Microsoft 365 backup: what's built in and how options differ

Do I need to back up Microsoft 365? That’s each organisation’s decision, but Microsoft’s own documentation says the customer keeps responsibility for its data. It’s a common question, because Microsoft runs the service and it’s easy to assume Microsoft keeps a copy of everything forever. Microsoft’s shared responsibility documentation puts it differently: “Regardless of the type of deployment, you always retain the following responsibilities”, and the first item on that list is data, followed by endpoints, accounts and access management.

In practice, Microsoft keeps the service running, and the organisation decides how its own files and email would be recovered after a mistake, a departed staff member or a ransomware attack. This guide explains what Microsoft says its built-in restore features cover, how Microsoft 365 Backup works, what to compare between backup services, and how five services describe themselves.

What’s built in, according to Microsoft

• Restore your OneDrive. Microsoft’s support page says this helps Microsoft 365 subscribers “undo all the actions that occurred on any files and folders within the last 30 days”. If the restore follows automatic ransomware detection, Microsoft says a suggested restore date is filled in.
• Restore a shared library. Microsoft says restoring a SharePoint or Teams shared library undoes actions on files and folders from the last 30 days. Only site admins can start it, and it relies on version history and the recycle bin.
• Version history and recycle bins. Microsoft notes that when version history is turned off, files can’t be restored to a previous version, and that deleted files can’t be restored once they’ve been removed from the site collection recycle bin.

The common thread is a time window. The built-in tools are designed to undo recent changes, such as the 30 days for OneDrive and shared library restores. They aren’t described as a separate, long-term copy.

How to restore a OneDrive to an earlier date

Based on Microsoft’s instructions (checked October 2026). Menus can change; Microsoft’s guide has the latest steps.

1. Sign in to OneDrive on the web. For work or school accounts, go to Settings > Restore OneDrive. For a personal account with Microsoft 365, select Settings > Options > Restore your OneDrive.
2. Choose a restore date from the list, such as Yesterday, or pick a custom date and time.
3. Review the activity chart and feed to see which actions will be undone.
4. For a custom date, select the earliest activity to undo; later activities are selected automatically.
5. Select Restore. Microsoft says OneDrive returns the files to their state before the first selected activity, and that files created after the restore point move to the OneDrive recycle bin.

Do you need a separate backup?

That’s a decision for each organisation, often with its IT provider. What official sources say:

• The ACSC’s small business guide says regular backups can help recover information if it is lost or compromised, and describes creating and implementing a plan to regularly back up information. Ten small business cyber security basics summarises it.
• The ACSC’s ransomware page says that without a backup, “it could be impossible to recover your files”. Its case study describes a business keeping regular backups on cloud servers, external drives and a network-attached storage device.

For some small organisations, the built-in 30-day restore features may cover the situations they’re concerned about. Others want longer retention, a copy held separately from the main tenant, or coverage for things the built-in tools don’t restore. Those are the gaps backup services describe themselves as filling. The guide to the 3-2-1 backup approach explains the general idea of keeping more than one copy.

What to compare

• Workloads covered. Exchange email, OneDrive, SharePoint and Teams are stored differently. Some services also back up Microsoft Entra ID, Planner or Power Platform; others sell those separately.
• Where backups are stored. Options include inside Microsoft’s own boundary (Microsoft 365 Backup), a provider’s separate cloud, or a device the organisation owns, such as a network-attached storage (NAS) box.
• Data location. For organisations with data residency requirements, the region where backups are held matters. Not every provider names its regions on its product page.
• Retention. How long backups are kept, from months to years, and whether that can be configured.
• Frequency. How often a new copy is taken, which affects how much recent work could be lost.
• Protection of the backup itself. Makers use terms such as “immutable”, “append-only” and “air-gapped” to describe how backups resist changes or deletion.
• Restore options. Whole-mailbox or whole-site restore, single items, export to files, and self-service restore for staff.
• Billing basis. Per user, per amount of storage, or bundled with hardware. Each maker’s site has current pricing.

How the products compare

Based on makers’ published specifications, checked October 2026. Listed alphabetically, not ranked. Services change often, so each maker’s documentation has the current details.

The product summaries further down this page set out what each maker states, with links to their pages.

How to set up Microsoft 365 Backup

Based on Microsoft Learn (checked October 2026). Microsoft’s setup guide has the latest steps and role names.

1. Check admin roles. Microsoft says a SharePoint Administrator or Global Administrator can set it up, recommends roles with the fewest permissions, and describes a separate Microsoft 365 Backup Administrator role.
2. Have an Azure subscription with Owner or Contributor access, a resource group and a chosen region.
3. Link the Azure subscription for pay-as-you-go billing in the Microsoft 365 admin centre. Microsoft says organisations onboarding after 1 April 2026 do this through the Billing node.
4. Create backup policies for OneDrive, SharePoint or Exchange, under Settings > Microsoft 365 Backup.
5. Turn on email notifications. Microsoft says it “highly recommend[s] enabling multi-admin notifications, at a minimum, for potentially harmful events”.

Third-party services each publish their own onboarding steps. The Microsoft 365 security baseline checklist covers related tenant settings.

Things to watch for

• Who can delete backups. Microsoft says Microsoft 365 Backup doesn’t block deletion, so customers can offboard, and describes a 90-day grace period. Limiting who holds backup admin roles is part of what Microsoft describes.
• Time windows. The built-in restore features cover 30 days. Changes older than that need another copy.
• Version history settings. Microsoft notes that turning off version history removes the ability to restore earlier versions of files.
• What isn’t covered. Microsoft’s Backup overview lists OneDrive, SharePoint and Exchange. Some third-party services list Teams, Planner or Entra ID, and some sell them separately.
• App permissions. Third-party services connect to the tenant to copy data, and each describes the access it asks for. The guide to app consent settings explains how Microsoft handles these permissions.
• Retention policies aren’t backups. Microsoft states that Purview retention and deletion policies don’t affect the Microsoft 365 Backup recovery window. The two features do different jobs.
• Your own hardware. With a NAS-based option, the organisation is responsible for that device, including its security and where it’s kept.

Common questions

Do I need to back up Microsoft 365?

That’s a decision for each organisation, often with its IT provider, but Microsoft’s shared responsibility documentation says customers always retain responsibility for their data. Microsoft’s built-in restore features cover a time window, such as 30 days for OneDrive and shared libraries, and aren’t described as a separate, long-term copy. Some organisations want longer retention or a separate copy, which backup services describe themselves as filling. See Do you need a separate backup?

How long does OneDrive keep deleted files?

Microsoft’s Restore your OneDrive feature lets Microsoft 365 subscribers undo actions on files and folders from the last 30 days. Shared libraries in SharePoint and Teams have a similar 30-day restore that relies on version history and the recycle bin, and Microsoft notes that files removed from the site collection recycle bin can’t be restored. Changes older than the window need another copy. See what’s built in.

How do I restore OneDrive to a previous date?

Microsoft’s steps start with signing in to OneDrive on the web and opening Settings > Restore OneDrive (work or school accounts) or Settings > Options > Restore your OneDrive (personal accounts with Microsoft 365). After choosing a date such as Yesterday, or a custom date, and reviewing the activity to be undone, selecting Restore finishes it. Microsoft says files created after the restore point move to the recycle bin. Full steps: restore a OneDrive to an earlier date.

What do I do if ransomware encrypts files in OneDrive?

Microsoft says that if Restore your OneDrive follows automatic ransomware detection, a suggested restore date is filled in, and the feature can undo actions from the last 30 days. The ACSC’s 24/7 hotline is 1300 CYBER1 (1300 292 371) for cyber incidents such as ransomware, and its ransomware page warns that without a backup, it could be impossible to recover files. See how ransomware works.

What is Microsoft 365 Backup?

It’s Microsoft’s own backup service, separate from the built-in restore features. Microsoft says it backs up all or selected SharePoint sites, OneDrive accounts and Exchange mailboxes, with retention of 3 months to 2 years per policy. Data stays within the Microsoft 365 boundary, and it’s charged on consumption with free restores. Setup needs an Azure subscription. See how to set up Microsoft 365 Backup.

Are Purview retention policies a backup?

Microsoft describes them as separate features that do different jobs. It states that Purview retention and deletion policies don’t affect the Microsoft 365 Backup recovery window. Backup services, including Microsoft 365 Backup, describe keeping a copy that can be restored, and they differ on where it’s stored, how long it’s kept and which workloads, such as Teams and Entra ID, they cover. See what to compare.

Where to get official help

Microsoft Learn’s Microsoft 365 Backup overview is the reference for Microsoft’s service. The ACSC’s 24/7 hotline is 1300 CYBER1 (1300 292 371) for cyber incidents such as ransomware. A qualified IT provider can advise on a particular organisation’s backup needs.