Office 365 Backup and Recovery Policy Explained: What You Actually Need to Know UK 2026

The uncomfortable truth about Microsoft 365 and backups

If you work in IT support or you're moving into Microsoft 365 administration, there's a fact that catches people off guard: Microsoft 365 does not back up your data in the way most people assume it does.

Microsoft does maintain redundancy for service continuity. Your Exchange Online mailbox exists in multiple geographic data centres. Your SharePoint sites have replicas. But when your organisation accidentally deletes a Teams channel containing six months of project records, or a user wipes their entire OneDrive folder, Microsoft's built-in retention policies and recycle bins are your first line of defence, not a full backup restore to an earlier point in time. If that data is gone beyond the recycle bin retention window (typically 93 days for SharePoint, 30 days for OneDrive), recovery becomes expensive or impossible without a third-party backup solution.

That distinction matters. It's the difference between "our data is redundant" and "we can recover deleted data reliably." Every organisation using Microsoft 365 needs a clear backup and recovery policy that accounts for this gap.

What Microsoft 365 actually protects (and what it doesn't)

What's covered by Microsoft's built-in safeguards

Microsoft 365 includes automatic protection for certain scenarios:

Mailbox data in Exchange Online: Microsoft maintains three copies across geographically dispersed data centres. If the service fails, your emails aren't lost.

SharePoint and OneDrive version history: You can recover previous versions of files (typically the last 500 versions or 90 days, whichever comes first).

Recycle bins: Deleted items sit in a recycle bin before permanent deletion. OneDrive recycle bins retain items for 93 days (or until the bin reaches 10 per cent of total storage). SharePoint works similarly.

Malware and ransomware detection: Microsoft scans for threats and can quarantine suspicious activity.

What's not automatically backed up

This is where organisations stumble:

Permanently deleted email (beyond the recycle bin recovery window): gone.

OneDrive or SharePoint files deleted by the user, then emptied from the recycle bin: gone.

Teams channel messages and files if the channel is deleted: unless you've configured retention policies, they vanish.

Accidental overwrites: If a file is modified and saved over, version history might not reach back far enough, depending on your retention rules.

User account deletions: Deleted user data is held for only 30 days by default before permanent removal.

Tenant-wide disasters (unlikely but real): A major security breach, legal hold failure, or infrastructure failure outside normal redundancy scenarios.

The risk is real and affects organisations of every size. Healthcare trusts, government departments, and enterprises all use Microsoft 365. Most don't have a robust third-party backup policy in place until something goes wrong.

Building an effective backup and recovery policy

Step 1: Define your Recovery Time Objective (RTO) and Recovery Point Objective (RPO)

Before you buy anything or configure settings, clarify what "recovery" means to your organisation:

Recovery Time Objective (RTO): How quickly do you need to restore data after a loss? For critical business functions, you might need recovery within 4 hours. For less critical data, 24 hours might be acceptable.

Recovery Point Objective (RPO): How much data loss can you tolerate? If you can afford to lose a day's emails, your RPO is one day. If you need to recover to within two hours, your RPO is two hours. This determines backup frequency.

These drive every decision that follows. If your organisation handles patient data in healthcare, your RTO and RPO will be much tighter than a small administrative office.

Step 2: Map your critical data

Audit your Microsoft 365 environment:

Which mailboxes contain irreplaceable information (chief executives, finance, legal)?

Which SharePoint sites are business-critical?

Do you use Teams extensively for project collaboration?

Which OneDrive accounts hold core operational files?

Not everything needs enterprise-grade backup. A 500-person organisation might identify 15 critical mailboxes and 8 critical SharePoint sites. That focus makes your policy realistic and your backup costs proportional to actual risk.

Step 3: Layer your protection

Use multiple methods:

1. Configure retention policies and recycle bin settings: Extend default retention windows to match your RTO/RPO. For example, set OneDrive recycle bin retention to the maximum (93 days) and enable mailbox archive policies so deleted emails are retained longer.

2. Use Microsoft 365 compliance features: Litigation hold and eDiscovery can prevent accidental deletion of critical data. Not a substitute for backup, but a safety net.

3. Deploy a third-party backup solution (for critical data only): Services like Veeam, Commvault, or cloud-native solutions like Backupify integrate with Microsoft 365 and backup to your own storage or their infrastructure. They'll cost between £2 and £10 per user per month, depending on the vendor and scope, but they give you granular recovery, point-in-time restores, and independence from Microsoft's retention windows.

Step 4: Document your recovery procedures

A policy is only useful if people know how to use it. Document:

Who can request a restore?

What's the approval process?

How long does a typical restore take?

What information do they need to provide (user, date, files or folders)?

Who owns the process (IT support, administrators, compliance)?

Publish this in your organisation's IT handbook or wiki. Most organisations skip this step and then fumble when a restore is needed.

Step 5: Test your recovery regularly

This is not optional. Every quarter, restore a test dataset and verify it's intact and accessible. If you're using a third-party tool, test a single mailbox or a SharePoint site document library. Many organisations pay for backup solutions and never test them, then discover during a real incident that the backups don't work as expected.

Compliance and legal holds

If your organisation operates in healthcare, finance, or law, regulatory requirements often mandate specific data retention and recovery policies. The UK's Data Protection Act 2018 (which implements GDPR) doesn't mandate backup specifically, but it requires organisations to demonstrate that they can recover from loss or damage. ISO 27001 and NHS Digital Security and Protection Standards assume backup and recovery are in place.

Document your policy in writing and have it reviewed by your compliance or legal team. This protects you from both legal liability and audit failures.

Getting started with Microsoft 365 administration

If you're new to Microsoft 365 and backup policies feel overwhelming, you're not alone. Most IT support roles don't dive into this level of detail until you move into administration. That's where structured training makes the difference.

SmoothOps 365's Microsoft 365 Administrator Course covers compliance, data protection, and retention policies as part of the core curriculum. You'll learn how to configure recycle bins, retention policies, and backup strategies in a practical lab environment. It's aimed at IT professionals moving from support roles into administration, and it's currently available on a waitlist. If you're planning to move into M365 administration this year, signing up now gets you priority access when places open.

Alternatively, if you're starting from IT support fundamentals and want a clear pathway into cloud roles, the free career pathway tool maps out which certifications and skills matter most for your role and region in 2026.

Frequently asked questions

Does Microsoft 365 automatically back up all my data?

No. Microsoft maintains service redundancy and data replicas, but this is not the same as backup. If a user or administrator permanently deletes data and it's beyond the recycle bin retention window, Microsoft cannot recover it. You need a third-party backup solution or strict retention policies to recover deleted data reliably.

What happens if I don't have a backup policy in place?

Without a policy, you rely entirely on Microsoft's recycle bins and version history, which typically retain data for 30 to 93 days. After that, deletion is permanent. Accidental data loss, ransomware attacks, or compliance failures can result in unrecoverable data and potential regulatory fines or reputational damage.

How much does a Microsoft 365 backup solution cost?

Third-party backup solutions typically cost between £2 and £10 per user per month, depending on the vendor and features. This is separate from your Microsoft 365 licensing. For a 200-person organisation with 50 critical users, you might budget £1,000 to £5,000 per year for a robust backup policy.

Can I use compliance holds instead of backup?

Compliance holds preserve data for legal discovery and prevent accidental deletion, but they're not a substitute for backup. A hold keeps data in place, but it doesn't create a restorable copy or protect against ransomware or intentional deletion by a malicious administrator. Use both: holds for compliance, backup for disaster recovery.

Who should own the backup and recovery policy in my organisation?

Typically, the IT security or IT operations lead owns it, with input from compliance, legal, and business continuity teams. If your organisation is small and has no dedicated IT lead, the Microsoft 365 administrator or IT support team should draft the policy and have it reviewed by management and compliance.