microsoft 365, Google Workspace, Salesforce — operates the same way. What is unusual is how many businesses assume the platform vendor is doing more than they actually are.

Native retention vs backup

Microsoft 365 has native retention features. Items in the Exchange deleted items folder are recoverable for a period. SharePoint sites have a recycle bin. OneDrive keeps version history. These are useful. They are not backup.

The reason: native retention lives inside the same tenant as the live data. It is designed to recover from the routine "I deleted the wrong file" case. It is not designed to recover from:

A compromised admin account that mass-deletes content across the tenant.
A ransomware infection that propagates through OneDrive sync clients to every connected device.
A malicious or careless user who empties the deleted items folder before anyone notices.
A retention policy misconfiguration that purges data after a short window.
An accidental tenant deletion or migration that goes wrong.
An audit or legal hold requirement to recover data from beyond the retention window.

A backup, by contrast, is an independent copy of the data stored outside the M365 tenant, with its own retention policy. It is not affected by what happens inside the tenant.

What can go wrong in M365 without backup

Staff departure. When a user's M365 licence is removed, their mailbox and OneDrive can be deleted within 30 days. If nobody has explicitly archived their data, project history walks out the door with them.

Sync-propagated ransomware. A workstation gets ransomwared. OneDrive sync faithfully propagates the encrypted files to the cloud, where they overwrite the good versions. The version history may help, but only within its retention window.

Account compromise. A phishing attack gains access to a privileged account. The attacker mass-deletes or exfiltrates email and SharePoint content. By the time it is noticed, the deleted-items windows have expired.

Routine over-aggressive retention. Someone applies a retention policy that purges email after 12 months. A year later, the legal department asks for an email from 18 months ago.

Teams data quirks. Microsoft Teams data is split across SharePoint, Exchange, and the Teams service itself. Retention behaviour is inconsistent across these stores. Chats, channels, and shared files do not all behave the same way.

What a proper M365 backup covers

A credible managed Microsoft 365 backup covers:

Exchange Online — mailboxes, folders, calendars, contacts.
SharePoint Online — sites, document libraries, lists, version history.
OneDrive for Business — per-user files and shared content.
Microsoft Teams — chats, channels, files behind channels.

Backups should run daily on an automated schedule. Storage should be independent of the M365 tenant, encrypted in transit and at rest. Granular restore — one email, one file, one folder — should be possible without restoring an entire mailbox or site. Our Microsoft 365 backup service covers all of these.

M365 backup and Singapore PDPA

Singapore's PDPA requires organisations to make reasonable security arrangements to prevent unauthorised access, collection, use, disclosure, copying, modification, disposal, or similar risks to personal data. Most businesses hold a substantial amount of personal data in Microsoft 365 — in Outlook mailboxes, in SharePoint, in OneDrive.

Native retention is not designed to demonstrate that personal data is protected from loss. A dedicated backup with documented retention, encryption, and isolation from the M365 tenant is. For the full picture see our PDPA backup compliance guide.

Talk to a backup specialist

Managed Backup Asia operates from Singapore and supports small businesses across Asia. If you would like to discuss your data protection needs, schedule a free 30-minute exploratory call.