Does Microsoft Back Up Microsoft 365?
Not by default, and not in the way your client means. Microsoft keeps Microsoft 365 running and holds deleted items for a limited time, but it keeps no independent copy you can restore after a deletion, a ransomware sync or a compromised admin. That's the shared responsibility model in plain words: the service is Microsoft's, the data is your client's. When something goes missing, the call comes to you.
Every Safety Net Lives Inside the Tenant
The recycle bin empties on a timer, and the request to get something back usually arrives after it has run out. Retention policies and holds sit in the same tenant, so a compromised Global Administrator can usually remove them along with everything else. Microsoft's replication keeps the service up, and it copies a deletion as faithfully as a new file. When ransomware encrypts files on one laptop, OneDrive syncs the encrypted versions straight into the tenant. None of that is a flaw in Microsoft 365. It's a service built to stay available, not a backup built to bring things back.
Microsoft's Safety Nets
| Safety net | Where it lives | Restore after an attack? |
|---|---|---|
| Recycle bin and deleted items | Inside the tenant | Only if nobody emptied it and its timer hasn't run out |
| Retention policies and holds | Inside the tenant | Only if the attacker didn't remove them |
| Microsoft's replication | Microsoft's data centres | No, it copies the damage like any other change |
| An independent backup | Outside the tenant, under a lock | Yes, tenant credentials can't reach it |
The Words That Land With a Client
Clients rarely object to backup. They object to paying for something they think they already have, often because someone senior believes the recycle bin will save them. So make the loss concrete. Ask what happens when a folder deleted in March is needed in June, or when an admin account is phished and the attacker empties the mailboxes. Then give them the one line: Microsoft keeps the lights on, and the backup is how you get their data back. One restore in front of them, with a signed report at the end, settles it faster than any slide.
How EnterProtect Backs Up Microsoft 365
EnterProtect Microsoft 365 Backup keeps a copy of every client's mail, OneDrive, SharePoint and Teams outside the tenant, captured every four hours, six times a day. It connects with a read-only identity that can't write or delete anything, so a stolen admin login can't touch the copy. Restores run from one email to a whole tenant's data, and each one ends in a signed report. If a client's admin removes the backup app's consent, EnterProtect spots the lapse within hours, alerts you and shows the gap in the record instead of passing it off as coverage.
What MSPs Ask Next About Microsoft 365
Why not use Microsoft's own backup for Microsoft 365?
It's a separate paid service, billed by the gigabyte at about $0.15 a GB a month, so a 25 GB mailbox costs close to $4 a month in storage alone. EnterProtect's Essential list price is $3.00 a mailbox with 50 GB included and pooled across your book, and its copy sits outside the tenant's own admin domain.
Do Microsoft 365 retention policies count as a backup?
No. Retention preserves items a user deletes, inside the same tenant an attacker would compromise, and by default a Global Administrator can change or remove it. A backup is a separate copy you can restore from when the tenant itself is the problem.
What should a Microsoft 365 backup cover?
Exchange Online, OneDrive, SharePoint and Teams at minimum, plus the tenant's configuration if you want to rebuild a damaged tenant rather than only restore its data. EnterProtect Essential covers the data. Complete adds Entra ID, Conditional Access, Intune policy, BitLocker keys and Planner.
Want the Copy Microsoft Doesn't Keep?
EnterProtect Microsoft 365 Backup keeps every client's data outside the tenant and proves each restore with a signed report.
More Answers
See Every AnswerWhat Happens to a Client's Backups When They Change MSP?
Usually the backup history stays behind with the outgoing MSP's tools, and the incoming MSP starts the client from zero.
What Is an Immutable Backup?
An immutable backup is a copy that can't be changed or deleted until a set date, by anyone, including the administrator who made it.
Can I Use My Own Hardware for a BCDR Appliance?
With EnterProtect, yes.