Table of Contents
Does your organization have a real backup of its Microsoft 365 data, or are you relying on something that was never designed to protect you?
Most organizations are doing the latter without realizing it.
Microsoft 365 is the backbone of how modern businesses communicate, collaborate, and store critical files. Exchange Online handles email. SharePoint and OneDrive hold documents. Teams carries conversations and shared content. If any of that data disappears (due to accidental deletion, a departing employee, ransomware, or a misconfigured retention policy), the window to recover it is shorter than most organizations expect.
This article covers what Microsoft does and does not protect, where the gaps are, and what your options are for closing them.
What Microsoft Actually Covers (and What It Doesn't)
Microsoft is responsible for the infrastructure that runs Microsoft 365: the data centers, physical network, physical hosts, and physical security. When it comes to your data, Microsoft provides limited short-term recovery tools, and under its shared responsibility model your data remains your responsibility. [1] Microsoft Learn Shared responsibility in the cloud View source ↗
Microsoft's Own Guidance
Microsoft's shared responsibility guidance, which covers Microsoft 365, states: “For all cloud deployment types, you own your data and identities. You're responsible for protecting the security of your data and identities.” [1] Microsoft Learn Shared responsibility in the cloud View source ↗
This is known as the Shared Responsibility Model. Microsoft ensures the platform stays running. You are responsible for protecting what's inside it.
What About Microsoft 365 Backup?
Microsoft recently released its own backup product, Microsoft 365 Backup [2] Microsoft Learn Overview of Microsoft 365 Backup View source ↗ , which delivers faster in-tenant recovery for Exchange, SharePoint, and OneDrive data. This is a meaningful improvement over native retention limits alone, and Veeam has integrated with this technology as a platform partner. [3] Microsoft Adoption Veeam View source ↗
That said, many organizations still have good reasons to use a third-party backup platform:
- Separation of duties: a backup stored independently of your Microsoft tenant is not affected if the tenant itself is compromised, misconfigured, or ransomware-encrypted within M365
- Longer retention: Microsoft 365 Backup has its own retention limits (up to 2 years per backup policy); [2] Microsoft Learn Overview of Microsoft 365 Backup View source ↗ third-party platforms can retain data for 7+ years
- Broader coverage: third-party tools typically cover more workloads and offer more restore options
- MSP management: for organizations using a managed service provider, consolidating backup management outside Microsoft's admin center has operational advantages
Native Retention Has Hard Limits
Microsoft 365 includes some built-in data recovery features, but they are short-term safety nets, not a backup strategy.
| Workload | Native Recovery Window |
|---|---|
| SharePoint & OneDrive | 93 days total (both recycle bin stages combined) [4] Microsoft Learn Learn about retention for SharePoint and OneDrive View source ↗ |
| Exchange Online | 14 days by default, configurable up to 30 days [5] Microsoft Learn Recoverable Items folder in Exchange Online View source ↗ |
| Microsoft Teams (files) | Follows SharePoint/OneDrive rules (93 days) [4] Microsoft Learn Learn about retention for SharePoint and OneDrive View source ↗ |
| Microsoft Teams (chat/messages) | Stored in Exchange; governed by separate M365 retention policies. [6] Microsoft Learn Learn about retention for Microsoft Teams View source ↗ Without explicit configuration, practical recovery windows for deleted content can be surprisingly short |
Organizations can configure longer records-management retention via Microsoft 365 retention policies in Microsoft Purview [7] Microsoft Learn Learn about retention policies and retention labels View source ↗ , but those are not a substitute for an operational backup and restore platform. They are compliance controls, not recovery tools.
Once data exits the recycle bin, it is permanently deleted. In our experience, Microsoft Support can sometimes attempt a site-level restore beyond the recycle bin window for SharePoint, but this is not guaranteed, is not granular (individual files cannot be targeted, only entire site collections), and has no published SLA.
Litigation Hold and eDiscovery Are Not Backups
They are compliance tools designed for legal holds, not for operational data recovery. [7] Microsoft Learn Learn about retention policies and retention labels View source ↗ Retrieving a single email from litigation hold requires multiple administrative steps and administrator permissions. It is not a self-service restore tool.
Two Scenarios That Happen More Often Than You'd Expect
Scenario 1: The Departing Employee
A departing employee deletes a project folder from their OneDrive before offboarding. Nobody notices until months later when a colleague needs those files. At that point, the data is gone. The 93-day recycle bin window closed long ago.
Scenario 2: Ransomware Propagation
A ransomware attack encrypts files synced through OneDrive, and those encrypted versions propagate back to SharePoint. The attack is discovered days later. Without an independent backup taken before the encryption occurred, restoring clean data requires working backward through version history, which may not go far enough.
Why This Matters
Every organization relying on Microsoft 365 faces the same exposure. Critical business data (contracts, financials, communications, project files) lives in Exchange, SharePoint, OneDrive, and Teams. When native recovery windows close, that data is unrecoverable without a third-party backup in place. Data protection is a core component of any layered security strategy.
Cyber insurance carriers increasingly include third-party cloud backup as a question in underwriting questionnaires. While no universal formal requirement exists across all carriers, organizations that cannot demonstrate data recoverability may face higher premiums or gaps in coverage. It is becoming a baseline operational expectation, not a differentiator.
A Note for Legal and Law Firms
Law firms carry an additional layer of obligation that makes Microsoft 365 backup more than an IT best practice. It is an ethical and professional responsibility.
ABA Model Rules of Professional Conduct
- Rule 1.1 (Competence) requires attorneys to keep abreast of the benefits and risks of relevant technology (Comment 8). [8] ABA Rule 1.1 Competence - Comment View source ↗
- Rule 1.6 (Confidentiality) requires “reasonable efforts” to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, client information. [9] ABA Rule 1.6: Confidentiality of Information View source ↗
- Rule 5.3 (Nonlawyer Assistance) requires lawyers to make reasonable efforts to ensure that outside services, including internet-based services that store client information, are provided in a manner compatible with the lawyer’s professional obligations. [10] ABA Rule 5.3 Responsibilities Regarding Nonlawyer Assistance - Comment View source ↗
ABA Formal Opinion 477R (2017) [11] ABA Formal Opinion 477R: Securing Communication of Protected Client Information View source ↗ reinforced a risk-based, fact-specific approach to securing electronic communications and client data. Formal Opinion 483 (2018) [12] ABA Formal Opinion 483: Lawyers' Obligations After an Electronic Data Breach or Cyberattack View source ↗ addressed attorneys' obligations when a data breach or loss event occurs, including potential notification duties to current clients when there is a substantial likelihood that confidential information was compromised.
For law firms, the scenarios described above carry consequences beyond operational disruption. A deleted client matter folder or a ransomware event affecting client files can trigger ethics obligations, malpractice exposure, and notification requirements. A third-party backup is one of the most straightforward ways to demonstrate the “reasonable efforts” standard these rules require.
RPO and RTO: What Recovery Actually Means in Practice
Two terms worth understanding when evaluating backup vendors:
RPO — Recovery Point Objective
How much data can your organization afford to lose? If a vendor backs up email 3x/day, your worst-case data loss in a recovery scenario is roughly 8 hours of mail. If they back up 6x/day, that window drops to 4 hours.
RTO — Recovery Time Objective
How quickly does your organization need to be operational again? Granular item-level restores (a single email, a single file) typically take minutes. Mailbox-level or site-level restores can take longer.
For most organizations, practical targets often look something like this:
- File-level restore (single document, email): under 15–30 minutes
- Mailbox restore: within a few hours
- Full site or workload restore: same business day
Validate Before You Commit
Verify whether the vendor you're evaluating can meet those targets at your data scale before committing.
Vendor Options: What to Evaluate
The market for Microsoft 365 backup has matured significantly. Below is an overview of the vendors we evaluate most often for our clients, along with what distinguishes each one.
Veeam Data Cloud for Microsoft 365
Best for: Enterprise-grade protection with unlimited included storage and a fully SaaS-delivered platform
Veeam is one of the most widely deployed M365 backup platforms and has a formal strategic partnership with Microsoft, including integration with the Microsoft 365 Backup Storage API. [3] Microsoft Adoption Veeam View source ↗ The current product is called Veeam Data Cloud for Microsoft 365 and is fully SaaS-delivered.
Workloads covered: Exchange Online, SharePoint, OneDrive, Microsoft Teams (including shared and private channels), and Entra ID (Advanced and Premium plans).
What stands out:
- Unlimited storage included at all tiers — no separate storage charges
- Granular restore down to individual emails, files, and Entra ID attributes
- Immutable backups, MFA enforcement, and role-based access controls
- MSP multi-tenant management via the Veeam Service Provider Console
- Self-hosted deployment also available (Veeam Backup for Microsoft 365) for organizations that want to bring their own storage
The Premium tier is required for the fastest disaster recovery speeds using Microsoft 365 Backup Storage integration. Retention is configurable, with support for multi-year retention policies depending on plan and storage design.
AvePoint Cloud Backup
Best for: Complex SharePoint environments or multi-SaaS backup coverage beyond just M365
AvePoint has one of the longest track records in Microsoft 365 data protection — they have been backing up SharePoint since it was called Team Services. Their platform is particularly deep on SharePoint and Teams content structure, including permissions, site hierarchies, and metadata.
Workloads covered: Exchange Online, SharePoint, OneDrive, Microsoft Teams, Dynamics 365, Azure AD/Entra ID, Google Workspace, and Salesforce [13] AvePoint AvePoint Cloud Backup, Recovery, and Ransomware Protection View source ↗ — making it one of the broadest platforms available.
What stands out:
- Automated backups with granular item-level restore
- Flexible retention policies configurable to organizational needs
- Storage options: AvePoint-managed Azure storage or bring your own cloud
- Strong MSP reseller program with competitive partner pricing
- Broad coverage across SaaS platforms beyond M365
Some user reviews have noted that on-demand backup outside the scheduled window could be more flexible — worth asking about during a demo.
N-able Cove Data Protection
Best for: Backup coverage extending beyond M365 to include servers and workstations in a single console
Cove was built cloud-first and MSP-first. It is the only platform in this comparison that manages Microsoft 365, server, and workstation backups in a single web-based multi-tenant dashboard — no separate portals, no separate billing relationships for your IT provider to juggle.
Workloads covered: Exchange Online, SharePoint, OneDrive, Microsoft Teams [14] N-able Office 365 Backup with Cove for Microsoft 365 View source ↗ — all covered under a single per-user M365 license. Server and workstation backup are managed in the same console under separate licenses.
What stands out:
- Exchange backed up up to 6x/day; SharePoint up to 4x/day [14] N-able Office 365 Backup with Cove for Microsoft 365 View source ↗
- Up to 7-year data retention with regional storage selection for data sovereignty
- Storage is included — no second vendor for cloud storage
- SOC 1, SOC 2, ISO 27001, PCI-DSS, and HIPAA certifications
- Designed for MSP multi-tenant management with consolidated reporting
- Integrates with N-able RMM/N-central for unified monitoring
Some user reviews note that searching for specific data across the backup archive is less flexible compared to other platforms. Portable data export (e.g., PST format) has currently limited options — worth validating if that is a requirement.
Backupify (by Kaseya / Datto)
Best for: M365-focused backup with strong compliance credentials and minimal configuration overhead
Backupify [15] Backupify Cloud-to-Cloud SaaS Backup View source ↗ is now part of the Kaseya/Datto portfolio and runs on Datto's private cloud infrastructure. It is one of the simpler platforms to deploy and manage — automated lifecycle management handles user detection and departed employee archiving without manual intervention.
Workloads covered: Exchange Online, SharePoint, OneDrive, Microsoft Teams.
What stands out:
- Automated backups 3x/day with unlimited on-demand recovery
- Automatic detection of new users and archiving of departed employees
- SOC 2 Type II and HIPAA compliant
- AES-256 encryption with OAuth authentication
- Granular item-level or full-tenant restore without overwriting live data
PST export options are currently limited — restores go to another Microsoft 365 account rather than a portable file format. Some user reviews note UI complexity.
Side-by-Side Comparison
| Veeam Data Cloud | AvePoint Cloud Backup | N-able Cove | Backupify | |
|---|---|---|---|---|
| Exchange | Yes | Yes | Yes | Yes |
| SharePoint | Yes | Yes | Yes | Yes |
| OneDrive | Yes | Yes | Yes | Yes |
| Teams | Yes (incl. private channels) | Yes | Yes | Yes |
| Entra ID | Yes (Advanced+ only) | Yes | No | No |
| Server & Workstation | No | No | Yes | No |
| Backup Frequency | Configurable by tier | Automated / configurable | Up to 6x/day (Exchange), 4x/day (SharePoint) | 3x/day + on-demand |
| Retention | Configurable | Configurable | Up to 7 years | Configurable |
| Storage Included | Yes (unlimited) | Optional (BYO or AvePoint) | Yes (pooled) | Yes (Datto cloud) |
| MSP Multi-Tenant | Yes | Yes | Yes (strongest) | Limited |
| Compliance Certs | SOC 2, ISO 27001 | SOC 2, ISO 27001 | SOC 1, SOC 2, ISO 27001, PCI-DSS, HIPAA | SOC 2 Type II, HIPAA |
Features subject to change. Verify with vendors prior to purchasing. Contact DP3 for pricing guidance.
Our Recommendation
Every organization's environment is different. The right vendor depends on your workload scope, retention requirements, compliance obligations, and how your IT is managed. That said, there are a few consistent takeaways:
Fully SaaS with Unlimited Storage
If your organization needs a fully SaaS-delivered platform with unlimited storage and the broadest Microsoft 365 workload coverage, Veeam Data Cloud for Microsoft 365 is the strongest all-around option.
Deep SharePoint or Multi-SaaS Coverage
If you have deep SharePoint complexity or need backup across multiple SaaS platforms, AvePoint's depth and flexibility make it worth evaluating.
M365 + Servers + Workstations in One Console
If your organization needs backup coverage that extends beyond Microsoft 365 to include servers and workstations — all under a single managed solution — Cove is the strongest fit. It is also the right choice for organizations with strict data residency requirements or compliance mandates that require up to 7 years of retention.
Simple M365-Only Backup
If your backup requirements are focused exclusively on Microsoft 365 — no servers, no workstations, no Entra ID — and you want a straightforward solution with strong compliance credentials and minimal configuration overhead, Backupify is a solid fit.
The Worst Option Is No Backup
If your organization is relying solely on Microsoft's native recycle bin and retention policies, your data is on a countdown timer: 93 days for SharePoint and OneDrive, 14 to 30 days for email. [4] Microsoft Learn Learn about retention for SharePoint and OneDrive View source ↗ [5] Microsoft Learn Recoverable Items folder in Exchange Online View source ↗ Once those windows close, the data is gone.
Ready to Talk About Backup?
DP3 helps organizations evaluate, implement, and manage cloud backup as part of a broader data protection strategy. We can assess your current Microsoft 365 environment, identify gaps, and recommend a solution that fits your size, compliance obligations, and requirements.
Contact us to schedule a review
References and Standards
- [1] Microsoft, Shared responsibility in the cloud, Microsoft Learn, updated August 24, 2026. Accessed September 27, 2026. https://learn.microsoft.com/en-us/azure/security/fundamentals/shared-responsibility
- [2] Microsoft, Overview of Microsoft 365 Backup, Microsoft Learn, updated September 18, 2026. Accessed September 25, 2026. https://learn.microsoft.com/en-us/microsoft-365/backup/backup-overview?view=o365-worldwide
- [3] Microsoft, Veeam, Microsoft Adoption, updated September 30, 2026. Accessed October 23, 2026. https://adoption.microsoft.com/en-us/microsoft-365-backup/veeam/
- [4] Microsoft, Learn about retention for SharePoint and OneDrive, Microsoft Learn, updated June 25, 2026. Accessed September 25, 2026. https://learn.microsoft.com/en-us/purview/retention-policies-sharepoint
- [5] Microsoft, Recoverable Items folder in Exchange Online, Microsoft Learn, updated July 16, 2026. Accessed September 25, 2026. https://learn.microsoft.com/en-us/exchange/security-and-compliance/recoverable-items-folder/recoverable-items-folder
- [6] Microsoft, Learn about retention for Microsoft Teams, Microsoft Learn, updated June 25, 2026. Accessed September 25, 2026. https://learn.microsoft.com/en-us/purview/retention-policies-teams
- [7] Microsoft, Learn about retention policies and retention labels, Microsoft Learn, updated July 23, 2026. Accessed September 25, 2026. https://learn.microsoft.com/en-us/purview/retention
- [8] American Bar Association, Rule 1.1 Competence - Comment, Model Rules of Professional Conduct. Accessed September 28, 2026. https://www.americanbar.org/groups/professional_responsibility/publications/model_rules_of_professional_conduct/rule_1_1_competence/comment_on_rule_1_1/
- [9] American Bar Association, Rule 1.6: Confidentiality of Information, Model Rules of Professional Conduct. Accessed September 28, 2026. https://www.americanbar.org/groups/professional_responsibility/publications/model_rules_of_professional_conduct/rule_1_6_confidentiality_of_information/
- [10] American Bar Association, Rule 5.3 Responsibilities Regarding Nonlawyer Assistance - Comment, Model Rules of Professional Conduct. Accessed September 28, 2026. https://www.americanbar.org/groups/professional_responsibility/publications/model_rules_of_professional_conduct/rule_5_3_responsibilities_regarding_nonlawyer_assistant/comment_on_rule_5_3/
- [11] American Bar Association Standing Committee on Ethics and Professional Responsibility, Formal Opinion 477R: Securing Communication of Protected Client Information, revised May 22, 2017. https://www.americanbar.org/content/dam/aba/administrative/professional_responsibility/ethics-opinions/aba-formal-opinion-477.pdf
- [12] American Bar Association Standing Committee on Ethics and Professional Responsibility, Formal Opinion 483: Lawyers' Obligations After an Electronic Data Breach or Cyberattack, October 17, 2018. https://www.americanbar.org/content/dam/aba/administrative/professional_responsibility/ethics-opinions/aba-formal-op-483.pdf
- [13] AvePoint, AvePoint Cloud Backup, Recovery, and Ransomware Protection. Accessed September 25, 2026. https://www.avepoint.com/products/cloud-backup
- [14] N-able, Office 365 Backup with Cove for Microsoft 365, updated August 5, 2026. Accessed September 25, 2026. https://www.n-able.com/products/cove-data-protection/microsoft-365-backup
- [15] Backupify, Cloud-to-Cloud SaaS Backup, updated June 30, 2025. Accessed September 25, 2026. https://www.backupify.com/
© 2026 DP3. All rights reserved. Product details and features are subject to change; verify directly with vendors before purchasing. This article is provided for informational purposes and does not constitute a binding recommendation.