Does Microsoft 365 Include Backup?

No — not in the sense the word normally means. Microsoft 365 includes retention: deleted data is held for a documented, finite period and then permanently removed. Exchange Online retains purged items for 14 days by default (configurable to 30); SharePoint and OneDrive retain deleted content for 93 days across both recycle-bin stages. What the platform does not provide is independent, point-in-time restore outside those windows. Microsoft’s own shared-responsibility position is that the customer retains responsibility for their data.

It depends on the service. Exchange: Deleted Items, then Recoverable Items for 14 days by default (up to 30 if an administrator has raised it). OneDrive and SharePoint: a first-stage and a second-stage recycle bin totalling 93 days — cumulative across both stages, not 93 days in each. A deleted user’s OneDrive is retained for 30 days by default. Teams has no retention of its own: channel files follow SharePoint and chat messages follow Exchange. These are tenant-configurable defaults, so verify them against your own tenant rather than assuming.

No. A retention policy prevents data being permanently removed before a defined period, which genuinely helps. But recovering content that exists only because of a retention policy means running an eDiscovery search, exporting the result, and re-importing it by hand. That is an evidence-production process measured in days, not a restore. A retention policy answers "is it still there"; a backup answers "can we put it back, by Tuesday lunchtime".

It protects against Microsoft losing your data through hardware or datacentre failure. It does not protect against you losing it. Replication copies a deletion to every replica just as faithfully as it copies a new file. Redundancy and backup answer two different questions and are routinely conflated.

It can. The common path is not an attack on Microsoft’s platform but a compromised account or an infected endpoint synchronising encrypted files up through OneDrive, so the cloud copy becomes the encrypted copy. Version history helps up to a point and can be exhausted. The structural issue is that every in-platform protection is reachable with sufficient privilege, so a compromised administrator and the recovery mechanism share one blast radius.

By default the mailbox is recoverable for 30 days after the account is deleted, and the OneDrive is retained for 30 days — configurable by an administrator up to 3,650 days, though most tenants never change it. Because licence reclamation usually happens quickly and the business often does not realise what the person held until later, departing-employee data is the most common irrecoverable loss we see in Microsoft 365.

The same way you would for any other system holding operational data: decide how much data you could lose (RPO) and how long you could operate without it (RTO), per workload rather than for the tenant as a whole. Mail, active project files and archived records usually warrant different answers. The point of writing them down is that nothing in the platform is designed around a target you have not stated.

At least annually, and after any material change to tenant configuration or to who administers it. A test is only meaningful if it is a genuine restore of a real item to a usable state, performed by whoever would do it in an incident — not a confirmation that a job reported success.

The obligations that apply are usually client-file retention and the duty to preserve, both of which commonly run far longer than 93 days — so platform defaults do not satisfy them on their own. The practical risk is a closed matter: a file nobody touches for a year, deleted during a tidy-up, discovered missing when the matter reopens. By then every platform retention window has closed.

No, and they should not be traded off against each other. They do different jobs. A retention policy enforces that data is kept and can be produced for a legal or regulatory obligation. Backup provides a point-in-time copy that can be restored operationally, held outside the tenant’s own administrative blast radius. Most regulated organisations need both.