Is Microsoft 365 backup necessary? An honest answer, workload by workload

The question usually lands on the owner's desk in the same way. A quote arrives with a line called "Microsoft 365 backup", a few euros per user per month, and the reaction is reasonable: we already pay Microsoft every month to store this data in some of the best data centres on the planet, so why would we pay a second company to store it again?

It is a fair question and it deserves a better answer than "because the vendor says so". Microsoft 365 has more built-in recovery than most backup salespeople mention, and considerably less than most owners assume. This article goes through it workload by workload, says plainly when the built-in tools are enough, and gives you five questions that settle the matter for your own company. We have this conversation with nearly every new client of our Microsoft 365 managed service, and the answer is not always the expensive one.

Quick answers

Is Microsoft 365 backup really necessary if Microsoft already stores everything redundantly? Redundancy keeps the service online, it does not keep your history. Every deletion, overwrite and ransomware encryption is replicated to all copies within seconds. Once the recycle bin period ends there is no older copy for Microsoft to give back.

How long can I recover deleted data without a backup? Deleted email: 14 days by default, 30 if an administrator extends it. Deleted SharePoint and OneDrive files: 93 days. A deleted user with mailbox and OneDrive: 30 days. A deleted team: 30 days.

Is Microsoft's own Microsoft 365 Backup product enough? It is fast and well integrated, and it now keeps restore points for up to two years. But the copies stay inside Microsoft's cloud and it covers Exchange, SharePoint and OneDrive only. For multi-year legal retention or a copy outside Microsoft, you still need a third-party product.

What does a Microsoft 365 backup cost? Third-party products typically cost two to five euros per user per month, usually with unlimited storage. Microsoft 365 Backup is billed at a list price of $0.15 per gigabyte of protected content per month, so a company protecting 400 GB pays about $60 a month.

What Microsoft 365 already recovers, workload by workload

Start with what you already have, because it is not nothing. For the file deleted yesterday or the email removed last week, the built-in tools work well and cost nothing extra. The table lists each workload, the recovery Microsoft provides out of the box, and the point at which that recovery ends.

Two things stand out. First, every row that holds business data ends somewhere between two weeks and three months. Second, all of these safety nets live in the same tenant as the data they protect, behind the same administrator accounts. An attacker or a careless script with admin rights can empty a recycle bin as easily as a document library. We covered the contractual side of this, including what Microsoft's own agreement says, in who is responsible for backing up Microsoft 365 data. This article is about the practical decision.

When are the built-in tools genuinely enough?

More often than backup vendors suggest, though still rarely. We have told clients not to buy a backup product when all of the following were true: the company's legally relevant records live in a separate system that is already backed up, such as an accounting platform or a document management system. Microsoft 365 is used for day-to-day communication whose value fades within weeks. Retention policies in Microsoft Purview are configured and someone checks them. And the owner has consciously accepted that a mailbox deleted more than 30 days ago is gone.

That describes some two-person consultancies and a few businesses that use Microsoft 365 as little more than an email service. It does not describe a company where offers, contracts and customer correspondence live in mailboxes and SharePoint libraries, which is nearly every company with more than a handful of staff. If you are unsure which group you are in, the five questions below decide it.

Five questions that decide whether you need a backup

Answer these honestly for your own company. One "yes" is a strong argument for a backup. Two or more and the discussion is over.

• Do you have to keep any of this data for years? In Germany, business correspondence must be retained for six years and invoices for eight. If those documents exist only in mailboxes and SharePoint, a 93-day recycle bin does not meet a six-year duty. How record-keeping rules translate into IT settings is the ground our IT governance and compliance service covers.
• Would you notice a deletion within 90 days? Most losses we see are discovered late: a folder tidied away in March is needed in a dispute in October. If nobody reviews your libraries regularly, the honest answer is no.
• Has an employee ever left the company? Offboarding deletes the account, and 30 days later the mailbox and OneDrive follow. Unless every leaver's data is deliberately moved first, staff turnover quietly destroys records.
• Could a single compromised admin account reach everything? In most small tenants it could, including the recycle bins and the retention policies. Only a copy outside the tenant survives that. A Microsoft 365 security assessment shows how exposed your admin accounts actually are.
• How long could you work without one key mailbox or one project site? If the answer is "not a single day", you need point-in-time restore, not a search-and-export exercise through compliance tools.

For regulated professions the first question answers itself. A law firm or a tax and accounting practice carries retention duties on practically every client file, and "the account was deleted when she left" is not something a chamber or an auditor accepts.

Three ways to close the gap, compared

If the questions above say you need more than the defaults, you have three options. They solve different problems, and many of our clients combine two of them. The table compares them on where the copy lives, how far back it reaches, how a restore works and what it costs.

Retention policies are worth switching on in any case, they cost nothing extra on the right plan. But they preserve, they do not restore, and they sit behind the same admin accounts as everything else. Microsoft 365 Backup is the fastest way to get a large tenant back, and since it gained file-level restore for SharePoint and OneDrive it is practical for small incidents too. Its limit is that the backup never leaves Microsoft. A third-party product is the only option of the three that gives you a copy outside the platform, and the only one that comfortably reaches six or eight years. For ransomware resilience the copy should also be unchangeable, which we explain in immutable backups and the 3-2-1-1-0 rule.

What does it cost for a 20-person company?

Take a typical client: 20 users, 400 GB across mailboxes, OneDrive and SharePoint. A third-party product at three euros per user comes to 60 euros a month, about 720 euros a year, normally with unlimited storage and retention. Microsoft 365 Backup at $0.15 per gigabyte comes to $60 a month for the same 400 GB, and grows with your data rather than your headcount. It needs an Azure subscription for billing.

The pricing model matters more than the headline figure. Per-user pricing favours companies with a lot of data per person, such as agencies and architects with large project files. Per-gigabyte pricing favours companies with many light users, and it lets you protect only the mailboxes and sites that matter rather than every account. Either way you are looking at well under a thousand euros a year for a company of this size, which is less than a single day of two people reconstructing a lost project site from email attachments.

What no Microsoft 365 backup covers: your configuration

One gap stays open whichever option you choose. Backup products protect content: emails, files, sites. Most of them do not protect the settings that make your tenant safe, such as Conditional Access policies, Intune device policies, sharing restrictions and mail flow rules. If an attacker or a mistake wipes those, restoring the data brings back the files but not the locks on the doors.

The practical answer is documentation rather than another product: export the security configuration, keep it outside the tenant, and review it when it changes. That is part of how we run cloud security for clients, and it is the piece most often missing when we take over a tenant that "already has a backup".

How do you know the backup actually works?

By restoring from it. A backup that has never been restored is an assumption. Twice a year, pick one mailbox and one SharePoint folder, restore them to a separate location, and check three things: that the content is complete, how long the restore took, and that the person doing it could follow the procedure without the one colleague who set it up. Write the result down. Running and recording these tests is a fixed part of our backup and recovery service. That single page is also what an auditor, an insurer or a large customer's security questionnaire will ask for.

While you are at it, check the backup report for accounts that are not covered. New mailboxes and newly created teams are the usual gap, because many products only protect what existed on the day they were configured unless auto-discovery is switched on.