Does Microsoft 365 Back Up Your Data? Why NZ Small Businesses Still Need a Separate Backup

Microsoft 365 doesn’t give you a true backup of your data. Microsoft looks after the platform and keeps deleted items for a short window, but the files and email inside it are your responsibility to protect and restore. Here’s what Microsoft does cover, and where its protection stops.

What Microsoft Handles

Microsoft builds resilience into the service itself. Its data resiliency documentation describes near real-time duplicate copies of OneDrive and SharePoint content, with failover that most users never notice.

That protects you from a failed disk or a data centre problem. It doesn’t protect you from a bad afternoon. Replication copies mistakes just as faithfully as it copies good work, so a deleted folder disappears everywhere at once.

What Stays With You

Under the shared responsibility model, Microsoft runs the infrastructure and you own the data. That includes what happens when someone deletes it, overwrites it or locks it with ransomware.

Think of renting an office in a secure building. The landlord maintains the walls and locks. If you leave the filing cabinet open and a client file walks out, that’s on you.

Microsoft’s native tools still handle plenty of everyday slip-ups. Recycle bins, file versions and retention settings cover many routine mistakes. They just weren’t built for big incidents or long memories.

What Is Managed Microsoft 365 Backup?

A managed service means a provider sets up the backup, watches the jobs, fixes failures, tests restores and runs the recovery when something goes wrong. You get the protection without hiring a specialist or adding another system for one busy person to look after.

A good managed service gives you an independent copy that sits outside your everyday admin logins, the ability to restore a single file or mailbox item, scheduled restore tests, alerts when a job fails and a regular report on backup health. It also gives you a person to call, which matters most on the day you need a restore.

CyberMark Agency’s backup and disaster recovery services cover Outlook, OneDrive and SharePoint, with Backblaze B2 cloud storage, AES-256 encryption, immutable versions, scheduled restore testing and a monthly backup health report. Plans start from $17.32 NZD a month on a month-to-month basis, with an NZ-based support team.

How Long Does Microsoft 365 Keep Deleted Data?

These are the default windows for the workloads that matter most:

Workload	Default recovery window	Source
SharePoint Online	93 days from deletion, counted across both recycle bin stages	Microsoft Support: SharePoint recycle bin
OneDrive (work or school account)	93 days, unless an admin changes the setting	Microsoft Support: restore OneDrive files
Exchange Online mailbox	14 days by default, and admins can raise it to 30	Microsoft Learn: deleted item retention

These are defaults at the time of writing. Check your own tenant settings, because an admin may have changed them.

Here’s how it plays out. Imagine your bookkeeper clears an old client folder on 1 March. SharePoint’s 93-day window closes on 2 June, so when the accountant asks for those files in the second week of June, they’re gone.

Why a Recycle Bin and Retention Policy Aren’t a Backup

A recycle bin restores individual items. It doesn’t roll back a whole site after a mass overwrite, and it empties on a timer. Retention policies are a different tool again. They preserve content for compliance and legal reasons rather than giving you a point-in-time copy to restore from. Microsoft’s own backup recovery window is not affected by retention or deletion policies.

There’s one useful nuance. Microsoft 365 subscribers can restore a whole OneDrive to any point in the last 30 days. That helps with a recent incident, but it won’t help if you spot something three months later.

What Can Go Wrong Without a Microsoft 365 Backup?

Data loss is usually quiet and discovered late. Three scenarios cover most of it.

Accidental Deletion

This is the everyday one. Someone tidies a shared site, deletes the wrong library, and nobody notices until the quarter-end rush.

Picture a 12-person accounting firm where a staff member removes a folder of signed engagement letters on a Friday. The recycle bin might save them, but only if someone looks within the window.

A backup with granular recovery lets you restore a single file, folder or mailbox item from a chosen date. No drama, no rebuilding from memory.

Ransomware and Compromised Accounts

Ransomware doesn’t care that your files live in the cloud. Sync tools copy changes up to OneDrive and SharePoint, so encrypted files can spread from a laptop into your cloud storage. Microsoft’s own guidance on restoring OneDrive covers files that were deleted, overwritten, corrupted or infected by malware.

Backup is the safety net. Stopping ransomware before it spreads is the job of endpoint detection and response, and if an attack does land, security incident response support shortens the time you spend offline.

A stolen password causes the same headache. An attacker with admin rights can delete data and hide their tracks, and the recovery clock starts the moment they do.

Malicious Deletion by Insiders

A staff member leaving on bad terms can delete files before they hand back their laptop, which is one of the more common insider threats small businesses face. The same recovery windows apply. Without a separate backup, you rely on whatever the recycle bin still holds.

Microsoft 365 Backup and NZ Compliance Requirements

Backup isn’t only an IT worry. Two NZ obligations make the short native windows a business risk.

Seven Years of Tax Records

Business.govt.nz says small businesses need to hold on to tax records for at least seven years, and Inland Revenue’s records guidance says that includes records kept in electronic form. If those records live in SharePoint, OneDrive or email, a 14 to 93 day recovery window falls a long way short.

A backup doesn’t replace good record keeping. It gives you a second route to the files when the first one fails.

Privacy Act 2020 and Lost Access

The Office of the Privacy Commissioner describes a notifiable privacy breach as personal information that has been accessed, disclosed, altered, lost (including temporary loss of access) or destroyed without authorisation, where serious harm is reasonably believed or likely. Notification is required as soon as practicable, and the Commissioner’s office expects it within 72 hours of becoming aware.

So a ransomware attack that locks client records can raise Privacy Act questions, not just IT ones. A documented incident response plan and a clear view of your Privacy Act 2020 obligations make that first day far less chaotic.

A backup shortens the outage and helps you show you took reasonable steps. It doesn’t make you compliant by itself, and this isn’t legal advice.

Choosing the Best Microsoft 365 Backup Solution

You’ve got three realistic options. Each suits a different kind of business.

Microsoft 365 Backup (Microsoft’s Own Product)

Microsoft sells its own backup service for OneDrive, SharePoint and Exchange Online. Retention is set per policy, from three months up to two years. OneDrive and SharePoint get restore points every 10 minutes for the previous two weeks and weekly snapshots after that, while Exchange Online gets 10-minute restore points across the prior 52 weeks.

Microsoft lists pricing at US$0.15 per GB per month, with free restores, so confirm current rates before you budget. Microsoft also says its backups use append-only storage, which protects them from malicious overwrites.

The trade-off is that the data stays inside the Microsoft 365 trust boundary. If you want a copy under different control, you’ll need something else as well. The service covers those three workloads only, so check how you’d recover Teams and anything else you rely on.

Third-Party Microsoft 365 Backup

Tools such as Veeam Backup for Microsoft 365 let you store backups on-premises or in cloud object storage such as Amazon S3 or Azure Blob, with granular recovery of individual items. That gives you a copy outside your Microsoft tenant, which fits the 3-2-1 backup rule: three copies, on two types of storage, with one offsite.

The trade-off is another vendor, another bill and another system to keep healthy. Somebody has to watch the backup jobs.

Managed Microsoft 365 Backup

A managed service puts the setup, monitoring, failure fixes and restores in a provider’s hands. It suits businesses with no in-house IT, or with one busy person already juggling everything. Ask any provider exactly which Microsoft 365 workloads they cover, how long they keep versions and how often they test restores.

Option	Best for	Watch out for
Microsoft 365 Backup	Fast restores inside Microsoft 365	Covers three workloads and stays inside Microsoft’s boundary
Third-party tool	Teams with IT staff who want an independent copy	More admin and a separate vendor
Managed service	Small businesses without in-house IT	Provider quality and clear coverage terms

What to Look for in Any Backup Solution

Whichever route you take, test it against this list:

• Workloads covered: Exchange Online, SharePoint, OneDrive for Business and Teams.
• Granular restore: Can you bring back one email or one file, not just a whole site?
• Backup frequency: How often does the tool run, and what’s the worst-case data loss (your recovery point objective)?
• Retention length: Is it long enough for the records you hold, and how are older versions handled?
• Separate, protected storage: Can an attacker with a stolen admin login delete your backups?
• Alerts: Does someone get told when a backup job fails?
• Restore speed: How long until staff can work again (your recovery time objective)?

Microsoft 365 Backup Best Practices

Here’s a practical routine.

• Follow the 3-2-1 rule: Keep three copies of important data, on two storage types, with one copy offsite or outside your tenant.
• Write down your recovery targets: Decide how much data loss you can live with, and how long you can stay offline, in plain language.
• Lock down the backup admin account: Use multi-factor authentication, and keep it separate from everyday admin logins.
• Switch on failure alerts: A silent backup failure is how people discover problems on the worst day.
• Test restores on a schedule: We’d suggest quarterly. Restore a file, a mailbox and a site, and time how long it takes.
• Review when things change: New staff, new SharePoint sites and new apps all change what you need to protect.

Frequently Asked Questions

Is Microsoft 365 backup required under the NZ Privacy Act?

Not by name. The Privacy Act 2020 doesn’t mention Microsoft 365 backup, but temporary loss of access to personal information can count as a breach.

Can you restore a deleted Microsoft Teams channel?

Yes, within 30 days. A team owner can restore it from Manage team, under Deleted in the Channels tab. After that, you need a backup that covers Teams.

Why do I need a managed backup for Microsoft 365 if it’s already in the cloud?

Cloud hosting keeps the service available, not your history. A managed provider also watches for failed jobs, tests restores and handles recovery, so protection doesn’t depend on one busy person.

What is immutable backup for Microsoft 365?

It’s backup storage that can’t be altered or deleted for a set period. That means ransomware or a stolen admin login can’t wipe your recovery copies.

What is the difference between M365 retention and backup?

Retention preserves content for compliance or legal reasons. A backup gives you point-in-time copies to restore after deletion or an attack.

How do you recover permanent SharePoint deletions?

Within 93 days, a site collection admin can restore items from the second-stage recycle bin. After that window closes, only a separate backup can bring the data back.

How does managed backup help with eDiscovery?

It doesn’t replace Microsoft Purview eDiscovery. It can help when data was deleted before a hold, depending on the provider’s retention length.

How long does it take to restore a full M365 tenant?

It depends on data size and restore method, so ask for times in writing. Microsoft says a single OneDrive or SharePoint site restores in 10 to 120 minutes on average.

Which Managed Microsoft 365 Backup Option Is Right for Your Business?

Microsoft 365 keeps your service running, but protecting what’s inside it is your job. Recycle bins empty after 14 to 93 days, ransomware can encrypt synced files and a single deleted folder can go unnoticed until it’s too late. Add NZ’s seven-year record-keeping expectations and the Privacy Act 2020, and the gap between what Microsoft covers and what your business needs is hard to ignore.

The fix doesn’t have to be complicated. Choose a backup approach that fits your team, keep an independent copy outside your tenant, lock down the admin account, switch on failure alerts and test a restore this month.

If you’d rather not manage it yourself, you can book a free security assessment with CyberMark Agency. It takes 15 to 30 minutes, maps what is currently backed up, flags the recovery gaps and reviews the recovery targets that suit your business and your compliance obligations.