en
Does Microsoft 365 require a separate backup?
Many organizations store their email, documents, calendars, and other important business information in Microsoft 365. Employees use Outlook, Teams, SharePoint, and OneDrive on a daily basis. This can quickly lead to the assumption that all data is automatically backed up with unlimited storage.
Microsoft provides a reliable cloud environment and offers various options for recovering deleted or modified data. However, this does not automatically mean that every organization has a backup and recovery solution that is tailored to its specific business risks.
Does Microsoft 365 therefore require a separate backup? That depends on the data you process, how long you want to keep it, and how quickly you need to be able to resume work after an incident.
On this page
Does Microsoft 365 create backups on its own?
Microsoft protects the infrastructure on which Microsoft 365 runs. Data is stored redundantly. As a result, a failure of individual hardware or an outage at a data center does not immediately result in the loss of your files and emails.
Microsoft 365 also includes various recovery options. These include, for example:
Recycle Bins for deleted files;
version history in SharePoint and OneDrive;
recovery options for deleted emails;
retention policies for storing and deleting data;
Recovery of OneDrive and SharePoint environments;
Microsoft 365 Backup for Exchange, SharePoint, and OneDrive.
These features are valuable, but they don’t all serve the same purpose. For example, the Recycle Bin helps with a recently deleted file. Version history can restore a previous version of a document. Retention policies help preserve information according to established rules.
A backup strategy goes a step further. It involves determining in advance which data needs to be protected, which recovery points are necessary, and how quickly the information must be restored.
Availability is not the same as a backup
Microsoft ensures the availability and continuity of the Microsoft 365 platform. Your organization remains responsible for how accounts, data, retention periods, and recovery options are configured.
That distinction is important. If Microsoft’s infrastructure experiences an outage, Microsoft is responsible for restoring the service. But if an employee deletes a file, an administrator incorrectly deactivates an account, or ransomware damages files, the incident occurs within your own Microsoft 365 environment.
You'll need to have answers to questions such as:
What data has been lost or changed?
Is the correct version still available?
How far back in time can we go?
Can we restore a single file, a mailbox, or an entire environment?
Who is authorized to perform a recovery operation?
How quickly can employees get back to work?
Therefore, simply relying on the availability of the cloud is not enough. Recovery capabilities must be carefully planned and aligned with business operations.
Recovery, retention, and backup are not the same thing
Recovery options, retention, and backup are often used interchangeably. However, they each serve a different purpose.
Recovery Options
Recovery features help with common errors. A file that was recently deleted may be restored from the Recycle Bin. Version history allows you to restore a previous version of a document.
These features are useful for handling day-to-day incidents, but they depend on the system configuration and the available retention periods.
Retention
A retention policy determines how long information must be retained or when it should be deleted. This can be important for legal retention periods, internal agreements, investigations, and compliance.
Retention focuses primarily on information management. It is not necessarily the same as a quick and complete recovery of a mailbox, OneDrive account, or SharePoint environment.
Backup
A backup is designed to enable recovery following data loss, corruption, human error, or a cyber incident. The goal is to be able to restore a usable recovery point within an agreed-upon timeframe.
Retention and backup can therefore complement each other. A backup is no substitute for a good retention policy. Retention does not automatically replace a backup solution.
When is it a good idea to create an additional backup?
An additional backup is particularly important when Microsoft 365 contains critical business information and data loss has a direct impact on employees, customers, or business operations.
Sometimes data isn't noticed until later
Not every deletion is noticed right away. An agreement, email inbox, or project folder may not be needed again until months later.
Without appropriate retention periods or backups, the information may already be permanently lost by that point.
Employees and administrators can make mistakes
An employee might accidentally delete a folder or overwrite a document. An administrator might also make a mistake when modifying permissions, accounts, or settings.
A well-configured backup provides an additional recovery option when the built-in features are no longer sufficient.
An employee is leaving the company
When an employee leaves the company, email accounts, files, licenses, and access rights must be handled with care.
It must be clear from the outset that:
which data must be retained;
who owns the files and documents;
who will have access to the mailbox;
how long data must remain available;
when the user account can be permanently deleted.
A backup plan serves as an important safety net in this context, but it is no substitute for a well-structured offboarding procedure.
Ransomware can also affect cloud data
Cybercriminals don't just target local servers. Microsoft 365 accounts can also be compromised.
An attacker can delete, modify, or encrypt files. Due to automatic synchronization, unwanted changes can quickly spread throughout OneDrive and SharePoint.
Version history and data retention can assist with recovery. A separate backup and recovery solution can provide additional assurance, provided it is properly configured, secured, and monitored.
Learn more about Encis' security solutions.
The organization must be able to get back on track quickly
Having a copy isn't enough. It must also be possible to restore the data within a reasonable amount of time.
Therefore, the following must be determined in advance:
how much data loss is acceptable;
how far back the organization needs to be able to go;
how quickly data must be restored;
which systems and users are restored first;
who is responsible for carrying out the recovery.
What Microsoft 365 data do you need to protect?
A good backup strategy doesn't start with a product. First, you need to determine what data your organization needs to keep operating.
For many organizations, the key issues are:
Exchange Online mailboxes;
calendars and contacts;
employee OneDrive files;
SharePoint sites and document libraries;
files that employees share via Teams;
data from former employees;
important project, customer, and contract documents.
Files shared via Microsoft Teams are often stored in SharePoint or OneDrive. The configuration of these underlying environments therefore plays a role in determining how files are stored and recovered.
Encis helps organizations implement, set up, and manage Microsoft 365. In doing so, we take a holistic view of the entire digital workplace, rather than focusing solely on individual applications.
See also how Encis helps organizations create a secure, modern workplace.
A backup must be managed and monitored
Simply setting up a backup solution is not enough. Its operation must be monitored, and recovery must be tested periodically.
The following must be checked:
whether the correct users and environments have been included;
whether backups are performed without errors;
whether reports and deviations are followed up on;
whether retention periods are still appropriate for the organization;
whether new employees are automatically added;
whether data can actually be restored;
how long a recovery operation takes in practice.
A backup that is never checked or tested provides, above all, a false sense of security.
Backup and recovery are therefore an integral part of structured IT management. As part of its Managed Services, Encis monitors, manages, and maintains its clients’ IT environments. In doing so, Encis handles and oversees backups, updates, and security, among other things.
How does Encis manage backup and recovery?
Encis doesn't just provide advice on Microsoft 365 and backups. We set up the chosen solution, manage it, and verify that the backups are running properly.
To do this, we first take a look at your organization. What data is important? How long does it need to remain available? How quickly must a mailbox, file, or environment be restored? And what risks must not disrupt day-to-day operations?
Based on this, Encis can, among other things, provide:
the setup and management of Microsoft 365;
an appropriate backup and recovery solution;
management of user accounts and access rights;
monitoring of backups and notifications;
support for data recovery;
secure employee onboarding and offboarding;
security of workstations and Microsoft 365 accounts;
agreements regarding management, support, and responsibilities.
The solution required varies from organization to organization. A small organization with limited recovery needs requires a different setup than a company that relies on large volumes of documents, mailboxes, and shared environments on a daily basis.
Encis ensures that the chosen solution fits your organization and becomes an integral part of your day-to-day operations.
Is your Microsoft 365 data properly protected?
Not sure what data is being backed up, how long it's retained, or how quickly it can be restored?
Encis assesses your current setup and determines which backup and recovery options are best suited for your organization. We can then implement, manage, and monitor the solution.
Frequently Asked Questions About Microsoft 365 Backup
Microsoft protects the Microsoft 365 infrastructure and offers various recovery options, such as recycle bins, version history, and retention policies. That does not automatically mean that your organization has a comprehensive backup strategy. The type of additional backup required depends on the data, retention periods, and desired recovery time.
No. OneDrive syncs files between devices and the cloud. This is useful for accessibility and collaboration, but syncing is not the same as a backup. When a file is deleted, overwritten, or encrypted, that change may also be synced.
The Recycle Bin is primarily intended for files that have been recently deleted. For data that is not noticed to be missing until much later, large amounts of data, or recovery following a cyber incident, an additional backup may be necessary.
Retention determines how long information is retained or when it is deleted. A backup is primarily intended to restore data after loss, damage, or an incident. Retention and backup can complement each other, but they do not automatically replace one another.
That depends on the solution you choose. Many backup solutions protect Exchange Online, OneDrive, and SharePoint in any case. Files shared via Teams are often stored in SharePoint or OneDrive and are therefore covered by the protection provided by these environments.
The size of the organization is not the most important criterion. The question is how dependent the company is on email, documents, and other Microsoft 365 data. If the loss of this data disrupts business operations, a well-designed backup and recovery solution is advisable.
A backup won't prevent a ransomware attack, but it can help restore damaged, deleted, or encrypted data. Therefore, combine backups with measures such as multi-factor authentication, access control, monitoring, and secure workstations.
When an employee leaves the company, email accounts, files, access rights, and licenses must be handled with care. Determine in advance which data needs to be retained, who will take over responsibility for it, and when the account can be deleted. A backup provides an extra safety net, but it is no substitute for a proper offboarding procedure.
Backups must be monitored on a regular basis. Not only should you verify that the backup runs without errors, but you should also periodically test whether files, mailboxes, and environments can actually be restored.
Yes. As part of its managed services, Encis implements appropriate backup and recovery solutions, monitors their implementation, and provides support during recovery. The specific data, retention periods, and recovery options required are tailored to the organization and specified in the service agreement.
Our specialists will be happy to help you
Encis is your IT partner, providing, installing, and managing your IT infrastructure, communication services, and applications.
Want to explore the possibilities? Get in touch.
Contact
