Does Microsoft 365 Back Up Your Data? What South African Businesses Need to Know

Microsoft works on what it calls a shared responsibility model. Microsoft looks after the platform: the hardware, the data centres, the uptime and the physical security. You look after your data: who can access it, what happens when someone deletes it, and how you get it back.

Think of it like renting a unit in a secure complex. The complex has guards, cameras and a strong wall. But if you leave your own door open, or throw something away by mistake, that's on you.

Microsoft 365 does have some safety nets. They're useful, but they're short-term and they have hard limits.

• Email (Exchange Online). Deleted emails go to Deleted Items. Once that's emptied, they sit in a Recoverable Items folder for 14 days by default. An admin can stretch that to 30 days.
• Files in SharePoint and OneDrive. Deleted files go to the recycle bin, then to a second-stage recycle bin. Together, that gives you 93 days. After that, they're gone for good.
• Version history. SharePoint and OneDrive keep earlier versions of files, which helps when someone overwrites a document. It doesn't help when the whole file or site is deleted.
• People who leave. When a user's account is deleted, their OneDrive is kept for 30 days by default and then removed, unless someone steps in.

So if a deletion goes unnoticed for a few months, which happens all the time, there's often nothing left to restore.

Ransomware that syncs

If ransomware encrypts files on a laptop, OneDrive can sync those encrypted files straight up to the cloud. Version history may help, but rolling back thousands of files across many users isn't quick or simple.

Mistakes nobody notices

A staff member clears out an old project folder. A script deletes the wrong mailbox. Nobody spots it for three months. By the time someone asks for that contract, the 93-day window has closed.

Retention policies aren't backups

Microsoft Purview retention policies can keep content for longer, and they're worth setting up. But they're built for compliance, not for fast, easy restores. Getting data back out of them can be slow and fiddly.

Departing employees

When someone leaves and their licence is removed, their mailbox and OneDrive go with it after a while. If nobody moved their files first, years of client history can disappear.

POPIA's security safeguards condition (section 19) expects you to take reasonable steps to stop personal information being lost or damaged. If client records in your mailboxes or SharePoint vanish and you can't recover them, that's a problem you'd have to explain. A proper backup is one of the simplest ways to show you've taken reasonable steps. Our guide to POPIA and your backups goes into more detail.

A good Microsoft 365 backup copies your data to a separate system on a schedule, and lets you restore anything from a single email to a whole site. Here's what to look for:

1. Everything covered: Exchange, OneDrive, SharePoint and Teams, not just email.
2. Several backups a day for busy mailboxes and shared sites.
3. Retention that fits your business, whether that's one year or seven.
4. A copy outside Microsoft's environment, ideally in a South African cloud region if data residency matters to you.
5. Immutable storage, so backups can't be changed or deleted, even if an admin account is compromised.
6. Quick, granular restores. You should be able to get back one file without restoring everything.
7. Regular test restores, so you know it works before you need it.

Microsoft now sells its own Microsoft 365 Backup service, and there are well-known third-party tools such as Veeam Backup for Microsoft 365. Whichever you choose, the questions above still apply.

Ask yourself these four questions:

• If someone deleted a SharePoint site today, could we get it back in six months' time?
• Could we restore the whole mailbox of someone who left last year?
• If ransomware hit OneDrive, how long would it take to roll back every affected file?
• When did we last actually test a restore?

If any answer is “not sure”, it's worth a closer look. Our free ransomware recovery readiness check takes about two minutes and covers Microsoft 365 too.

At Big Data SA, we set up and manage Microsoft 365 backups for South African businesses, using Veeam, with your data securely stored in the country when residency matters. Have a look at our backup and disaster recovery service and our data governance and POPIA service, or book a free consultation and we'll walk through your setup with you.