Microsoft 365 Backup for Small Business: Is Your Data Actually Recoverable?

Updated August 2026: I originally wrote this article to explain why small businesses should think about protecting the information they keep in Microsoft 365. Since then, Microsoft has expanded its own backup capabilities, I have dealt with real Microsoft 365 recovery situations for clients, and I have written more detailed articles about OneDrive, employee offboarding, SharePoint, and Microsoft 365 management. The original article needed an update because simply saying “Microsoft 365 is not a backup” no longer accurately explains the situation. Microsoft 365 has built in recovery capabilities, and Microsoft now offers Microsoft 365 Backup as a separate service. The question I think a small business owner should be asking today is much more practical: If something happens to your Microsoft 365 data, do you know what you can recover, how far back you can go, and how you would actually get it back?

That is what I care about when I talk to a client about backup. I care less about being able to say that a backup job reported success last night than I do about knowing what I can actually recover for that client when something goes wrong. A backup strategy should not exist only on a dashboard. Someone needs to understand what is protected, where recoverable copies exist, how long they are retained, who knows when something fails, and what restoring the business's information would actually look like.

Does Microsoft 365 Back Up Your Data?

Microsoft 365 includes several built in ways to protect and recover information. SharePoint and OneDrive have version history. Deleted SharePoint content normally moves through recycle bins with a 93 day retention period. Microsoft also provides Files Restore, which can return a SharePoint document library to an earlier point within the previous 30 days. Microsoft maintains additional resiliency and recovery capabilities behind the services as well.

Microsoft also now offers Microsoft 365 Backup, a separate Microsoft backup service for Exchange Online, SharePoint, and OneDrive. Microsoft currently supports configurable recovery windows of three months, six months, one year, or two years, depending on the backup policy.

That means the old blanket statement that Microsoft does not back up Microsoft 365 is no longer a good way to explain this to a business owner.

What I would not do, however, is assume that having Microsoft 365 means your business automatically has the backup and recovery strategy it needs. Version history, recycle bins, retention, Microsoft 365 Backup, and third party backup products solve different problems and have different recovery capabilities. The important question is not whether Microsoft has recovery technology. It does. The important question is what your business actually has configured and whether that matches what you need to recover.

OneDrive and SharePoint Are Not the Same Thing as a Backup Strategy

This is one of the areas where I see understandable confusion. OneDrive can synchronize files from a computer into Microsoft 365, and SharePoint gives a business a central place to store and collaborate on company information. Both platforms have useful recovery capabilities. That does not automatically make either one the company's complete backup strategy.

Think about what would happen if an employee accidentally deleted an important file. Version history or the recycle bin might solve the problem quickly. Now consider a larger incident involving a large number of files, an employee account that is no longer licensed, a SharePoint site that is deleted, malicious activity, or information that somebody does not realize is missing until months later. The recovery path can be very different.

This is why I want small business owners to get away from thinking only in terms of “Is it in the cloud?”

Being in the cloud tells me where the information is being stored and accessed. It does not tell me how the business would recover that information under every scenario that matters to it.

What Happens to OneDrive When an Employee Leaves?

Employee departures are a good example of why Microsoft 365 data management and backup need to be planned rather than assumed. OneDrive is associated with an individual user's account. If documents really belong to a department or the company as a whole, I generally prefer to structure that shared company information in SharePoint rather than allow one employee's OneDrive to quietly become the business's file server.

Microsoft's current OneDrive lifecycle also makes it important to distinguish between deleting a user and simply removing the user's Microsoft 365 license. When a user account is deleted from Microsoft Entra ID, Microsoft's standard OneDrive deletion process begins. The default OneDrive retention period for a deleted user is 30 days, although an administrator can configure that period from 30 through 3,650 days. After that retention period expires, the deleted user's OneDrive moves into the site collection recycle bin, where it remains for 93 days and requires administrative restoration.

Removing the license is different. Under Microsoft's current process, an unlicensed OneDrive account can enter read only status and is automatically archived or otherwise moved through Microsoft's unlicensed account lifecycle on its 93rd unlicensed day, depending on the account and retention state. Microsoft's rules around unlicensed OneDrive accounts have changed over time, which is another reason I do not recommend building an offboarding process around the assumption that the data will simply remain accessible indefinitely.

I dealt with a version of this problem firsthand when a client discovered that important shared company documents were tied to a former employee's OneDrive. The employee's license had been removed during a licensing audit, and everything continued working for roughly three months before access suddenly disappeared. I was able to determine that the data still existed, assign licensing as part of the recovery process, open a case with Microsoft, regain access, and then move the business information into a properly structured SharePoint library so the company was no longer depending on one former employee's OneDrive.

I cover that situation in much more detail in Microsoft 365 Data Loss: OneDrive Access Issues When Employees Leave. The larger lesson applies to any small business: do not wait until someone leaves to determine who actually owns the information in their OneDrive and where shared company files should live.

Retention, Version History, and Backup Solve Different Problems

I think this distinction is worth making because these terms are often used interchangeably when they should not be.

• Version history can help recover an earlier version of a file after somebody changes it.

• Recycle bins and restore capabilities can help recover information that was deleted or changed within Microsoft's available recovery windows.

• Retention can preserve information according to policies configured in Microsoft 365.

• Backup provides another recovery mechanism designed around preserving recoverable copies or recovery points for defined periods.

A business may use more than one of these at the same time. The right combination depends on what the company needs to protect and how it expects to recover from different types of problems.

The part that matters to me is understanding the recovery path before we need it. If an owner tells me, “Everything is in OneDrive, so we're backed up,” my next questions are going to be what happens if those files are deleted, what happens if the employee leaves, how far back we can recover, whether SharePoint and Exchange are also protected, and what we would actually do if the business needed a large amount of information restored.

What I Want to Know About a Small Business Microsoft 365 Backup

A small business owner does not need to become a Microsoft 365 administrator to ask good backup questions. Someone responsible for the environment should be able to answer them clearly.

• What Microsoft 365 information is actually protected?

• Are Exchange Online, SharePoint, and OneDrive included?

• How frequently are recoverable copies or recovery points created?

• How long is the data retained?

• Can individual emails, files, mailboxes, OneDrive accounts, or SharePoint information be restored?

• What happens to company data when an employee leaves?

• Who receives an alert when a backup fails?

• Where are the additional backup copies stored?

• When was an actual restore last tested?

• If a significant amount of information had to be recovered, how long would that realistically take?

That last question is one I think businesses overlook. Having a recoverable copy is obviously important, but recovery time matters too. If a company needs a large amount of information restored after an incident, I want to understand how we are going to get that data back into the hands of the people who need it.

Why I Prefer More Than One Recovery Path

For the clients whose Microsoft 365 data I back up, I use a layered approach rather than relying on one recovery location. I maintain a local offsite copy that gives me another recovery path and allows me to begin pulling client data without first depending on the internet to download a large amount of information from a cloud provider. I also maintain a separate cloud backup through a US based cloud service.

I chose that approach for a practical reason. If a client calls because something has happened and they urgently need their information, I want options. I do not want the recovery plan to depend entirely on one platform, one copy of the data, or my ability to download a large amount of information over the internet before I can begin helping them.

That does not mean every small business needs to use the exact backup architecture I use for my clients. The appropriate strategy depends on the amount of data involved, how important that data is to daily operations, how far back the company needs to recover, and how quickly information needs to be available again. What matters is that somebody has made those decisions intentionally instead of assuming the word cloud automatically answers them.

Backup Is Only One Part of Managing Microsoft 365

Backup is also a good example of something I see repeatedly with Microsoft 365. Buying Microsoft 365 and managing Microsoft 365 are not the same thing.

A business can have Exchange Online, OneDrive, SharePoint, Microsoft Defender, Entra ID, retention capabilities, and backup technology available while still having gaps in the way those services are configured and managed. Licensing tells me what the company owns. It does not tell me whether employee offboarding is handled properly, whether company files are stored in the right place, whether permissions make sense, whether security alerts are monitored, or whether anybody has tested the recovery process.

That broader management picture is why backup and recovery are part of what I look at during a Microsoft 365 Audit and Tenant Security Review. I am not looking at Microsoft 365 as a collection of unrelated products. Identity, access, licensing, SharePoint, OneDrive, security, employee offboarding, data ownership, and recovery can all affect one another.

I also go deeper into this problem in Microsoft 365 for Small Businesses: Is Anyone Actually Managing Your Environment?. As Microsoft continues adding capabilities, this distinction becomes more important. More features do not automatically equal better management.

Do Small Businesses Need a Separate Microsoft 365 Backup?

I do not think the responsible answer is to tell every small business that there is one mandatory backup configuration they all need. Microsoft provides meaningful native recovery capabilities, Microsoft offers its own Microsoft 365 Backup service, and third party Microsoft 365 backup products provide additional options. Those options can differ in retention, storage, restore capabilities, management, and cost.

For the businesses I support, I prefer an additional backup strategy because I want another recovery path outside the production Microsoft 365 environment. That is my professional approach based on how I want to be able to recover client information. It is not a Microsoft requirement, and I do not present it as one.

For a business owner trying to decide whether the current setup is enough, I would start with a scenario instead of a product:

Imagine an important mailbox, OneDrive account, SharePoint library, or collection of company files became unavailable today. Who would you call? What could they recover? How far back could they go? How long would it take?

If you cannot get clear answers to those questions, that is where I would start.

Microsoft 365 Backup Questions Small Business Owners Ask

Does Microsoft 365 automatically back up everything in my business?

Microsoft 365 provides multiple native data protection and recovery capabilities, but that does not mean every Microsoft 365 tenant automatically has the same backup configuration or recovery capability. Microsoft also offers Microsoft 365 Backup as a separate service. What your business can recover depends on the services, policies, backup products, retention settings, and other configurations actually in place.

Is OneDrive a backup?

OneDrive provides synchronization, versioning, recycle bin, and recovery capabilities, but I would not treat having files in OneDrive as the entire Microsoft 365 backup strategy for a business. I want to understand how the organization would recover information across OneDrive, SharePoint, Exchange Online, and any other important Microsoft 365 services it relies on.

What happens to OneDrive when an employee leaves?

It depends on what happens to the user's account and how the Microsoft 365 tenant is configured. Deleting the Microsoft Entra ID user starts Microsoft's deleted user OneDrive retention process. Simply removing the license follows a different unlicensed OneDrive lifecycle. That distinction is important enough that I recommend dealing with company data ownership as part of the offboarding process rather than waiting for Microsoft retention or archival timelines to make the decision for you.

Should shared company files be stored in OneDrive or SharePoint?

For information that belongs to an individual employee and is primarily that person's working data, OneDrive can make sense. For information that belongs to a department, project, team, or company and needs to remain available independently of one employee, I generally prefer SharePoint. The right structure depends on how the business works, but shared company information should not accidentally depend on one person's account.

How do I know whether my Microsoft 365 backup actually works?

Test a restore. Confirm what is protected, how long it is retained, who receives failure notifications, and what recovery options are available. A dashboard showing that backups completed successfully is useful, but being able to successfully recover the information the business needs is what proves the recovery process works.

Know How You Would Get Your Data Back Before You Need It

Microsoft 365 backup does not need to become another technical subject a small business owner has to master. You do not need to memorize Microsoft's OneDrive lifecycle or understand every recovery mechanism available in SharePoint. You do need someone managing the environment who understands where your important information lives, what protects it, how long those protections last, and what happens when something goes wrong.

That is ultimately what I am looking for when I review backup and recovery for a client. I want to know where the data is, who owns it, what is protecting it, who knows when protection fails, and what I can actually restore when the client needs me.

If nobody has looked at those questions recently, SNL Tech Services can review your Microsoft 365 environment, existing backup and recovery strategy, and how your business is managing its Microsoft 365 data.

ADDITIONAL RESOURCES

Microsoft Learn: Overview of Microsoft 365 Backup

Microsoft's current documentation for Microsoft 365 Backup, including supported Exchange Online, SharePoint, and OneDrive workloads, configurable recovery windows, recovery points, and restore capabilities. Microsoft 365 Backup Overview

Microsoft Learn: SharePoint and OneDrive Data Resiliency in Microsoft 365

Microsoft's documentation covering SharePoint and OneDrive resiliency, versioning, Files Restore, recycle bins, and Microsoft's native recovery mechanisms. SharePoint and OneDrive Data Resiliency

Microsoft Learn: OneDrive Retention and Deletion

Microsoft's current documentation explaining the difference between deleting a Microsoft Entra ID user, removing licensing, the standard deleted user retention process, and the current unlicensed OneDrive lifecycle. OneDrive Retention and Deletion

Microsoft Learn: Set the OneDrive Retention for Deleted Users

Microsoft documents a configurable retention setting of 30 through 3,650 days for a deleted user's OneDrive. Set OneDrive Retention for Deleted Users

Microsoft Learn: Manage Unlicensed OneDrive User Accounts

Microsoft's current guidance covering the lifecycle of unlicensed OneDrive accounts, including read only status, archival, retention, and deletion considerations. Manage Unlicensed OneDrive User Accounts

Microsoft Learn: Microsoft 365 SharePoint Data Deletion

Microsoft's current documentation explaining SharePoint deletion, the 93 day deleted site retention period, and Microsoft's additional platform recovery mechanisms. Microsoft 365 SharePoint Data Deletion