Author name: Muskan Gupta

Most business owners assume that because their email, files and SharePoint sites live in Microsoft 365, everything is automatically backed up. It isn’t. And the gap between what you think is protected and what actually is can cost you a contract, a compliance breach, or weeks of lost work. Here’s the short version before we go deeper. No – Microsoft 365 does not fully back up your data. Microsoft keeps your service running and stores deleted items for a short window (14–93 days), but it does not provide long-term, recoverable backups by default. Under Microsoft’s shared responsibility model, protecting your own data is your job, not Microsoft’s. That single fact catches out thousands of Australian businesses every year. Let’s unpack exactly what Microsoft protects, what it doesn’t, and what you actually need to be safe. What does Microsoft 365 actually protect? Microsoft runs on what’s called a shared responsibility model. It’s a simple split, but most people never read it. Microsoft says this plainly in its own Services Agreement: it recommends that customers regularly back up their content using third-party apps and services. In other words, Microsoft is telling you to arrange your own backup. Is data backup included in all Microsoft 365 plans? No. Standard Microsoft 365 Business and Enterprise licences do not include a true backup. They include short-term retention features (recycle bins and deleted-item folders) designed for quick “oops” recovery — not for restoring data weeks or months later after a deletion, staff exit, or ransomware attack. Does Microsoft 365 back up emails and OneDrive files automatically? Not in the way you’d hope. What Microsoft 365 gives you by default is retention, not backup and the difference matters. Retention means deleted items sit in a recycle bin for a set period, then they’re gone forever. A real backup is an independent copy you can restore from at any point in time, long after the original is lost. Here are the default native windows: Microsoft 365 data Default native retention What happens after Exchange emails (deleted items) 14 days (extendable to 30) Permanently deleted OneDrive & SharePoint files (recycle bin) 93 days Permanently deleted Deleted SharePoint site 30 days Permanently deleted Microsoft Teams chats/files Limited, inconsistent Often unrecoverable The trap is timing. If a finance staff member deletes a folder and nobody notices for four months, the 93-day window has already closed. The data is gone and no support ticket will bring it back. Isn’t there a “Microsoft 365 Backup” option now? Yes and this is where most older articles are wrong. In 2024 Microsoft launched its own native add-on called Microsoft 365 Backup, available through the Microsoft 365 admin centre. It’s real, and it’s worth knowing about. Microsoft 365 Backup is a paid native add-on (not included in your licence) that backs up Exchange, OneDrive and SharePoint for up to 365 days. It’s billed pay-as-you-go at roughly USD $0.15 per GB per month. It closes part of the gap but it has real limits around coverage, retention length and data independence. What it does well: Where it still falls short for many businesses: For a small business, the native tool is better than nothing. For a business with compliance obligations or a low tolerance for downtime, it’s usually only part of the answer. What are the real risks of relying on Microsoft 365 alone? This is where the theory becomes a real bill. The most common ways Australian businesses lose Microsoft 365 data: Does Microsoft 365 protect against ransomware or user error? Only partly. Microsoft 365’s native recycle bins and version history can help with a quick mistake caught early, but they are not designed to recover from ransomware that has synced encrypted files, or from deletions discovered months later. A dedicated backup with immutable copies is what actually protects you. Native retention vs a real backup: what’s the difference? This is the comparison most buyers are searching for, so here it is in one place. Feature Microsoft 365 native retention Dedicated / managed backup Independent copy of your data No — stays in Microsoft Yes — held separately Long-term retention (years) No (max ~1 year even with add-on) Yes — flexible, years or unlimited Point-in-time restore Limited Yes — restore to any date Granular restore (single email/file) Difficult Yes — one click Ransomware-safe immutable copies No Yes Protection if Microsoft account is breached No Yes Australian data sovereignty options Limited Yes — choose AU data centres Does Microsoft 365 backup matter for Australian compliance? Yes, and this is the part overseas blogs ignore. If your business holds personal information, the Privacy Act 1988 requires you to take reasonable steps to protect it. Losing that data or being unable to recover it after an incident can trigger obligations under the Notifiable Data Breaches (NDB) scheme, overseen by the Office of the Australian Information Commissioner (OAIC). For regulated sectors the bar is higher: Do Australian data laws require Microsoft 365 backup? Not by name but in practice, yes. The Privacy Act requires reasonable steps to protect personal information, and the Essential Eight lists regular backups as a baseline control. A recoverable, Australian-hosted backup is the simplest way to meet both and to prove it if you’re ever audited. Data sovereignty matters too. A managed backup lets you keep your copy in an Australian data centre, which many local clients and government contracts now expect. Microsoft 365 backup vs Google Workspace: which is safer by default? A common question and the answer is the same for both. Neither Microsoft 365 nor Google Workspace fully backs up your data by default. Both run on a shared responsibility model: they keep the platform online, but you own recovery of your data. If you run either (or both), the safe setup is an independent third-party or managed backup that covers your whole environment. Some backup platforms protect Microsoft 365 and Google Workspace under one console, which simplifies things for mixed setups. How much does Microsoft 365 backup cost in Australia? There