1. The Backup Limitations of Microsoft Office 365
Common retention misunderstandings demystified.
BACKUP BASICS

2. Perception versus reality
You may be asking — why do I need backup? Microsoft backs everything up for me.
Not so fast! Microsoft is only responsible for the Office 365 infrastructure. Not the data.
Perception
Microsoft backs up all Office 365 data
Reality
Truth be told — your perceptions about what is actually being backed up versus what is really being backed up are probably out of sync. This is understandable. The rapid adoption of the cloud and popular ecosystems such as Office have left little time for proper education.
SharePoint & OneDrive are backed up
Calendars & tasks are backed up
The reality: Microsoft is not in the backup-as- a-service (BaaS) business. With Office 365, it’s your data. You own it. You control it. You are responsible for it. Period.
s & attachments are backed up
Deleted files are backed up

4. Office 365 data responsibility grid
Source:
PRIMARY
SUPPORTING
REGULATIONS
SECURITY
Infrastructure and Uptime of the Cloud and the Apps Within Office 365
Recycle Bin (aka Trash) as temporary Data Recovery
Data Processor Role providing privacy tools, regulatory controls, industry certs, HIPAA, etc.
IT Structural Role providing user & admin security, physical security, app security, etc.
Microsoft’s
Responsibility
Data Center Geo Redundancy
Office 365 Backup External copies of All Data across All Apps
Internal Data issues such as Accidental Employee Theft and Accidental Deletion to External Data issues like Phishing and Ransomware
Manage Data according to Regulatory Rules, and Internal Compliance, HR & Legal requests
Access/Control of Your Office Data in Exchange Online, SharePoint, OneDrive, etc.
Your
Responsibility
Data Storage, Retention & Recovery

5. Data retention: What Microsoft backs up
7 DAYS
30 DAYS
90 DAYS
1 YEAR
2 YEARS
5 YEARS
Inbox or Folder Data
Within O365
Moved to Archive
Deleted Items (Recycle Bin)
Permanently Deleted
Auto Archived Data (Set at 1 Mo)
Deleted SharePoint Sites / Items
Recycle Bin 1
Recycle Bin 2
Deleted OneDrive Files
Staff Leaves Company
Note
Microsoft administrators often misunderstand what backup is provided in Office 365 and what is not, then discovering too late that they cannot restore client data. A Dropsuite survey showed a high number of Admins were using the recycle bin as a backup repository. Recycle bins are trash cans, not a safe place to store valuable client data.
Sources
Microsoft Default MRM Policy: SharePoint Server backup:
OneDrive For Business File Restore: Note: An admin may have the ability to extend retention rules based on the Office 365 license used, or Microsoft may alter retention rules.