Microsoft 365 backup: why Microsoft does NOT back up your email (and what to do)

Many IT managers believe Microsoft 365 backs up their data. The confusion is understandable: Microsoft has redundant datacenters, geographic replication, and a 99.9% uptime SLA. But resilience does not mean backup.

Microsoft explicitly distinguishes both in its terms of service. The shared responsibility model works as follows:

• Microsoft is responsible for infrastructure availability, physical failure protection, and cross-datacenter replication.
• You are responsible for your data: its content, long-term retention, and recovery from accidental or malicious deletion.

This model is documented in Microsoft compliance pages, but few resellers highlight it at the point of sale.

Concretely, what Microsoft offers natively:

• Exchange Recycle Bin: deleted emails recoverable for 14–30 days depending on configuration.
• Litigation Hold / eDiscovery: legal email retention (included in E3/E5, absent from Business Basic/Standard).
• SharePoint versioning: 500 file versions retained, but automatic purge beyond that.

None of these features is a proper backup: they do not allow you to restore the complete state of a mailbox to a specific past date, or recover data deleted more than 30 days ago without a specific licence.

If your SMB processes contractual emails, customer data, or exchanges subject to local regulation (OHADA, GDPR, etc.), the absence of third-party backup is a real legal and operational risk.

Here are five real situations documented by the Veeam, Datto and Spanning support teams. In each case, SMBs suffered permanent data loss on Microsoft 365.

1. Accidental user account deletion: an admin deletes a user without suspending the mailbox first. By default, Exchange Online purges the mailbox 30 days later. If no one notices before that deadline — common during rushed departures — emails are unrecoverable natively.
2. Ransomware via OneDrive sync: an employee syncs OneDrive with their PC. Ransomware encrypts local files; OneDrive propagates encrypted files to the cloud. The previous version exists for 30 days — but if the attack is only detected at D+35, it is too late. SharePoint keeps 500 versions, but versions deleted by the ransomware itself are not restorable without a backup.
3. Malicious departing employee: before leaving, a staff member methodically deletes their emails and shared SharePoint files. The deletion is "authorised" by the system — Microsoft cannot distinguish legitimate deletion from sabotage.
4. Misconfigured retention policy: an admin sets a "delete after 90 days" rule intending to apply it to an archive folder, but applies it to the main mailbox. Within 90 days, 3 years of emails disappear automatically.
5. Tenant failure or corruption: rare, but documented — third-party migrations or poorly coded app integrations have corrupted data at tenant scale. In such cases, Microsoft can assist with recovery, but the delay may exceed 72 hours and the recovery scope is not guaranteed.

These five scenarios share one thing: the cause of loss is within your responsibility perimeter, not Microsoft's. That is precisely why third-party backup exists.

Four solutions dominate the Microsoft 365 backup market for SMBs. Here is an objective comparison based on 2026 public features and pricing:

Tool	Indicative price/user/mo	Max retention	Restore granularity	EU residency
Veeam Backup for M365	~€1.50–3 (self-hosted) / ~€4–6 (cloud)	Unlimited (your storage)	Email, attachment, folder, calendar, contact, Teams	Yes (Azure EU or your infra)
Spanning Backup	~€3–4	Unlimited	Email, attachment, OneDrive file, SharePoint item	Yes (EU datacenter available)
Datto SaaS Protection	~€3–5	Unlimited	Email, Teams, SharePoint, OneDrive	Yes
AvePoint Cloud Backup	~€2–4	Unlimited	Finest granularity (item-level)	Yes

Selection criteria for an African SMB:

• Veeam is ideal if you have an in-house sysadmin and want to control your own storage (S3-compatible, OVH Object Storage, IONOS S3). Moderate learning curve.
• Spanning is the simplest to deploy — pure SaaS, intuitive interface, ideal for SMBs without a dedicated IT team.
• Datto is MSP-oriented (IT resellers): if you work with a local IT provider, there is a good chance they use Datto.
• AvePoint excels in complex environments (multi-tenant, SharePoint-heavy, Teams with many channels).

For an SMB with 10–50 users and no dedicated IT team, Spanning or Datto offer the best simplicity/protection balance. Budget €3–5 per user per month — that is €30–250/month for 10–50 users.

The traditional 3-2-1 backup rule (3 copies, 2 different media, 1 off-site) adapts to the Microsoft 365 SaaS context as follows:

• Copy 1 — Live M365 data: your active tenant. Microsoft ensures resilience, not retention.
• Copy 2 — Daily incremental backup: delta snapshot every 24 hours to object storage (S3 eu-west-1, OVH Object Storage Strasbourg, or IONOS S3 Frankfurt). Minimum retention: 1 year for standard businesses, 3 years for regulated sectors (finance, health, legal services).
• Copy 3 — Monthly full backup: full snapshot exported to a second bucket or cold storage (AWS Glacier, Azure Archive). Minimal cost (~$0.004/GB/month on Glacier).

Recommended cadence:

1. Monthly full backup (1st day of month)
2. Daily incremental backup (each night, 2 AM–5 AM window)
3. Mandatory semi-annual restore test: restore a full mailbox into a test tenant. An untested backup is a backup whose reliability is unknown — and in 30% of documented cases, it does not work.

Storage sizing for 20 users:

• Average Exchange mailbox: 8 GB — Total email: 160 GB
• Average OneDrive: 15 GB — Total OneDrive: 300 GB
• SharePoint + Teams: ~50 GB shared
• Raw total: ~510 GB. With Veeam deduplication (~40%): ~300 GB
• OVH Object Storage cost: ~€3.60/month for 300 GB

For 3-year retention with monthly + daily backups: plan ~3–5 GB of additional storage per user per year. 20 users × 3 years × 4 GB = ~240 GB additional.

AfricWebHosting offers a managed Microsoft 365 backup option based on Veeam Backup for M365, available as an add-on to your Microsoft 365 subscription:

• Indicative price: €2.50/user/month (coming soon — currently being qualified)
• Coverage: Exchange Online (email, calendars, contacts), OneDrive, SharePoint, Teams
• Storage: EU Object Storage (Frankfurt or Paris depending on availability), 1-year retention included
• Restore: item-level (email, file, individual contact) within 4 business hours on request via ticket
• Reporting: monthly backup compliance report + automatic alert on failure

While this option becomes available, you can deploy Spanning or Datto directly from their websites — setup takes under 30 minutes for a 10-user tenant.

If you want to be notified when the managed backup option launches, or want to discuss your specific retention needs (local regulations, ongoing audit), contact us — we respond within 24 business hours.

To go further on M365 tenant security, also read our guide on migrating Microsoft 365 from IONOS/OVH/Gandi which covers SPF/DKIM/DMARC configuration and post-migration 2FA.