No, Microsoft does not back up your Microsoft 365 data the way most business owners assume. Microsoft runs the servers and keeps the lights on, but its own Services Agreement tells customers in plain language to regularly back up their own content, because the native recycle bin in Exchange Online only holds deleted items for 14 days by default. If someone deletes a mailbox, a SharePoint folder, or a Teams channel by mistake or on purpose, and nobody notices for a few weeks, there may be nothing left to recover without a separate Microsoft 365 backup.
- Microsoft’s Services Agreement, Section 6.b, recommends customers regularly back up their own content and data.
- Exchange Online’s default deleted item retention is 14 days, extendable to a 30-day maximum.
- A late-August outage took down Exchange Online, Teams, SharePoint, and OneDrive for several hours, a reminder that availability and data protection are two different problems.
- Native retention policies and litigation holds are compliance tools, not a substitute for point-in-time backup and restore.
- A departing employee, a ransomware infection, or a bad sync can erase data faster than most SWFL businesses can react without a backup in place.
What happened when Microsoft 365 went down in August?
On August 31, 2026, a failure in a core Microsoft authentication system knocked out Exchange Online for several hours, with Teams, SharePoint Online, OneDrive for Business, and the Microsoft 365 admin center also affected. Reports started landing around 11:30 a.m. Eastern, and mailbox access wasn’t largely back to normal until late that night. It was an availability problem, not a reported data-loss event, but it’s a useful jolt. If your business can’t send or receive email for half a business day, you feel it immediately in a way that a slow, quiet data loss somewhere in a SharePoint library does not. Both deserve a plan, and they’re not the same plan.
What does Microsoft’s own agreement say about backup?
Section 6.b of the Microsoft Services Agreement states that Microsoft recommends customers regularly back up their content and data stored on the services or through third-party apps and services connected to them. That’s Microsoft, in its own contract, telling you this isn’t their job. Microsoft is responsible for keeping the global infrastructure running. You’re responsible for making sure a deleted file, a hijacked account, or a bad migration doesn’t permanently cost you records, invoices, or client history.
How long does Exchange Online actually keep deleted items?
According to Microsoft’s own documentation, the default deleted item retention period for Exchange Online is 14 days, and an admin can extend that to a maximum of 30 days. Once that window closes, the item is gone from Exchange Online. Litigation Hold and retention policies can extend protection for specific legal or compliance purposes, but they’re built for discovery and recordkeeping, not for an owner who needs to restore last quarter’s project folder after a staff turnover mix-up.
What should a real Microsoft 365 backup cover?
A proper backup needs to reach beyond Exchange Online mailboxes into OneDrive for Business, SharePoint Online sites and document libraries, and Teams chats and channel files, with the ability to restore to a specific point in time, not just the most recent version. For a Naples accounting firm or a Fort Myers contractor, that means being able to pull back an invoice folder, a client email thread, or a shared Teams channel from three months ago, not just whatever survived the last two weeks. This is also where the long-term archive conversation we covered in our piece on Microsoft 365 archiving and storage connects: archiving solves a capacity problem, backup solves a recovery problem, and a business needs both working correctly.
How does this fit into hurricane-season planning?
Southwest Florida businesses already think about generators, cell signal, and remote access when a storm is bearing down. Data backup belongs on that same list, because a named storm isn’t the only thing that can take a system offline for days. We’ve written before about why backups need to be tested, not just scheduled, and the same logic applies here. A Microsoft 365 backup that’s never been test-restored is a guess, not a safety net.
Frequently asked questions
Does Microsoft back up my Microsoft 365 data?
No. Microsoft runs the infrastructure and keeps the service available, but its own Services Agreement recommends that customers regularly back up their own content and data stored in the services. Microsoft is explicit that this responsibility sits with you, not them.
How long does Exchange Online keep deleted emails?
By default, 14 days. Admins can extend that to a maximum of 30 days. After that window closes, a deleted item is gone from Exchange Online for good unless you have a separate backup.
Does a Microsoft 365 outage mean my data was lost?
Not necessarily. An outage like the one on August 31, 2026 mainly blocks access while it’s happening. Data loss comes from separate risks such as accidental deletion, a compromised account, ransomware, or an employee clearing out a mailbox on the way out the door.
What should a Microsoft 365 backup actually cover?
At minimum, Exchange Online mailboxes, OneDrive for Business, SharePoint Online sites and libraries, and Teams chats and channel files, with point-in-time recovery that goes back further than Microsoft’s native retention windows.
If you’re not sure whether your Microsoft 365 data would survive a bad month, no storm required, we’ll look at what you have and what’s missing. SWFIT offers a free 15-minute IT and security review for Southwest Florida businesses. Contact us to schedule one.
