Microsoft 365 has retention features, but that’s not the same as backup. Here’s what SMEs should protect in Exchange, OneDrive and SharePoint — and why restore matters.
A lot of SMEs assume Microsoft 365 “is backed up by Microsoft.” The reality is more nuanced. Microsoft provides strong platform resilience and some retention features — but retention is not the same as backup, and it won’t always save you from the situations that hurt most: accidental deletion discovered too late, malicious deletion, ransomware syncing encrypted files, or a messy dispute where you need a clean point-in-time restore.
A proper Microsoft 365 backup gives you recovery confidence: you know what’s protected, how far back you can go, and how quickly you can restore the right data without drama.
Amazing Support is a multi-award-winning, Microsoft Partner and Cyber Essentials Plus certified provider supporting UK SMEs across London, Greater London and Manchester — and we typically recommend thinking about M365 backup as part of business continuity, not just “an IT add-on.”
In plain English: Microsoft 365 backup is a separate system that copies your Microsoft 365 data so you can restore it later — even if it’s deleted or corrupted in Microsoft 365.
What SMEs usually need to protect
- Exchange Online (mailboxes, calendars)
- OneDrive (user files)
- SharePoint (team sites, document libraries)
- sometimes Teams data (often stored in SharePoint/OneDrive underneath)
What backup helps with (real scenarios)
- accidental deletion found months later
- ransomware encrypting files and syncing changes
- disgruntled user deleting data
- restoring a single folder or mailbox without rolling back everything
- meeting compliance or client expectations around retention and recovery
What to look for in an M365 backup solution
- clear retention options (30/90/365 days or longer)
- granular restore (single email, folder, site)
- fast recovery times (not “we’ll get back to you”)
- reporting and alerts
- regular restore testing (this is where confidence comes from)
Common mistakes
- assuming retention policies equal backup
- backing up only some users or only mailboxes
- never testing restores
- unclear ownership (“who checks it’s working?”)
FAQ
Isn’t Microsoft responsible for my data?
Microsoft runs the platform, but you’re responsible for your data governance and recovery approach. That’s why backups exist.
How often should we test restores?
At least annually, and after major changes. If you’ve never tested a restore, you don’t really know your recovery time.
If you want to be confident you can recover email and files quickly after an incident (or a simple mistake), we can design and manage a
Microsoft 365 backup approach that matches your risk and retention needs.
