Your expert in backup and data protection!The solution tailored to your needs
How do you back up Microsoft 365?
You back up Microsoft 365 by regularly copying Exchange mailboxes, OneDrive and SharePoint outside the tenant, with several restore points. Microsoft’s recycle bins, retention and litigation hold remain useful, but they live in the same tenant and have short time limits: they are not that copy.
Key points
- By default, Exchange Online keeps permanently deleted items for 14 days, 30 days at most.
- A deleted user can be restored for 30 days; after that, their account and mailbox are lost.
- Include Exchange, OneDrive, SharePoint and Teams, as well as shared mailboxes.
- Connect the tool with a dedicated application with minimum permissions, not a global administrator.
- Run a test restore of a mailbox and a site every quarter.
What Microsoft keeps, and for how long
The details of what the subscription does and does not include are in Does Microsoft 365 really include a backup?. This page describes the method. Keep in mind the native time limits documented by Microsoft:
| Situation | Native recovery period |
|---|---|
| Item permanently deleted from an Exchange Online mailbox | 14 days by default, 30 days at most |
| Deleted user account (with its mailbox) | 30 days |
| OneDrive of a deleted user | 30 days by default (configurable), then 93 days in the recycle bin |
These periods are enough for a mistake spotted the same day. They cover neither a compromise discovered a month later, nor a deletion carried out by an administrator whose account has been stolen.
What to include
- Exchange Online: messages, folders, calendars, contacts. A mailbox deleted or emptied by a compromised account is the most common case.
- OneDrive: users’ files. Microsoft versioning is limited in duration and number of versions.
- SharePoint and Teams (Teams files are stored in SharePoint): team sites, libraries. This is often where collaborative work lives.
- Shared mailboxes and equipment mailboxes, not just named users.
Applications that store their data outside these three services (some third-party apps in the tenant) are not covered by a generic “Microsoft 365” backup. They need to be identified.
The method
- Inventory mailboxes and sites, including accounts of people who left less than thirty days ago, and shared items.
- Choose a tool that connects to the Microsoft APIs through a dedicated application with minimum permissions, protected by strong authentication. Avoid a global administrator account whose password is left lying around in a script.
- Set the frequency. Once a day is enough for many SMEs. Management mailboxes or an active sales team may justify several runs a day. This frequency is the RPO of your email.
- Set the retention period. Thirty to ninety days covers mistakes and a large share of compromises. Beyond that, keep only what a business rule justifies: the GDPR applies to backed-up mailboxes.
- Store the copy outside the tenant, encrypted, ideally immutable over the anti-ransomware period. The CNIL, France’s data protection authority, recommends protecting backups to the same level of security as the original data.
- Run test restores: a mailbox to a test mailbox, a OneDrive folder, a site. At least once a quarter.
The first run copies all the history the tool can read. It takes a long time. Subsequent runs only pick up changes.
Before deleting the account of a departing employee, check that their mailbox and OneDrive are in the backup: after 30 days, Microsoft no longer allows the user to be restored.
Common mistakes
- Enabling a Microsoft retention policy and assuming “it’s backed up”. Retention prevents certain deletions within the tenant. It does not create an independent copy.
- Forgetting shared mailboxes.
- Giving the tool a permanent global administrator role.
- Never restoring, then discovering that the API application was revoked six months ago.
At WeDoBack
Microsoft 365 is within scope: emails, calendars, contacts, as well as SharePoint and OneDrive. The public price list requires one agent per email address, plus SMART or INTEGRAL storage matching the volume retained. Encryption takes place before sending, the key stays with the customer, and copies are stored outside the tenant, on servers dedicated to backup. Backups are monitored 24/7. Installation is done from the console, or with deployment assistance from a technician (45 € excl. VAT per hour). Support can be reached on +33 9 72 50 78 28 from 9:00 to 13:00 and from 14:00 to 17:30 (Paris time).
Frequently asked questions
Doesn’t Microsoft already back up my data?
Microsoft ensures the availability of its service and the redundancy of its data centres. With the standard subscription, it does not provide you with an independent copy that can be restored to a date of your choice. Native recovery periods are short: 14 days by default for items deleted from a mailbox, 30 days for a deleted user.
Is a Microsoft Purview retention policy enough?
It prevents certain permanent deletions in the tenant and serves compliance purposes. The data remains in the same tenant, under the control of the same administrators, and bulk restoration of a mailbox or site to a given date is not what it is designed for. It is a complement, not an external copy.
How long should the backup of a former employee’s mailbox be kept?
For as long as justified by a business need or a legal obligation, not indefinitely: mailboxes contain personal data subject to the GDPR. Also remember to back up the mailbox before deleting the account: Microsoft only allows a deleted user to be restored for 30 days.
Further reading
Sources
Documents consulted in October 2026.
- Change how long permanently deleted items are kept for an Exchange Online mailbox — Microsoft Learn
- Restore a user — Microsoft Learn
- OneDrive retention and deletion — Microsoft Learn
- Security: Backing up — CNIL (French authority)
- Offers and prices — WeDoBack
Planning a backup, DRP or BCP project?
More than 20 years of experience protecting business data.
Request a quote+33 9 72 50 78 28Protect your data with WeDoBack
Encrypted offsite backup, immutable storage, DRP and BCP: tell us about your servers and we will recommend the right combination.