Does a Small Business Need Microsoft 365 Backup? What's Built In and What Isn't (2026)

By Justin N. · Updated 2026-10-22 · This page may contain affiliate links

Microsoft 365 holds on to deleted email and files for a while, and that saves most "I deleted it by accident" days. But those are short recovery windows, not a backup you control. Here's exactly what's built in, where it runs out, and what your options cost.

Who this is for: a 5–50 person business on Microsoft 365 Business Standard or Business Premium, with email in Exchange Online and files in OneDrive, SharePoint, and Teams. Time windows below are Microsoft's defaults as documented on Microsoft Learn on 2026-10-22. Your tenant may have different settings.

The short answer

Microsoft's own position is that your data is your responsibility. Its shared-responsibility guidance says that for every cloud model, including SaaS like Microsoft 365, "you own your data and identities" and you're responsible for protecting them (Microsoft Learn: Shared responsibility in the cloud).
The built-in recovery windows run from about 14 days to 93 days, depending on what was deleted. If someone notices a problem after the window closes, the data is gone.
If losing a month of email or a project folder would really hurt the business, add a backup. You can use Microsoft's own pay-as-you-go Microsoft 365 Backup or a third-party service. Both are covered below.

What Microsoft 365 keeps for you (and for how long)

What was lost	Built-in safety net	Default window
Deleted email (after emptying Deleted Items)	Recoverable Items folder	14 days by default. An admin can raise it to a maximum of 30 days. Calendar items are kept for 120 days. (Recoverable Items folder)
Deleted SharePoint or Teams files	Site recycle bin, then site collection recycle bin	93 days total, counted from the original deletion. (Restore items in the recycle bin)
A user's whole OneDrive encrypted, overwritten, or mass-deleted	"Restore your OneDrive"	Undo changes from the last 30 days. (Restore your OneDrive)
A deleted user account (with its mailbox)	Restore the user	Within 30 days of deletion, the account and its data are restored. (Restore a user)
A deleted user's OneDrive	OneDrive retention for deleted users, then the recycle bin	30 days by default (adjustable in the SharePoint admin center), then 93 days in the site collection recycle bin, restorable only with PowerShell. (OneDrive retention and deletion)
A OneDrive whose license was removed but the user wasn't deleted	Unlicensed OneDrive handling	Read-only after 60 unlicensed days and archived after 93 unlicensed days. (Manage unlicensed OneDrive accounts)

Easy-to-miss detail: when the Recoverable Items warning quota is reached before the retention period ends, Microsoft says messages are deleted first in, first out. So a very full mailbox can lose recoverable items sooner than 14 days. (Recoverable Items folder)

Where the built-in safety nets stop

None of the features above were designed as a backup you control. In practice, here's where small businesses get caught:

Late discovery. Someone cleans out a shared folder in March and nobody notices until a client asks for a file in July. That's past the 93-day recycle bin window.
Offboarding mistakes. Deleting a departed employee's account starts a 30-day clock on their mailbox and OneDrive. If no one copied what mattered, it's gone after that. (See the offboarding checklist.)
Ransomware and bulk changes. "Restore your OneDrive" covers 30 days per user. Larger, multi-user events are the scenario Microsoft itself names as the reason Microsoft 365 Backup exists. (Overview of Microsoft 365 Backup)
One copy, one admin boundary. If a compromised admin account deletes data and empties recycle bins, the built-in windows are the only thing between you and loss.

Option 1: Microsoft 365 Backup

Microsoft sells its own backup for OneDrive, SharePoint, and Exchange Online. What Microsoft documents, as of 2026-10-22:

Price: $0.15 per GB per month for all data protected by Backup. Restores are free. It's pay-as-you-go, not per user.
Recovery window: set per backup policy to 3 months, 6 months, 1 year, or 2 years.
Restore points: for OneDrive and SharePoint, every 10 minutes for the past two weeks, then weekly. For Exchange, every 10 minutes for the prior 52 weeks.
Where the copy lives: inside the Microsoft 365 data boundary, in append-only storage. If you offboard from Backup, Microsoft keeps a fixed 90-day grace period in which you can still recover your backups.
What you need to set it up: an Azure subscription linked for pay-as-you-go billing, with Owner or Contributor access on that subscription, plus the SharePoint Administrator or Global Administrator role to set it up. Microsoft also has a dedicated Microsoft 365 Backup Administrator role for day-to-day management. (Set up Microsoft 365 Backup)

Rough cost example (hypothetical): if the mailboxes, OneDrives, and SharePoint sites you protect add up to 300 GB, that's 300 × $0.15 = $45 a month at the documented rate. Check your actual storage in the admin center before you estimate, and watch the bill in Azure Cost Management, which Microsoft says shows the cost breakdown (Microsoft 365 Backup billing).

Good fit if: you want fast, large restores and don't need a copy outside Microsoft. Think twice if: your insurer, auditor, or own risk policy asks for a copy held by a separate provider.

Option 2: A third-party backup service

Several vendors back up Exchange Online, OneDrive, SharePoint, and Teams into their own storage. Pricing is usually per user, and plans differ in what they cover, so compare on the questions in the vendor checklist below rather than on the homepage price.

Examples of vendors with Microsoft 365 backup products:

I haven't reviewed these products here. The list is just a starting point, and the links are ordinary links.

Option 3: Retention policies (not a backup, but useful)

Microsoft Purview retention policies and labels can keep content for a set period even if a user deletes it. Microsoft also notes that retention settings take precedence over the standard OneDrive deletion process (OneDrive retention and deletion). That's valuable for "we must keep email for X years" requirements. It isn't a point-in-time restore of a whole mailbox or site, so treat it as a compliance tool. Check which retention features your plan includes (the Business Premium vs E3 comparison covers the basics) in the Microsoft Purview service description. (Learn about retention policies and labels)

A decision checklist

Would losing more than 30 days of one person's email or files cause real harm? If no, the built-in windows plus a careful offboarding process may be enough for now.
Do you have a written requirement for backups (cyber insurance, a client contract, an industry rule)? If yes, read the exact wording. Some require a copy that's separate from the primary provider.
Need fast restores and comfortable keeping everything inside Microsoft? Price out Microsoft 365 Backup using your real storage numbers.
Need a copy held by a separate company? Shortlist third-party vendors and use the questions below.
Whatever you pick, test a restore of one mailbox folder and one SharePoint folder in the first week, then put a reminder on the calendar to do it again each quarter.

Questions to ask any backup vendor

Which workloads are covered: Exchange, OneDrive, SharePoint, Teams chats, Teams channel files? Are any extra-cost?
How often does it back up, and how long are backups kept on the plan you're quoted?
Where is the data stored (country/region), and who can delete backups? Is there protection against an attacker deleting them?
Can you restore a single email or file, and also a whole mailbox or site?
Is pricing per user or per GB, and what happens to backups of departed users when you remove their license?
How is the vendor's access to your tenant granted, and how do you revoke it?

Sources

Where to get it: Microsoft 365 Backup is set up in the Microsoft 365 admin center. Third-party options are linked in Option 2. These are ordinary links, not affiliate links.

Accuracy note: Microsoft changes admin center menus and licensing often. Paths and prices were checked against Microsoft documentation on 2026-10-22. If something has moved, tell me at [email protected].