Microsoft 365 backup: what Microsoft protects and what’s on you
A 68-person distribution business in Navi Mumbai had paid for Microsoft 365 for six years. Nobody in the room could say what would happen if somebody emptied the wrong SharePoint library on a Friday evening.
Microsoft 365 backup is your responsibility, and Microsoft says so in its own Services Agreement. Your subscription buys short recovery windows with clocks attached to them. Fourteen days on a permanently deleted email, thirty if an admin has raised the setting. Ninety-three days in the SharePoint and OneDrive recycle bin. Thirty days on a leaver’s OneDrive before the next countdown starts.
Microsoft now sells its own backup service at USD 0.15 per GB per month, which changed the buying question instead of closing it. The line that decides your cost is roughly 20 GB per user. Hold more than that in your tenant and per-user third-party pricing usually wins. Hold less, and Microsoft’s own meter is cheaper.
The email came to me on a Wednesday with four words typed above the forward. Do we need this.
Under it was a quote for a Microsoft 365 backup product, priced per user per month, for a distributor that moves industrial spares out of two warehouses and a Vashi office. Sixty-eight licensed users. The annual figure at the bottom was a little under two lakh.
The Managing Director had already decided. We pay Microsoft every month, he said, and now we are paying somebody else to keep the same data. Explain that to me.
It is a fair question. It is also the argument their IT manager had been losing for two years, so I asked him instead. If Ravi in accounts deletes the vendor master folder tonight and nobody notices until the audit in March, what happens?
He said he would restore it from the recycle bin. Bas. Then he stopped, because he had heard the March part.
The line in Microsoft’s own agreement
Start where the contract starts, because that is where the argument ends.
The Microsoft Services Agreement carries this sentence: “We recommend that you regularly backup Your Content and Data that you store on the Services or store using Third-Party Apps and Services.” A few clauses later, on account closure, it is blunter. “You should have a regular backup plan as Microsoft won’t be able to retrieve Your Content or Data once your account is closed.”
That is the vendor telling you, in the document you already agreed to, that the copy is on you.
The split has a name. Microsoft runs the platform, the data centres, the replication between them, the uptime commitment. You own what happens inside your tenant. Somebody on your payroll deleting the wrong thing is not a Microsoft failure, and geo-redundant replication does exactly what it is designed to do when that happens. It replicates the deletion, faithfully, to every copy.
Point being: replication protects you from Microsoft having a bad day. It does nothing about your own team having one.
What you actually get by default
Your subscription does include recovery. It is real, it works, and I have used it many times. It just has clocks attached, and almost nobody in the buying meeting knows what they are set to.
A permanently deleted email goes into the Recoverable Items folder and sits there for 14 days by default, extendable by an administrator to a maximum of 30. Not 90. Not a year. Calendar items get 120 days, which surprises people who assume mail gets the same.
Files deleted from SharePoint or OneDrive are kept for 93 days from the moment of deletion. That 93 days is the total across both recycle bins, not 93 plus 93. If somebody empties the site recycle bin, the item moves to the site collection bin and lives out whatever is left of the same 93 days.
When an employee leaves and you delete the account, their OneDrive is retained for 30 days by default, then moved to the site collection recycle bin for 93 more. There is a detail in that same Microsoft page worth reading twice. An unlicensed OneDrive is archived on its 93rd unlicensed day, and after twelve months in unpaid archive the data may be deleted regardless of your retention policies, your eDiscovery holds, all of it.
None of these clocks are secret. They are published, they are sensible defaults, and they were designed for the accident you notice this week. They were never designed for the one you notice in the March audit.
Every native recovery window in Microsoft 365 assumes somebody spots the problem quickly. Ransomware that encrypts in the background, a departed employee’s mailbox nobody opens, a misconfigured sync that overwrites a library, and a finance folder wiped in October and missed until March all share the same shape. By the time anyone looks, the clock has run out.
The four ways it goes missing
Across every one of these arguments I have sat in on, the loss is almost never exotic. Arre, it is always the same four things.
Somebody deletes something and says nothing, because admitting it feels worse than hoping. That is the common one. A leaver’s account gets cleaned up on the day HR closes the file, and eight months later somebody needs the contract thread with a supplier that only existed in that mailbox. Ransomware encrypts a mapped drive that syncs cheerfully up to SharePoint, versioning included. And the invisible one, a sync or migration misconfiguration that overwrites good data with stale data across thousands of files in an afternoon.
Three of those four are invisible on the day they happen. That is the entire problem, and it is why a recovery window measured in days is the wrong instrument.
We have seen a Bengaluru firm lose a Sales Director’s inbox on day 96 after his exit, which is six days past the point where anything could be done about it. We wrote that one up in detail if you want the full retention post-mortem on the mailbox-gone Monday.
Where I was wrong for about eighteen months
Now the part I have to own, because I used to give a shorter answer than the question deserved.
My line for years was that native Microsoft 365 protection is not backup, therefore buy third-party backup. Clean, true enough, and it made every one of these meetings quick. Then Microsoft shipped its own backup service and my clean answer stopped being complete.
Microsoft 365 Backup covers Exchange Online, SharePoint and OneDrive with a one-year retention period, recovery points every ten minutes for the prior two weeks, then weekly snapshots out to 52 weeks. Restores are free. It is pay as you go at USD 0.15 per GB per month of protected content, with no extra licence beyond the Exchange or SharePoint licence the data already sits on.
So the honest position now has two parts. Microsoft is still not backing you up by default, and Microsoft launching a paid backup product is the loudest possible confirmation of that. But the choice in front of a 68-person distributor is no longer third-party or nothing. It is a real three-way, and the answer moves with the shape of your tenant.
The number that decides it: about 20 GB per user
Here is the arithmetic I put on the whiteboard in that room, and it is the only part of this article anyone wrote down.
Microsoft charges by the gigabyte. Almost every third-party Microsoft 365 backup vendor charges by the user, typically somewhere around USD 2 to 5 per user per month with storage bundled in.* Set those two equal and the crossover falls out. At a three-dollar per-user price, you break even at 20 GB of protected data per user.
Under 20 GB a head, Microsoft’s meter is cheaper and simpler, and it lives in the admin centre you already use. Over 20 GB a head, and a data-heavy tenant gets there faster than anyone expects, the per-user model wins and keeps winning as your data grows.
The distributor had about 2 TB across mailboxes, OneDrive and SharePoint. Two thousand gigabytes over 68 users is a shade under 30 GB each. On Microsoft’s meter that is 300 dollars a month, roughly 26,000 rupees, a little over three lakh a year.* The quote on the MD’s desk was under two lakh. The vendor was not overcharging him. He was about to reject the cheaper option because it arrived as a separate invoice.
| What goes wrong | Native Microsoft 365 | Microsoft 365 Backup | Third-party backup |
|---|---|---|---|
| Email deleted, noticed in a week | Yes, 14 days default and 30 at most | Yes, up to 1 year | Yes, retention you set |
| File deleted, noticed in five months | No, 93 days is the ceiling | Yes, up to 1 year | Yes, retention you set |
| Leaver mailbox needed a year later | Only with a hold set beforehand | Yes, if the mailbox was protected | Yes, if the mailbox was protected |
| Ransomware across a synced library | Slow, item by item, often incomplete | Fast rollback of the whole site | Yes, speed varies by vendor |
| Teams chat and channel history | Partial, and it lives in Exchange | Not covered as a workload | Usually covered, confirm in writing |
| Entra ID users, groups, conditional access | 30-day soft delete on users only | Not covered | Usually covered, confirm in writing |
| A copy outside the Microsoft tenant | No | No, it stays inside the boundary | Yes, that is the point of it |
| How you pay | Included | Per GB per month | Per user per month, typically |
Two rows in that table are where the money and the argument sit. Teams and Entra ID.
The question Microsoft’s own paper will not answer for your auditor
Microsoft 365 Backup keeps your backup inside the Microsoft 365 trust boundary, in its native encrypted format. Microsoft is straightforward about why. It is faster to restore, and no outside application needs a tenant-wide token to read every file you own. Both are good arguments and I make them to clients.
Microsoft’s own backup best-practices whitepaper then goes a step further. On the requirement some regulated industries have for a copy of data held outside the service, it says the company’s general stance is that the requirement is outdated for SaaS.
Maybe. But your auditor has not read that whitepaper, and if you sell to a bank or an insurer, their vendor questionnaire is going to ask where an independent copy of their data sits. Answering “inside the same vendor you are asking us about” starts a longer conversation than anyone wanted that week. Same story if the risk you are insuring against is a billing lapse, a tenant lockout, a compromised global admin, or a dispute with Microsoft itself. A copy held inside the tenant does not help with any of those, by design.
That is the point where a company either buys the third-party product or writes down, in one line, why it does not need one. Either is a defensible position. Having neither is what shows up in the audit.
What I would do, in this order
First, find out what your clocks are set to today. Ask your admin for the deleted item retention on user mailboxes, the OneDrive retention for deleted users, and whether litigation hold is on for anybody. Most firms find at least one of the three at its default and nobody remembers choosing it.
Second, measure your tenant. Total GB across Exchange, OneDrive and SharePoint, divided by licensed users. That single number puts you on one side or the other of the 20 GB line, and it turns the quote in front of you from a feeling into a calculation.
Third, decide the boundary question before you compare products. If an independent copy outside Microsoft matters to your customers or your regulator, the per-GB native option is off the table whatever it costs, and the comparison gets much shorter.
Fourth, and I care about this one more than the rest, restore something. Pick a file and a mailbox item, restore both, time it, and write down the number. A backup nobody has tested is a subscription. You find out which one you bought on the worst possible morning. We have watched a perfectly configured backup fail its first real restore because nobody had ever tried, and that morning is not one you want to have.
Where this usually starts is licensing, thoda boring but it pays. Most mid-size Indian companies are either over-licensed on plans they do not use or under-protected on the ones they do. Our Microsoft 365 and cloud practice runs that review for free, and more than once the shelfware we find has paid for the backup the client came to us about. If your tenant has grown by acquisition, read the permissions audit story first, because a backup of a badly governed tenant just preserves the mess with more fidelity.
What to take away
- The contract already told you. The Microsoft Services Agreement recommends you back up your own content. Replication protects Microsoft’s uptime, not your data from your own people.
- Know your three clocks. 14 days on deleted mail, 30 at most. 93 days in the SharePoint and OneDrive recycle bin. 30 days on a leaver’s OneDrive. Anything discovered later than that is gone.
- Do the 20 GB sum. Total protected GB divided by licensed users. Above roughly 20, per-user third-party pricing usually wins. Below it, Microsoft’s own per-GB service is cheaper.
- Check Teams and Entra ID in writing. Microsoft 365 Backup does not cover them. If a vendor says they do, get it in the order form, not the sales deck.
- Decide the boundary question early. If a regulator or a customer needs a copy outside Microsoft, native backup cannot give you one, and no amount of price comparison changes that.
- Test one restore this quarter. Time it. Write the number down. That number is the only proof your plan works.
Questions the MD asked after the whiteboard came out
Do you really need to back up Microsoft 365?
Yes, if you need to recover anything you might discover late. Microsoft protects the platform and replicates your data for availability, and its Services Agreement recommends that customers keep their own backup. What your subscription gives you is short recovery windows: 14 days on permanently deleted mail, extendable to 30, and 93 days in the SharePoint and OneDrive recycle bin. Accidental deletion noticed in week one is covered. Ransomware, a leaver’s mailbox, or a finance folder missed until the audit is not.
What does Microsoft 365 Backup cost in India?
It is billed in dollars at USD 0.15 per GB per month of protected content, with restores free and no additional licence beyond the Exchange or SharePoint licence the data already sits on. There is no separate India list price, so your cost tracks the exchange rate and lands on your Microsoft invoice. For a tenant holding 2 TB, that is about USD 300 a month, roughly 26,000 rupees at current rates. Bill in your own currency only if your CSP partner offers it.
Is Microsoft 365 Backup better than a third-party backup tool?
It depends on two things, and price is only the first. Microsoft’s service is per GB, most third-party tools are per user, so break-even sits around 20 GB of protected data per user. The second is the boundary. Microsoft 365 Backup keeps your copy inside your Microsoft tenant, which restores faster and avoids giving an outside app broad access to your content. A third-party tool puts the copy somewhere else, which is what a regulator or an enterprise customer usually wants to see. Decide the boundary first, then compare price.
Does Microsoft 365 Backup cover Teams and Entra ID?
No. Microsoft 365 Backup protects Exchange Online, SharePoint and OneDrive. Teams is not a covered workload, although chat and channel messages are stored in Exchange and SharePoint underneath. Entra ID objects such as users, groups and conditional access policies are not covered at all, beyond the standard 30-day soft delete on a deleted user. Most third-party tools do cover both. Ask for it on the order form rather than the brochure, because coverage differs a lot between vendors.
How long does Microsoft keep a deleted employee’s mailbox and OneDrive?
Delete the account and the OneDrive is retained for 30 days by default, then moved to the site collection recycle bin for 93 more. The mailbox follows the deleted user record, which shows in the admin centre for 30 days. You can extend OneDrive retention up to 3,650 days in the SharePoint admin centre, or convert the mailbox to an inactive mailbox with a hold before you delete the account. Both need doing beforehand. After the fact there is nothing to press. If offboarding is the gap, that is what our cloud and Microsoft 365 practice tightens first.
Not sure which side of the 20 GB line you are on?
Send us your licensed user count and we will pull the tenant storage number with you, work out your cost both ways, and tell you plainly if you already have enough protection. If the answer is buy nothing, we will say buy nothing. 200+ Indian businesses work with Sirius Star from Vashi, Navi Mumbai. Response within 24 working hours.
The MD signed the third-party quote, and not because of my arithmetic. Their largest customer is a private bank, and two weeks later the bank’s vendor questionnaire landed with a question about where an independent copy of their data was held. He forwarded it to me with three words this time. Haan, good timing. Nobody in that room had been wrong. The IT manager was right that the recycle bin covers the accident you notice on Tuesday. The MD was right that paying twice for one thing deserves an explanation. The gap between them was a number nobody had measured. If you are holding a backup quote and cannot say what your tenant holds per user, that is the number to get before you sign anything. We will pull it with you, no charge.
One page. Every retention clock in your tenant, the default value, where to check it, and a blank column for what yours is actually set to. Hand it to your admin and you will have the whole picture back in an hour.
Send me the retention audit sheet
* Third-party per-user pricing varies by vendor, term and workload coverage, and the rupee figures here move with the exchange rate. Treat both as working numbers for your own calculation, not as a quote.
