Your expert in backup and data protection!The solution tailored to your needs
Home›Guides›Microsoft 365 and Google Workspace
Microsoft 365 and Google Workspace
Should you back up Microsoft 365?
Yes, if the messages or files stored in Microsoft 365 could not be rebuilt after a deletion, a compromised account or a retention period that is too short. That is the case for almost every SME whose email and team folders live in that tenant. No, only if another system already holds a complete, tested historical copy, which is rare.
Key points
- Microsoft’s safety nets last days or weeks: 14 to 30 days for a purged message, 30 days to restore a deleted account, 93 days for the SharePoint recycle bins.
- A hacked admin account can purge mailboxes and sites: redundancy replicates the destruction.
- Not backing up one component (test tenant, distribution list) is acceptable if it is documented.
- Typical setting: a daily copy, kept for 30 to 90 days, a period that must be justified under the GDPR.
When having no backup costs you
- An employee deletes a folder, empties the recycle bin, and the need resurfaces two months later. Exchange Online only keeps a permanently deleted message for 14 days by default, 30 at most.
- An admin account is hacked. The attacker purges mailboxes, sets up forwarding rules and deletes sites.
- A retention policy is set too aggressively and erases more than intended.
- The account of a departed employee is deleted and the 30-day window during which Microsoft allows it to be restored with its mailbox is missed.
- Ransomware encrypts synchronised files (OneDrive, SharePoint via the workstation) and file versions are no longer enough.
In each of these cases, Microsoft keeps the service running. The business data, however, is gone.
| Situation | Built-in Microsoft safety net | After this period |
|---|---|---|
| Message purged from the mailbox | 14 days by default, configurable up to 30 | Lost |
| User account deleted | 30 days | Account and mailbox lost |
| SharePoint file or site deleted | 93 days of recycle bins, then 14 days via support | Lost |
| Purge by a compromised admin | None beyond the periods above | Lost |
When you can decide not to back up a component
- A distribution list mailbox with no useful history.
- Purely conversational Teams teams, if it is documented that these exchanges are not part of the company’s records. The files, however, must still be covered.
- A test tenant.
Deciding not to back something up is acceptable if it is documented. “We’ll see” is not a decision.
What it costs
The price depends on the number of mailboxes and the volume retained, plus the length of history kept. A daily backup kept for 30 to 90 days is the most common setting. Going further should be justified by a business need, not by fear: mailboxes contain personal data, and the GDPR prohibits keeping it indefinitely. The retention period is set according to the purpose, after which the data is deleted.
Comparing it with the cost of a week of unrecoverable email (unanswered customers, contract attachments, order threads) makes the choice simpler than looking at the unit price.
What not to buy instead
A higher Microsoft licence (E5, for example) adds security and compliance. It is not equivalent to a copy outside the tenant. The paid Microsoft 365 Backup offering, on the other hand, is a genuine backup of Exchange Online, OneDrive and SharePoint, billed by volume, and Microsoft states that its data stays within its Microsoft 365 boundary. It meets part of the need. It does not meet the wish for a copy held by another party, nor does it back up servers that are not in Microsoft 365. The comparison is in Does Microsoft 365 really include a backup?.
At WeDoBack
Backing up Microsoft 365 emails, calendars and contacts is part of the service: one agent per address, plus the terabytes of the volume, under the SMART offer (€49.99 excl. VAT/TB/month, support billed per intervention) or the INTEGRAL offer (from €100 down to €65 excl. VAT/TB/month depending on volume, two hours of support per month). The principle is the same as for a server: the copy leaves the original environment and remains encrypted with a key held by the customer. SharePoint and OneDrive are covered too: a single quote can bring together emails, files and servers in the same storage volume.
Frequently asked questions
How long does Microsoft keep the account of an employee who has left?
Once a user is deleted, the administrator has 30 days to restore the account and its data, mailbox included. After that, the account and its mailbox can no longer be restored this way. What must remain accessible therefore has to be decided before deletion: a backup, or retention within the tenant.
How long should email backups be kept?
Thirty to ninety days covers most mistakes and compromises discovered late. Beyond that, you need a reason. Mailboxes contain personal data: the GDPR (Article 5) prohibits keeping information about individuals indefinitely: the retention period must follow the purpose, as data protection authorities point out (the CNIL in France, for example).
Is Microsoft 365 Backup enough?
It is a genuine backup of Exchange, OneDrive and SharePoint, paid for and hosted in the Microsoft cloud. It meets the need to roll back. It does not meet the wish for a copy held by another party, nor does it cover servers and workstations outside Microsoft 365.
Further reading
Sources
Documents consulted in October 2026.
- Restore a user — Microsoft Learn
- Change how long permanently deleted items are kept for an Exchange Online mailbox — Microsoft Learn
- SharePoint data deletion in Microsoft 365 — Microsoft Learn
- Overview of Microsoft 365 Backup — Microsoft Learn
- Do I need to set a data retention period for my file? (in French) — CNIL (French authority)
- Offers and prices — WeDoBack
Planning a backup, DRP or BCP project?
More than 20 years of experience protecting business data.
Request a quote+33 9 72 50 78 28Protect your data with WeDoBack
Encrypted offsite backup, immutable storage, DRP and BCP: tell us about your servers and we will recommend the right combination.