Microsoft 365 Backup NZ: What Your Business Can Recover

A staff member empties a full mailbox to free up space. Three months later you need an attachment that went with it, and it is nowhere to be found. The business assumed Microsoft 365 had a copy. What Microsoft actually held depended on settings nobody had looked at, and by then the window had closed.

This is the most common misunderstanding we see. The logic feels sound: the data is in the cloud, Microsoft is a giant, surely they are backing it up. Microsoft does provide recovery tools, and it sells a backup service of its own. What it cannot do is decide what your business needs to be able to recover, or how far back.

Microsoft keeps the platform running and gives you recycle bins, version history and retention policies. Those recover a great deal, inside conditions and time limits most businesses have never read. Deciding what has to be recoverable, for how long and by whom is the customer’s job, and most businesses only look at it after something is already gone.

The retention windows inside Microsoft 365 are longer than most articles claim, and they are more conditional too. Which stage an item was deleted from, which policies apply, and how the site or account was configured all change the answer. This guide gives the actual figures with their conditions, explains where an Office 365 backup adds something the built-in tools do not, and sets out how to decide what your business needs.

If you want the wider principles behind protecting business data, our guide to a data backup strategy covers the model. This page is about Microsoft 365 specifically, and about what an Office 365 backup does and does not add to it.

What does Microsoft 365 not protect against?

Microsoft 365 does not protect you from the things that cause most data loss: human error, malicious deletion, account compromise and ransomware. These are the everyday events that wipe out business data, and native retention expires on a clock you do not control.

How long does Microsoft actually retain deleted data?

Longer than most articles claim, and still not long enough. Microsoft publishes the figures, and they are worth knowing precisely rather than vaguely.

In Exchange Online an item is soft deleted when a user removes it from Deleted Items, empties that folder, or presses Shift+Delete somewhere else. Only then does it enter the Recoverable Items folder, where it is held for 14 days by default, raisable by an administrator to a maximum of 30. Ordinary deletion moves the item to Deleted Items first, so the clock usually starts later than people expect. In SharePoint and OneDrive, deleted items move through a first and second stage recycle bin over a total of 93 days from the original deletion.

These are different mechanisms with different conditions, not one deadline, and an Office 365 backup sits alongside them rather than replacing them. Before concluding that something is gone, check which stage it was deleted from, what the mailbox or site is configured to do, and whether a retention policy applies. What they have in common is that every clock starts at the deletion and not at the moment somebody notices, and losses are usually found late.

Searchability works differently in each product. Exchange’s Recoverable Items folder is indexed by Exchange Search and can be discovered through eDiscovery and Content Search, so soft-deleted email remains findable. In SharePoint and OneDrive the recycle bin is not where you search; where a retention policy applies, deleted content is copied into a hidden Preservation Hold library and kept there instead. What you can produce for a legal or client request therefore depends on the policies configured, not on the recycle bin.

What about accidental and malicious deletion?

Both are common and both are yours to recover from, not Microsoft’s. A staff member clearing out a mailbox, a departing employee deleting files, or an attacker who gains access and wipes data can all cause permanent loss once retention expires. An office 365 backup keeps an independent copy so these events become an inconvenience instead of a disaster.

Does Microsoft 365 protect against ransomware?

Only partially. If ransomware encrypts files synced to OneDrive or SharePoint, that encryption can sync to the cloud copy too. A backup with protected recovery points gives you something to restore from, provided a clean recovery point survives and the incident has been contained first. It does not prevent the attack and it does not undo data that was copied out. This sits alongside the wider defences in our article on what actually stops ransomware.

What should your backup arrangement cover?

Start an Office 365 backup scope from what the business actually relies on rather than from a product list. Identify the mailboxes, OneDrive accounts and SharePoint sites that matter, including shared and archive mailboxes, then agree how new users and sites are brought into protection and what happens when somebody leaves.

Teams needs checking twice in any Office 365 backup scope, because its files and its conversations live in different places. Files shared in a channel sit in that team’s SharePoint site, files shared in a chat sit in the sender’s OneDrive, and private and shared channels each get a site of their own. The messages are somewhere else again: channel posts sit in the team’s Exchange mailbox, chat messages in each participant’s mailbox, and shared-channel messages in a system mailbox. Backing up the files does not back up the conversations, so ask about each separately.

Choose how often it captures around how much recent work the business could afford to lose. Daily is a decision rather than automatically the right answer. Agree how far back recovery has to reach, and what a usable restore involves in practice, including permissions and where the recovered data lands.

Recovery granularity matters as much as coverage. Confirm whether you can restore a single item, a whole mailbox or an entire site, and whether recovery is still possible when a loss is found late, which is the norm rather than the exception.

What gets missed most often?

Partial coverage. A business backs up email but not SharePoint, then loses a project site with no way back. Shared and archive mailboxes, private and shared channel sites, newly created users and sites, and Teams messages as distinct from Teams files are the usual gaps. If something is not explicitly named as covered, treat it as not covered and ask.

How is it different from just keeping files in OneDrive?

OneDrive stores and syncs your current files and keeps version history, which recovers a good deal on its own. What it does not give you is a defined set of recovery points chosen around your business, or a restore path for the case where the account itself is the problem. Version history answers an overwrite well. It is a weaker answer to a compromised account.

Are the built-in retention features enough?

It depends on what you would need to recover, and an Office 365 backup is not automatically the answer. Retention policies, recycle bins and holds do real work inside their conditions, and some are harder to defeat than people assume: a retention policy under Preservation Lock cannot be turned off, deleted or made less restrictive by anyone, including a global administrator. What they are not is a recovery arrangement designed around your business, with recovery points you chose and tooling built for rebuilding a mailbox or a site.

The distinction that matters is which failures the protection survives, and who is able to change or delete it. Ask what happens if the usual administrator account is compromised, who can shorten retention or remove a protected copy, and how a restore actually runs on the day.

What is the difference between retention and backup?

Retention preserves or deletes content according to policy, including for legal and records reasons, and it can run for a set period or indefinitely. A backup provides recovery points and the tooling to restore from them. They complement each other, because preserving a record so it can be found and exported is not the same as being able to rebuild a working mailbox or site.

Microsoft 365 Backup or an independent backup service?

Microsoft sells its own backup service, and independent providers sell different approaches. Microsoft 365 Backup covers Exchange mailboxes, SharePoint sites and OneDrive accounts, is billed by consumption rather than per user, and keeps its restore points inside the Microsoft 365 data boundary using append-only storage.

That matters for how you compare options, because location on its own is a poor test. A product sold by another vendor does not automatically store your data somewhere else. If copies held outside Microsoft infrastructure are a requirement for you, make it an explicit one and check it rather than assuming.

Compare any Office 365 backup option on what actually differs: which data each covers, how far back recovery reaches, what a restore can put back and where it lands, and who runs it when you need it at short notice.

Then ask the question that decides it. If the usual administrator account were compromised tomorrow, which arrangement would still let you recover, and who would be able to delete the protected copies first?

How do you set up Microsoft 365 backup for your business?

Through a managed Office 365 backup service that connects to your tenant, captures the data you have agreed is in scope, and keeps recovery points you can restore from. For most businesses that is simpler and more reliable than building and monitoring it in-house, and the scoping conversation matters more than the product choice.

Exodesk provides managed Microsoft 365 backup as part of our cloud solutions. We agree what needs to be covered, configure the protection around it, and confirm that a restore works. Where something sits outside the scope we have agreed, we say so rather than leaving you to find out during an incident.

How long does it take to set up?

That depends on the environment and the product, and the initial capture takes as long as the volume of data requires. Agree the timetable at scoping rather than assuming one. It is not a set-and-forget arrangement either: new systems, changed permissions, staff leaving and who is allowed to authorise a restore all need an owner.

Could you recover an email deleted three months ago?

It is a better question than whether a backup exists, because answering it means checking the settings rather than the invoice. Exodesk has operated since 1989, with offices in Christchurch and Dunedin serving businesses across New Zealand.

We check what is actually covered in your tenant, what the retention is set to, and whether anything has ever been restored from it. Most of what we find is a business that assumed the platform was doing more than it does.

What we usually find when we review an Office 365 backup is a gap nobody had reason to look at, and the fix is more often a decision than a purchase.