The Cloud Backup Myth: Why Microsoft 365 Isn't Your Complete Backup Strategy

Microsoft 365 keeps your email and files available, but that isn't the same as backing them up. Under Microsoft's published shared-responsibility model, the customer stays responsible for its own data, configuration and identities, even in a fully cloud service. The safety nets built into Microsoft 365 are short: 14 to 30 days for deleted email, 30 days for a deleted mailbox or user account, and 93 days for SharePoint and OneDrive recycle bins. After that, deleted content is gone. Recycle bins aren't an independent, versioned copy kept away from the account that deleted the data. Microsoft itself now sells a paid add-on called Microsoft 365 Backup, which tells you the default isn't the whole answer.

How long does Microsoft 365 keep deleted data?

Source: Microsoft Learn pages on Exchange Online mailboxes and Recoverable Items (updated 25 Sep 2026), Entra ID recovery from deletions (6 May 2026), Microsoft 365 Backup overview and pricing; Microsoft Support on SharePoint recycle bins; accessed 8 Nov 2026. Retention policies and Litigation Hold change these windows.

Doesn't Microsoft back everything up already?

Microsoft protects the service: its data centres replicate data so that a failed disk or building doesn't lose your mailbox. That is resilience against Microsoft's problems. It isn't protection against yours. Microsoft's shared-responsibility page says that "regardless of the type of deployment, you always retain" responsibility for data, endpoints, accounts and access management, and its SaaS column lists customer data, configurations and identities as the customer's job.

A note on a commonly quoted line: the sentence "We recommend that you regularly backup Your Content and Data" comes from the Microsoft Services Agreement, which covers consumer services such as Microsoft 365 Personal and Family, not business tenants. For a company, the shared-responsibility model is the better reference.

What actually goes wrong?

These are the everyday cases recycle bins don't cover well:

• Late discovery. A project folder is deleted in January and someone needs it in May. The 93-day window has closed.
• A departed employee. The account is removed when they leave, and 30 days later the mailbox and OneDrive are gone with it. Our offboarding checklist covers how to keep what you need.
• Ransomware or a compromised account. Files synced from an infected laptop are encrypted in OneDrive and SharePoint. Version history can help, but a clean copy held outside the affected account is safer. See how one wrong click becomes a ransomware incident.
• Admin mistakes. A retention policy is changed or a Conditional Access policy is deleted. Entra settings outside the 30-day soft-delete list can't be restored, and there is no built-in snapshot of the whole tenant configuration.
• Bulk deletion. If deleted items fill the Recoverable Items quota, Exchange purges the oldest ones early, before the window ends.

Availability means you can reach your data today. Backup means you can get last month's version back after someone, or something, destroyed it. Microsoft 365 is built for the first; the second is still your job.

What are the options for backing up Microsoft 365?

Retention policies and Litigation Hold. Included in many plans, these can keep content for years and cover accidental deletion well. They aren't an isolated copy, though: an admin with the right rights, or an attacker holding those rights, can change them.

Microsoft 365 Backup. Microsoft's own add-on backs up Exchange, OneDrive and SharePoint with point-in-time restore points. Microsoft says backups stay inside the Microsoft 365 trust boundary and are immutable, and it gives restore targets (not guarantees) of 1,000 units in under 12 hours. Its pricing page lists US$0.15 per GB per month of protected content, billed through Azure (accessed 8 Nov 2026; some pages still describe the service as in preview, so check before you budget). Teams and Entra aren't listed as covered. For 30 users averaging 40 GB each, that's about 1,200 GB, or roughly US$180 a month before GST (CALC, illustrative).

Third-party or NAS-based backup. Tools from backup vendors, or Synology's Active Backup for Microsoft 365, keep a copy outside Microsoft with retention you control. Synology says Active Backup for Microsoft 365 is licence-free on supported Synology NAS models and covers Exchange, OneDrive, SharePoint and Teams channel posts. The trade-off is that you now own the hardware, patching and offsite copy. A neglected NAS can become a risk in its own right; our NAS guide for Singapore SMEs explains why a NAS is not a backup on its own. Our post on NAS versus cloud storage costs runs the numbers.

What do Singapore guidelines expect?

CSA's Cyber Essentials mark (version V202503) asks organisations to identify and back up business-critical data, back up regularly, and store backups "separately and isolated from the operating environment". It also recommends testing backups at least twice a year. A Microsoft 365 recycle bin doesn't meet the "separate and isolated" test on its own. Under the PDPA, organisations must make reasonable security arrangements to protect personal data, and unrecoverable loss can be part of that picture. Check with your adviser how this applies to you; this isn't legal advice.

A practical 3-2-1 approach for a cloud-first office: keep the live data in Microsoft 365, keep one backup copy with separate credentials (Microsoft 365 Backup or a third-party service), and keep a second copy outside Microsoft, for example on a NAS or, for long-term archives, tape. Then test a restore. For outage planning rather than backup, see what happens when a cloud service goes down.

Buying in Singapore

For an on-premises copy of Microsoft 365 data, the Synology DS925+ is S$1,260, and Synology's dedicated ActiveProtect DP320 backup appliance is S$2,611.20 (listed 8 Nov 2026); ask us to confirm which Synology models and software cover your Microsoft 365 workloads. See the full Synology backup and data protection range. Prices change; ask for a current quotation. We don't list third-party Microsoft 365 backup subscriptions on the store, so ask us if you'd like options quoted. Use Request for Quotation on the product page, call (65) 6978 3502, email Sales@sourceit.com.sg or use our contact page.

Frequently asked questions

Does Microsoft back up my Microsoft 365 data? Microsoft replicates data to keep the service available, but under its shared-responsibility model your data, settings and identities remain your responsibility. Built-in recycle bins only last 14 to 93 days.

How long can I recover a deleted mailbox? 30 days. After that, Microsoft says the mailbox is permanently deleted and can't be recovered, unless a retention policy or hold was in place.

What is Microsoft 365 Backup? A paid Microsoft add-on that keeps point-in-time restore points of Exchange, OneDrive and SharePoint inside Microsoft 365. Microsoft lists it at US$0.15 per GB per month of protected content.

Are retention policies the same as backup? Not quite. They keep content from being deleted for a set time, but they aren't a separate copy and can be changed by anyone with the right admin rights.

Can a NAS back up Microsoft 365? Yes. Synology, for example, offers Active Backup for Microsoft 365 on supported NAS models. You then need to patch the NAS and keep a further offsite copy.