Why Microsoft 365’s Native Retention Isn’t a Backup: A UK Business Guide

Most UK businesses running Exchange Online believe their email is backed up because it lives in Microsoft’s cloud. It is not, at least not in the sense that matters on the day something goes wrong. Microsoft 365 backup and Microsoft 365 retention are two different things built for two different purposes: retention exists to stop content being destroyed before a compliance deadline, while a backup exists to put a mailbox, a folder or a whole tenant back the way it was at a known point in time, quickly, even when the people with administrative access are the problem.

This guide explains the difference at the level of the actual mechanisms rather than the marketing. It walks through what happens to a deleted email inside Exchange Online, how the Recoverable Items folder, litigation hold, retention policies and inactive mailboxes really behave, and what a “restore” from retention involves in practice. It sets out the shared responsibility model in plain English, covers the scenarios native features handle badly — a compromised Global Administrator, ransomware synced through OneDrive, a leaver’s mailbox deleted after thirty days, a malicious insider — and compares Microsoft’s own Microsoft 365 Backup service against third-party tools. It ends with a practical checklist for choosing an M365 email backup for a UK business, anchored to UK GDPR, HMRC record-keeping and the expectations cyber insurers now apply.

Retention and backup are not the same thing

Retention in Microsoft 365 is a preservation mechanism. A retention policy, a litigation hold or a retention label instructs the service not to permanently remove content before a defined date, even if a user deletes it. The content stays where it is — inside the same mailbox, inside the same tenant, governed by the same administrative accounts — and it becomes discoverable through Microsoft Purview eDiscovery. Retention answers the question “can we prove this message existed and produce it to a regulator or a court?” It was designed by compliance teams for compliance teams, and it does that job well.

A backup is a separate, independent copy of data taken at known points in time, stored outside the blast radius of the system it protects, and designed to be restored quickly to a usable state. Backup answers a different question: “it is Tuesday, the finance director’s mailbox has been emptied, and we need it back as it was on Monday, with its folders, before the month-end close.” The properties that matter are independence from the source, point-in-time granularity, speed and fidelity of restore, and resistance to deletion by anyone who has compromised the source environment.

Retention fails the backup test on almost every one of those properties. It lives inside the tenant it is meant to protect, so an attacker or a careless administrator with the right roles can change or remove it. It preserves items rather than states, so it can tell you a message existed but not which folder it was in on Monday. And its recovery route is a search-and-export process, not a restore button. None of that is a flaw in retention — it is simply not what retention is for. The flaw is in treating it as a backup, and that is the position most UK SMEs are in without having decided to be.

The numbers behind Exchange Online retention

Four figures set the limits of what Microsoft 365 will recover for you natively. All of them are defaults or ceilings set by Microsoft rather than estimates, and between them they explain why native recovery runs out sooner than most businesses expect.

The first card governs most everyday recovery. When a user deletes a message and then empties Deleted Items, or presses Shift+Delete, the item moves into the Recoverable Items folder, where it stays for the deleted item retention period — fourteen days by default. An administrator can raise that to thirty days per mailbox with a PowerShell command, and thirty is the hard ceiling. After that the item is purged unless a hold or retention policy is preserving it. Few UK SMEs have changed the default, which means that for the majority, an email deleted on the first of the month is unrecoverable by the fifteenth.

The second card is the one that catches businesses during staff turnover. When a user account is deleted in Microsoft Entra ID, the account and its mailbox become soft-deleted and can be restored for thirty days. After that, unless the mailbox was placed on hold before deletion and became an inactive mailbox, it is gone permanently. The common sequence — a leaver’s licence is removed to save money, the account is deleted a few weeks later, and three months on somebody needs a contract thread from that person’s mailbox — ends with the data simply not existing.

The third card covers files rather than mail. SharePoint and OneDrive keep deleted items in a first-stage recycle bin and then a second-stage bin for a combined ninety-three days, and OneDrive offers a “Restore your OneDrive” rollback to any point in the previous thirty days. These are genuinely useful features. They are also bounded, and the rollback is all-or-nothing for the library rather than selective by file.

The fourth card is not a number in any Microsoft document, and it is the one that matters most. Every native recovery feature — Recoverable Items, holds, retention policies, recycle bins, version history, OneDrive rollback — lives inside the same tenant, administered by the same accounts, as the data it protects. One sufficiently privileged compromised identity can reach all of it.

How UK businesses actually lose Microsoft 365 data

The chart below distributes the Microsoft 365 data loss incidents we are asked to help recover by root cause. The point of showing it is that infrastructure failure on Microsoft’s side — the scenario most people picture when they think of backup — barely features. Microsoft’s datacentre resilience is excellent. Nearly every real loss comes from inside the customer’s own half of the responsibility model.

Accidental deletion leads the list and is the cause native features handle best, provided it is noticed inside the window. The problem is timing. A user who deleted a folder of supplier correspondence in a tidy-up typically discovers the loss when they next need it, which is weeks or months later, not days. By then the fourteen-day Recoverable Items window has closed, and unless a retention policy was preserving mail, the recovery route has gone with it.

Leaver accounts are second, and almost entirely avoidable. The fix inside Microsoft 365 is to place a mailbox on litigation hold or under a retention policy before deleting the account, which converts it to an inactive mailbox retained without a licence. The fix outside it is a backup that keeps leavers’ data on its own schedule regardless of what happens in the tenant. Most businesses have neither, because offboarding is run as a licence-saving exercise rather than a data-retention one.

Compromised accounts and ransomware account for roughly one incident in six, and they are the incidents with the worst outcomes, because they are the ones where native protection is most directly attacked. Business email compromise in the UK typically involves an attacker establishing persistence in a mailbox, creating forwarding and deletion rules to hide their activity, and sometimes deleting evidence when they leave. Ransomware on an endpoint with the OneDrive sync client encrypts local files and syncs the encrypted versions to the cloud. Both are covered further below.

Administrative misconfiguration deserves its own mention because it is the cause nobody plans for. A retention policy scoped to the wrong locations, a PowerShell script intended for one test mailbox run against every mailbox, a migration tool configured to delete source after copy — these are routine operational errors, and they are why change control matters as much in a SaaS tenant as on a network. Our guide to network change management sets out the discipline, and it applies to tenant changes with very little adaptation.

What each protection option costs

There are four realistic ways to protect Microsoft 365 data in a UK SME, and they differ less in headline price than in what they actually defend against. The figures below are typical 2026 ranges per user per month; confirm current list pricing with the vendor or your licensing partner, as Microsoft and the backup vendors adjust prices regularly and GBP rates move with exchange rates.

The comparison that matters is between the first row and everything below it. Native retention costs nothing extra on most business plans, and that is exactly why so many SMEs stop there. But “included” needs reading carefully. Microsoft 365 Business Basic and Business Standard include Exchange Online Plan 1, which supports retention policies but not litigation hold; litigation hold requires Exchange Online Plan 2 or the Exchange Online Archiving add-on, and Business Premium includes the latter. Many businesses that believe they have legal hold on leavers’ mailboxes are on a plan that never permitted it.

Microsoft 365 Backup is the option most UK SMEs have not yet heard of, and it changes the conversation. Generally available since 2024 and billed through Azure on consumption, it creates genuine point-in-time restore points for Exchange Online, OneDrive and SharePoint, and its restore speed for whole mailboxes and sites at scale is very good because it operates inside Microsoft’s own infrastructure. It is a real backup, not a retention feature in disguise. Its limitation is the one in the fourth column: it is managed from within your tenant, so its resilience to a compromised Global Administrator depends heavily on how carefully the backup roles are separated and protected. For businesses already strong on identity security, it is a credible primary option; for most, it works best alongside rather than instead of an independent copy.

Third-party cloud-to-cloud backup is the default recommendation for most UK SMEs for one reason above the others: the copy sits with a different company, behind different credentials, on infrastructure your tenant administrators cannot reach. At £2 to £5 per user per month — about the price of a coffee per person — it typically includes unlimited retention, item-level restore and export, and UK data residency options. The quality difference between vendors lies in restore fidelity, Teams coverage, the separation of the backup console’s own identity, and whether the vendor’s storage is immutable.

Self-managed backup through Veeam or similar suits larger estates with an in-house team and existing storage. The licence is cheap; the total cost includes the storage, the compute, patching the backup server, monitoring the jobs and protecting the repository from the same attacker who might reach the tenant. For a fifty-user business without dedicated infrastructure staff, it is rarely the economical choice.

Native retention against an independent backup, side by side

The comparison below sets Microsoft 365’s native retention features against a well-configured independent backup on the criteria that decide what happens during a real incident. The highlighted card is the arrangement we recommend for UK SMEs, which is a statement about typical risk rather than a claim that native retention has no value — it should stay switched on alongside the backup.

The row that decides most real incidents is recovery method. Recovering content preserved by retention runs through Microsoft Purview: an administrator with eDiscovery permissions creates a search across the relevant mailbox, scopes it by date and keyword, waits for it to complete, exports the results — usually as a PST — and then imports that PST back into a mailbox, often into a recovery folder rather than the original locations. For one lost thread this is an hour of skilled work. For a whole mailbox emptied by an attacker, it is a day or more, the folder structure the user relied on will not come back as it was, and items that were moved rather than deleted will appear twice. It is a forensic tool being pressed into service as a restore tool.

The second decisive row is compromised Global Admin. In a tenant without preservation lock, an account with sufficient administrative roles can remove litigation holds, delete or disable retention policies, shorten deleted item retention, purge Recoverable Items and delete users. Preservation lock — Microsoft’s mechanism for making a retention policy unchangeable once applied, intended for regulatory immutability — does close much of this gap, but it is irreversible by design, it cannot be relaxed later even by Microsoft support, and most SMEs neither use it nor should apply it casually. An independent backup closes the same gap without that commitment, because the backup sits behind credentials the tenant administrator does not hold.

The honest summary is that native retention is a necessary layer and an insufficient one. Leave it on: retention policies that preserve mail for six years cost nothing on most plans and satisfy a large part of UK record-keeping obligations. Add an independent backup because retention was never designed to be one, and because the incidents that hurt most are exactly the ones that reach inside the tenant.

The shared responsibility model in plain English

Microsoft publishes a shared responsibility model for its cloud services, and its central point is simple: in every SaaS service, Microsoft runs the infrastructure and the application, and the customer remains responsible for its information and data, its accounts and identities, and its devices. Put more bluntly, Microsoft guarantees that Exchange Online will be running and that your mailbox will not vanish because a disk failed. It does not guarantee that what is inside the mailbox is what you wanted to be there. The cards below sort the work into who owns it and how much risk a UK SME carries when its half is neglected.

The left-hand card is the part people imagine they are paying for when they say their email is “in the cloud”, and Microsoft does it exceptionally well. Mailbox databases are replicated across multiple copies in separate datacentres, and the scenario in which a UK business loses mail because Microsoft lost a server is close to theoretical. If that were the only risk, backup would be unnecessary.

The middle card is where most of the confusion lives. Microsoft supplies capable tools — retention policies, holds, auditing, conditional access — and leaves them almost entirely unconfigured by default. A new tenant does not preserve deleted mail beyond fourteen days, does not hold leavers’ mailboxes, and until recently did not enforce MFA for every account. The tools are “included” in the sense that you have paid for them, not in the sense that they are protecting you. Identity protection is marked high risk in this card because almost every serious M365 incident starts with a compromised account, and because conditional access is the control that stops most of them. It is also a core expectation in Cyber Essentials, which our guide to defining Cyber Essentials scope explains for cloud services specifically.

The right-hand card is what remains when everything Microsoft provides is used well, and every row is high risk because nothing in the platform does it for you. Microsoft does not keep a copy of your data that is independent of your own administrators. It does not stop your offboarding process deleting a mailbox you will need. It does not undo a bulk deletion your staff made. And it does not test your recoveries. Under UK GDPR, Article 32 requires the “ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident”; that obligation sits with you as controller, regardless of where the data is hosted.

What implementing Microsoft 365 backup actually looks like

The timeline below describes a typical engagement to put independent backup in place for a UK business of twenty to two hundred users, alongside tightening the native retention configuration so that the two layers work together. Most of the elapsed time is the initial backup seeding, which depends on data volume rather than effort.

The sequencing worth defending is that native retention is tightened in the same project as the backup is introduced, not left as it was. The two layers complement each other: retention gives compliance and eDiscovery a preserved record inside the tenant, while backup gives operations a fast and independent way back. Businesses that add a backup and leave retention on default have bought the more expensive half and skipped the free one.

Where UK SMEs stand on Microsoft 365 data protection

The figures below are what we find when reviewing Microsoft 365 tenants in UK businesses of roughly ten to two hundred users for the first time. They describe the starting position, and the gap between the top and bottom of the list is the gap between what Microsoft switches on by default and what a business has to decide to do.

The 41 per cent with some independent backup is better than it was a few years ago and still means that most UK SME tenants depend entirely on native retention. Read it against the rows beneath it, though, and the picture is weaker than the headline. Many of those backups cover Exchange and OneDrive but not Teams, few have ever been used for a full mailbox restore, and fewer than one in ten keep the backup console behind credentials that differ from the tenant administrators. A backup that the same compromised account can log into and delete is better than nothing, but it does not survive the scenario that most justifies having one.

The 13 per cent row is the cheapest fix in this guide. Raising deleted item retention from fourteen to thirty days is a single PowerShell command per mailbox, or one command across all of them, it costs nothing, and it doubles the window in which ordinary accidental deletions can be recovered natively. That it is changed in so few tenants says less about difficulty than about the fact that nobody is assigned to look.

The 21 per cent offboarding row explains the leaver losses in the bar chart earlier. Converting a leaver to an inactive mailbox requires a hold or retention policy to be applied before the user is deleted; doing it afterwards does nothing. Most businesses run offboarding as a licence recovery exercise, removing the licence and later the account, and the order of operations quietly guarantees that the mailbox will be destroyed thirty days later.

How many tenants would survive an admin compromise?

The scenario that most clearly separates retention from backup is a compromised Global Administrator. It is also the scenario that UK business email compromise and ransomware groups increasingly aim for, because full tenant control lets an attacker read everything, hide their tracks and destroy recovery options before demanding payment.

Sixteen per cent means that in five tenants out of six, a single privileged account in the wrong hands is enough to cause permanent loss. The mechanism is not exotic. With Global Administrator or the right combination of Exchange and compliance roles, an attacker can remove litigation holds, delete retention policies that are not under preservation lock, reduce deleted item retention, purge the Recoverable Items folder, delete users and their OneDrives, and empty SharePoint recycle bins. If the business has a third-party backup but its console is accessed through the same compromised identity, or via single sign-on with that identity, the attacker can often reach the backup too.

The tenants in the sixteen per cent share three properties. Their backup copy sits outside Microsoft 365, with a vendor or in storage the tenant cannot administer. Access to that backup uses separate named accounts with their own MFA, not the tenant Global Administrators and not single sign-on from the same directory. And their privileged roles are tightly held — two break-glass accounts excluded from routine use, day-to-day administration through lesser roles, and Privileged Identity Management where the licence allows it. None of these is expensive. All three have to be decided deliberately.

It is worth being clear that preventing the compromise is the first line, and backup is the last. Conditional access, phishing-resistant MFA for administrators, and alerting on mass deletion and new forwarding rules stop most of these incidents before they become recovery exercises. The same layered thinking applies to every internet-facing system the business runs, as set out in our guide to website security hardening. Backup is what remains when the prevention fails, which is why it must not share the prevention’s weaknesses.

The 12-point checklist for choosing an M365 backup

Use this when comparing third-party Microsoft 365 backup products or evaluating Microsoft 365 Backup. Each item changes the outcome of a real incident, and each is easier to establish before signature than after.

1. Workload coverage. Confirm Exchange Online mail, calendars, contacts and tasks; shared mailboxes; OneDrive; SharePoint sites including permissions; Microsoft 365 Groups; and Teams channel messages, chats and files. Teams is where coverage most often differs between vendors.
2. UK data residency, in writing. Ask where backup data is stored, where it is replicated, and where support staff who can access it are located. For UK GDPR purposes, a UK-hosted copy with a clear data processing agreement and published sub-processors is the simplest position.
3. Independence of the backup console. The console should support its own named accounts with MFA, separate from your Microsoft 365 Global Administrators. Avoid configurations where the only route in is single sign-on from the tenant you are protecting.
4. Protection against backup deletion. Look for immutable storage, deletion delay or soft-delete on restore points, and alerts when retention settings or backup scopes are changed. A backup an attacker can quietly shorten is not much of a last line.
5. Backup frequency and retention. Several snapshots a day is normal. Retention should be configurable to match your record-keeping periods — unlimited is common, but you also need to be able to set shorter periods to honour storage limitation.
6. Restore granularity and fidelity. Item, folder, full mailbox, OneDrive folder, document library and site, with folder structure, metadata and permissions preserved. Ask specifically how Teams messages are restored, because some products can only export them.
7. Restore destinations. In place, to an alternative mailbox, to a different user, and export to PST or a downloadable archive for legal or HR purposes. Restoring a leaver’s mail into a manager’s mailbox is a common request.
8. Search and eDiscovery inside the backup. The ability to search across all backed-up mailboxes by sender, date and keyword without restoring first saves hours during subject access requests and disputes.
9. Automatic inclusion of new users and sites. New mailboxes, Teams and SharePoint sites should be protected by default through auto-discovery, not added manually. Manual inclusion is how the newest and often most active users end up unprotected.
10. Leavers and unlicensed accounts. Confirm how long backup data for a deleted user is kept, whether it continues to cost a licence, and whether the data survives if the account is removed from Microsoft 365.
11. Reporting and alerting. Daily job status, failed items, coverage gaps and storage trends, delivered to a named person or your IT provider, not just available in a dashboard nobody opens.
12. Exit terms. What happens to your backup data if you cancel: how long it is kept, how you can export it, at what cost, and how its deletion is confirmed. This matters for continuity and for your own GDPR obligations.

A cloud email business continuity score

The gauge below shows where a typical UK SME tenant scores on our Microsoft 365 recoverability assessment at first review. The score weights the ability to recover from the incidents in the bar chart earlier: ordinary deletion, leaver loss, compromise, misconfiguration and ransomware, each judged on whether recovery is possible, how quickly, and whether it has ever been tested.

A score in the mid-thirties has a recognisable shape. Recovery from a recent accidental deletion scores reasonably, because Recoverable Items and the recycle bins handle the first fortnight well. Recovery from leaver loss scores poorly, because offboarding rarely preserves mailboxes. Recovery from compromise scores worst, because the protections that exist live inside the tenant the attacker controls. And almost nothing scores well on testing, because so few businesses have restored a full mailbox from anything.

The useful feature of this score is how quickly it moves. Raising deleted item retention to thirty days, applying a basic retention policy, and fixing the offboarding order of operations costs a few hours and takes a typical tenant into the mid-fifties. Adding an independent backup with separate console credentials takes it above seventy-five. A quarterly restore test, recorded, takes it into the eighties. For most UK SMEs the whole journey costs less per year than a single day of lost email during a dispute or an insurance claim.

The score also matters outside IT. Cyber insurers increasingly ask specifically whether Microsoft 365 data is backed up independently and whether restores have been tested, and some reduce cover or raise excesses for ransomware where the answer is no. Boards that receive regular technology risk reporting should see this score, or something like it, alongside the other headline risks; our guide to IT governance and board reporting covers how to present it.

Common Microsoft 365 backup mistakes

These are the errors we see most often, and each leaves a business believing it is protected right up to the incident that shows otherwise.

• Treating the recycle bin as a backup. Recoverable Items, Deleted Items and the SharePoint recycle bins are short-term undo features with fixed windows. They are not independent, they are not point-in-time, and they are reachable by anyone who can administer the tenant.
• Assuming litigation hold is available. Business Basic and Business Standard do not include litigation hold without the Exchange Online Archiving add-on. Plenty of offboarding procedures say “place mailbox on hold” on plans where the command fails or was never run.
• Deleting leavers before preserving them. A mailbox becomes inactive only if a hold or retention policy applies before the account is deleted. Removing the licence, then the account, then trying to recover the mailbox months later is the single most common cause of permanent email loss we see.
• Protecting the backup with the same credentials as the tenant. If a Global Administrator account can sign into the backup console through single sign-on, the attacker who has that account can reach the backup too. Separate the identities.
• Forgetting Teams and shared mailboxes. Teams chats, channel messages and shared mailboxes increasingly hold the decisions and the customer correspondence. Backups scoped to user mailboxes and OneDrive only leave a growing share of the business record uncovered.
• Never restoring anything. Job success reports confirm that data was copied, not that it can be put back usefully. Until a full mailbox, a OneDrive and a SharePoint library have been restored and timed, the recovery objective is a guess.
• Keeping everything for ever. Unlimited retention is convenient and conflicts with UK GDPR storage limitation. Set retention by data class, and make sure the backup can delete data you are no longer entitled to keep, including on subject erasure requests where they apply.
• Relying on PST exports as a fallback. Ad-hoc PST exports to a file server or a laptop are unencrypted copies of personal data with no retention control and no audit trail, and they are often discovered during breach investigations rather than recoveries.

Mini case study — a 38-person Manchester property consultancy

A chartered surveying and property consultancy in Manchester, 38 staff, entirely on Microsoft 365 Business Standard with no servers and no third-party backup. Its IT was supported by a part-time contractor. The business believed its email was safe because it was hosted by Microsoft, and its offboarding checklist said to “keep the mailbox” for departing surveyors so their client correspondence could be retrieved.

The incident began with a phishing email that harvested the credentials of an office manager who held Global Administrator rights for convenience. MFA was registered but not enforced by conditional access for that account, and the attacker signed in from overseas on a Friday evening. Over the weekend they created inbox rules on two partner mailboxes to divert payment-related mail, attempted a fraudulent invoice change with a client, and on Sunday night, apparently to cover their tracks, deleted both partner mailboxes’ contents, emptied Recoverable Items, and deleted three user accounts. The client queried the changed bank details on Monday morning, which is how the breach was discovered.

Recovery from the native position was partial. The three deleted users were restored from Entra ID within the thirty-day window. The two partner mailboxes could not be restored to their previous state: there were no retention policies, deleted item retention was on the fourteen-day default and had been purged, and litigation hold was not available on Business Standard. Roughly four years of correspondence for two partners was lost permanently. Separately, the business discovered that the “kept” mailboxes of two surveyors who had left in the previous year had in fact been deleted when their accounts were removed after licence reclamation — they had never been preserved, and nobody had noticed until a client dispute required one of them.

We had always said our email was in the cloud, as if that meant somebody else had a copy. What we learned is that Microsoft keeps the service running and we were the only people responsible for what was inside it. The two lost mailboxes cost us far more in rework and a disputed fee than a backup would have cost over ten years.

The remediation over the following month was straightforward and modest in cost. Conditional access now enforces MFA for all users and phishing-resistant methods for two dedicated break-glass administrator accounts; day-to-day administration moved to lesser roles. Deleted item retention was raised to thirty days across all mailboxes, and a six-year retention policy was applied to Exchange, OneDrive and SharePoint. The business moved to Business Premium for its security features, which also brought Exchange Online Archiving and litigation hold. A third-party cloud-to-cloud backup was added at a little over £3 per user per month with UK storage and console access through separate accounts. Offboarding was rewritten so preservation happens before licence removal. The first quarterly restore test recovered a full mailbox, with folders intact, in under an hour.

Two points from the incident are worth generalising. The ICO was notified, because personal data in the deleted mailboxes had become unavailable and client data had been accessed, and the inability to restore was itself relevant to the Article 32 assessment. And the business’s cyber insurer queried the absence of independent backup during the claim, which slowed it. Neither consequence required a sophisticated attacker. Both followed from treating retention as if it were backup.

At a glance — native retention versus independent backup

If you take one row from that table, take the compromised Global Admin line. Every other difference is about convenience and speed. That one is about whether the data still exists after the incident that most UK businesses now consider their most likely serious threat.

How Cloudswitched protects Microsoft 365 email

We start with a recoverability review of your tenant: licences, retention settings, holds, offboarding, admin roles, audit logging and any existing backup. From there we configure native retention to match your UK record-keeping obligations, fix the leaver process, harden privileged access, and put an independent, UK-hosted backup in place behind separate credentials. We then test full mailbox, OneDrive and SharePoint restores, record the times, and repeat the test each quarter so your recovery objectives are measured rather than assumed.

Frequently Asked Questions

Does Microsoft back up my Microsoft 365 email?

Microsoft replicates your mailbox across multiple copies in separate datacentres so the service survives hardware and site failures, and it provides retention features that preserve deleted content for a limited period or until a compliance date. It does not keep an independent, point-in-time copy of your data that you can restore from after user error, a malicious deletion or an administrator compromise. Under Microsoft’s shared responsibility model, your information and data, accounts and identities remain your responsibility. Microsoft now sells its own Microsoft 365 Backup service, but it is a separately billed product you must buy and configure.

What is the difference between Exchange Online retention and backup?

Exchange Online retention prevents content from being permanently removed before a set date, keeping it inside the same mailbox so it can be found through eDiscovery. A backup is a separate copy taken at regular points in time, held independently of the source, and designed to restore a mailbox or folder to a previous state quickly. Retention tells you a message existed; backup puts the mailbox back the way it was. Retention also lives inside your tenant, so anyone who compromises a sufficiently privileged admin account can usually change or remove it.

How long can I recover deleted emails in Microsoft 365?

By default, items purged from Deleted Items stay in the Recoverable Items folder for fourteen days. An administrator can raise this to a maximum of thirty days per mailbox using PowerShell. Beyond that, deleted items are only recoverable if a retention policy or hold was preserving them, and then only through an eDiscovery search and export rather than a simple restore. A deleted user account and its mailbox can be restored for thirty days, after which they are permanently removed unless the mailbox was held beforehand.

What happens to a leaver’s mailbox when we delete their account?

When a user is deleted, their account and mailbox are soft-deleted and recoverable for thirty days, then permanently removed. If a litigation hold or retention policy applied to the mailbox before deletion, it becomes an inactive mailbox and is retained without a licence for as long as the hold lasts. Applying a hold after deletion does nothing. The safe offboarding order is to preserve the mailbox first — by hold, retention policy, or a confirmed backup — then convert it to shared or remove the licence, and only then delete the account.

Is Microsoft 365 Backup good enough on its own?

Microsoft 365 Backup is a genuine backup service with point-in-time restore points for Exchange Online, OneDrive and SharePoint, and its restore performance at scale is strong. Its main limitation for UK SMEs is that it is administered from within the same tenant, so its resilience to a compromised Global Administrator depends on careful separation of backup roles and strong identity protection. For organisations with mature privileged access controls it can be a primary option. For most SMEs it works best alongside, or is replaced by, a third-party backup held behind separate credentials.

How much does third-party Microsoft 365 backup cost in the UK?

Cloud-to-cloud backup products from vendors such as Datto, Dropsuite, Acronis, Keepit, AvePoint and Barracuda typically cost between £2 and £5 per user per month in 2026, usually including storage and long or unlimited retention. Self-managed options such as Veeam Backup for Microsoft 365 have lower licence costs but add storage, infrastructure and administration time. Check whether shared mailboxes, unlicensed leavers and Teams are included in the per-user price, because these are where quotes differ.

Can ransomware affect Microsoft 365 data?

Yes, in two main ways. Ransomware on a laptop running the OneDrive sync client encrypts local files, and the encrypted versions sync to OneDrive and SharePoint, overwriting the good copies. Version history and the thirty-day OneDrive restore can often roll this back, provided it is noticed in time and the attacker has not tampered with the tenant. The more serious case is an attacker with administrative access to the tenant, who can delete data and disable native recovery directly. An independent backup outside the tenant is the dependable recovery route for both.

Does UK GDPR require us to back up Microsoft 365?

UK GDPR does not name a specific technology, but Article 32 requires appropriate measures including the ability to restore the availability of and access to personal data in a timely manner after an incident. As controller you remain responsible for that regardless of where data is hosted. If a mailbox containing personal data is lost permanently, the ICO may consider whether your recovery measures were appropriate. Storage limitation also applies to backups, so retention should be set by data class rather than kept indefinitely by default.

Do we need to back up Microsoft Teams?

If Teams holds business decisions, customer conversations or files, yes. Teams chat messages are stored in user mailboxes and channel messages in the group mailbox for the team, while files live in SharePoint and OneDrive. Native retention policies can preserve Teams messages for eDiscovery, but restoring a deleted channel conversation into Teams is not something native tools do. Third-party products vary considerably here: some restore messages into Teams, some only export them. Confirm what restore means for Teams before choosing a product.

Who should have access to the backup console?

As few people as practicable, using named accounts with their own MFA that are separate from your Microsoft 365 Global Administrators. Day-to-day restore requests can be handled by your IT provider through a role limited to restoring rather than changing retention or deleting backups. The principle is the same least-privilege thinking applied to reporting and data access generally, as covered in our guide to row-level security for business reporting. Log every console sign-in and alert on changes to retention or scope.

How often should we test Microsoft 365 restores?

Quarterly is a sensible minimum for a sample restore, plus a full mailbox restore to an alternative location at least twice a year, and an annual rehearsal of a tenant compromise scenario. Each test should be timed and recorded, so your recovery time objective is a measured figure. Include at least one restore from a point more than ninety days old, because that proves the backup covers what native retention cannot. Cyber insurers and auditors increasingly ask for this evidence.

Should we keep native retention switched on if we buy a backup?

Yes. The two layers do different jobs. Retention policies preserve content inside the tenant for compliance, eDiscovery and subject access requests, and they cost nothing extra on most business plans. Backup provides fast, independent recovery when content has been deleted or the tenant has been compromised. Raising deleted item retention to thirty days, applying retention policies matched to your record-keeping obligations, and preserving leavers’ mailboxes all remain worthwhile alongside a backup.

Related reading

More guidance on securing and governing UK business systems:

• Cyber Essentials scope: what to include and why
• Website security hardening: a UK business guide
• IT governance and board reporting for UK SMEs
• Network change management: controlling risk in live systems
• Reporting security and row-level access control