Your expert in backup and data protection!The solution tailored to your needs
Home›Guides›Microsoft 365 and Google Workspace
Microsoft 365 and Google Workspace
Backing up SharePoint and OneDrive
SharePoint and OneDrive are backed up separately from the mailbox, because that is where the files are: OneDrive for personal spaces, SharePoint for teams, and therefore Teams files too. An “email only” backup leaves all document work out.
Key points
- SharePoint recycle bins keep a deleted item for 93 days, then Microsoft keeps 14 days of internal backups, which can only be restored through support.
- “Restore your OneDrive” lets you undo the actions of the last 30 days, but cannot bring back a file purged from the recycle bin.
- Teams files live in SharePoint libraries: backing them up means backing up SharePoint.
- The volume of documents often exceeds that of email: it is what determines the storage size.
What Microsoft already provides
- Recycle bins. A deleted item stays in the site recycle bin for 93 days and, if someone empties it, in the second-stage recycle bin for the remainder of those 93 days. An item deleted from the second-stage recycle bin is purged immediately.
- Deleted sites. A deleted site collection is kept for 93 days, then erased with all its content.
- Microsoft’s internal backups. Microsoft keeps 14 days of backups after permanent deletion. Only support can launch a restore, of an entire site collection or subsite, to a given point in time. After those 14 days, the data can no longer be recovered.
- Version history of a file, within limits on number and space.
- Restore your OneDrive. Users can undo all the actions of the last 30 days on their files, for example after an infection. A file permanently deleted from the OneDrive recycle bin, however, can no longer be recovered.
These mechanisms recover a file overwritten this week. They do not provide a quarter’s worth of history held by another party, they do not restore a single folder to a date of your choice, and a compromised administrator can empty the recycle bins.
| Mechanism | Duration | Who restores | Granularity |
|---|---|---|---|
| Site recycle bins (2 stages) | 93 days | User, site admin | File, folder |
| Deleted site | 93 days | Administrator | Entire site |
| Microsoft internal backups | 14 days after purge | Microsoft support | Site collection or subsite |
| Restore your OneDrive | 30 days | User | Entire OneDrive to a date |
| Backup outside the tenant | According to your retention | You | File, folder, site |
What needs to be copied
- The team sites actually in use, not just the root site.
- The libraries of Teams teams.
- The OneDrives of users who really work in them. Those that only sync a shortcut to SharePoint duplicate what is already covered: decide so that you do not pay twice for the same file, while leaving no gaps.
- Useful metadata if the tool captures it (dates, authors). A copy of bare files without permissions is already very useful. A copy that also restores permissions is even more so. Ask which of the two the tool does.
Method
The same logic as for Exchange: a dedicated application, minimal permissions, at least daily frequency, 30 to 90 days’ retention unless there is a specific reason, storage outside the tenant, and a test restore of a folder to a test site. The first run is long (the entire file history). Subsequent runs only cover changes. The ANSSI, France’s national cybersecurity agency, points out that a backup is only worth something if its restoration is tested regularly, following a written procedure.
The volume is often greater than that of email. It is what determines the storage size, not the number of messages.
Microsoft also sells Microsoft 365 Backup, which covers OneDrive and SharePoint (and Exchange Online), with restore points every 10 minutes over the last two weeks, then weekly up to 52 weeks. The copies remain within the Microsoft 365 boundary. See Does Microsoft 365 really include a backup?.
Limitations to know before buying
- Some backups restore files but not site customisations, Power Automate flows or third-party applications installed on SharePoint.
- Anonymous sharing and “anyone with the link” links are not a backup strategy. They are potential leaks.
- Workstation ↔ OneDrive sync spreads local encryption to the cloud. Version history and the 30-day restore help for a while. The dated external copy is the next safety net.
At WeDoBack
WeDoBack backs up SharePoint and OneDrive, in addition to Microsoft 365 emails, calendars and contacts. Copies are encrypted before they are sent, with a key held by the customer, and stored outside the tenant, on servers dedicated to backup. Storage is subscribed under the SMART or INTEGRAL offer, depending on the volume retained. Even so, have the sites and accounts concerned written into the quote: that is the list you will check during the restore test. File servers and NAS devices that remain on site fall under the same offers.
Frequently asked questions
Does OneDrive sync protect against ransomware?
No, on the contrary, it can spread encrypted files to the cloud. Microsoft lets you restore a OneDrive to a state from the last 30 days, which helps if the attack is detected quickly. A dated external copy, older than the attack, remains the next safety net.
Can Microsoft restore a site deleted two months ago?
Yes, if it is still within the 93-day retention period for deleted sites. Beyond that, Microsoft only keeps 14 days of internal backups after permanent deletion, and restoring requires a support request, for an entire site collection or subsite.
Should every OneDrive be backed up?
Those of the people who actually work in them. A OneDrive that only contains shortcuts to SharePoint duplicates what is already covered. Decide in writing so that you do not pay twice for the same file, without leaving any gaps.
Further reading
Sources
Documents consulted in October 2026.
- SharePoint data deletion in Microsoft 365 — Microsoft Learn
- Restore your OneDrive — Microsoft Support
- Overview of Microsoft 365 Backup — Microsoft Learn
- Information system backup – The fundamentals (ANSSI-BP-100, v1.1, 27 November 2025, in French) — ANSSI (French agency)
Planning a backup, DRP or BCP project?
More than 20 years of experience protecting business data.
Request a quote+33 9 72 50 78 28Protect your data with WeDoBack
Encrypted offsite backup, immutable storage, DRP and BCP: tell us about your servers and we will recommend the right combination.