Backing Up Microsoft 365: A Practical Guide for Fintechs (2026)

Most businesses we speak to assume Microsoft backs up their Microsoft 365 data. It doesn't, at least not in the way they think. Microsoft keeps the service running. Getting your data back after someone deletes it, encrypts it or corrupts it is your job.

For a fintech, that gap matters more than most. Your email, client files, approvals and Teams conversations all live in Microsoft 365, and regulators expect you to be able to restore them. This guide covers what Microsoft gives you out of the box, where it stops, and how to put a backup in place that you can actually rely on.

Key Takeaways: Backing Up Microsoft 365

• Under Microsoft's shared responsibility model, Microsoft protects the platform and you are responsible for protecting and recovering your data.
• Native recovery is short: deleted Exchange items are recoverable for 14 days by default (30 at most), and SharePoint and OneDrive recycle bins hold files for 93 days.
• Retention policies and litigation hold are compliance tools, not backups. They won't give you a clean point-in-time restore after a ransomware attack.
• Microsoft 365 Backup covers Exchange Online, OneDrive and SharePoint. Teams, Entra ID and other workloads need extra thought or a third-party tool.
• A backup only counts if you've tested a restore and protected the backup admin accounts as tightly as your production ones.

Does Microsoft back up your Microsoft 365 data?

No, not as a backup you control. Microsoft 365 runs on a shared responsibility model: Microsoft is responsible for the infrastructure, availability and resilience of the service, and the customer is responsible for the data inside it.

Microsoft replicates your data across its data centres so the service stays up if hardware fails. That replication copies deletions and encryption too. If a user deletes a SharePoint library, or ransomware encrypts a set of OneDrive files, those changes replicate just like any other. Replication keeps you online. It doesn't take you back in time.

How long can you recover deleted data in Microsoft 365?

Native recovery windows are measured in days, not years. The defaults are:

• Exchange Online: items deleted from Deleted Items move to the Recoverable Items folder for 14 days by default. An admin can extend this to a maximum of 30 days.
• SharePoint Online and OneDrive: deleted files sit in the first-stage and second-stage recycle bins for 93 days in total. That period can't be changed.
• Leavers' OneDrive accounts: when a user account is deleted, their OneDrive is kept for 30 days by default before it's removed, unless you've changed the retention setting.
• Entra ID: deleted users and Microsoft 365 groups stay in the Entra recycle bin for 30 days.

Those windows are fine for "I deleted a file yesterday". They don't help when nobody notices a problem for four months, or when you need to roll back hundreds of files to the state they were in before an attack.

Why isn't a retention policy a backup?

A retention policy in Microsoft Purview keeps copies of content for a set period so you can meet legal and regulatory obligations. It's designed for eDiscovery and compliance, not recovery.

Retained content is held in hidden locations like the Preservation Hold library and Recoverable Items folder. You can search it and export it, but you can't use it to restore a mailbox, site or OneDrive to a point in time. It also sits inside the same tenant, so an attacker with enough admin rights can change the policy. We'd always run retention and backup side by side, because they solve different problems.

Why do regulated fintechs need Microsoft 365 backup?

Because regulators expect you to show you can restore data and keep important services running, and Microsoft 365 holds a lot of that data. Three sets of rules come up most often with the fintechs we work with.

UK GDPR

Article 32 of UK GDPR asks for appropriate technical measures, including the ability to restore the availability of and access to personal data in a timely manner after an incident. If customer data lives in Exchange or SharePoint, your backup is part of how you meet that.

FCA operational resilience

Since 31 March 2025, FCA-regulated firms have had to show they can stay within impact tolerances for their important business services during severe but plausible disruption. If client communications, approvals or onboarding run through Microsoft 365, losing that data is exactly the kind of scenario you need a tested recovery plan for.

DORA

If you operate in or serve the EU financial sector, the Digital Operational Resilience Act sets out requirements for ICT backup policies, restoration and recovery (Article 12). It expects backups that are separate from the source systems and restore procedures that are tested regularly.

How does backup protect you against ransomware?

A good backup lets you restore clean data from before the attack, so you aren't negotiating with the attacker. That only works if the backup itself survives the attack.

Modern ransomware goes after backups first. If the backup tool sits behind the same global admin account that's just been compromised, the attacker can delete your restore points along with everything else. Protect your backup with:

• Separate, tightly scoped admin roles for backup, activated through Privileged Identity Management rather than held permanently
• Phishing-resistant MFA and Conditional Access on every account that can change or delete backups
• Immutable or isolated storage, so restore points can't be changed or deleted within their retention period
• Alerts on destructive actions such as policy deletion or retention changes

What does Microsoft 365 Backup cover?

Microsoft 365 Backup is Microsoft's native backup service. It covers Exchange Online mailboxes, OneDrive accounts and SharePoint Online sites, and stores restore points in Azure, separate from the live service. It's billed pay-as-you-go by the amount of data protected, through an Azure subscription.

It has improved a lot since launch. Restore points go back up to a year, file and folder level restore for SharePoint and OneDrive reached general availability in 2026, and you can now protect an entire workload with a single policy rather than picking sites and mailboxes one by one. Restores of SharePoint and OneDrive are quick because the backup data stays within Microsoft's own infrastructure.

There are gaps to be aware of:

• Teams is only covered indirectly. Files live in SharePoint and OneDrive, and chat data lives in mailboxes, but there's no dedicated Teams restore.
• Entra ID configuration (Conditional Access policies, app registrations, group memberships) isn't covered at all.
• Power Platform, Planner and other workloads aren't covered.
• Your backup sits with the same provider as your production data, which some risk teams and auditors will want you to justify.

Native or third-party Microsoft 365 backup: which should you choose?

For most fintechs, the answer depends on how wide your Microsoft 365 footprint is and how your risk team views supplier concentration.

Microsoft 365 Backup suits firms that mainly need fast, large-scale restore for Exchange, SharePoint and OneDrive and are comfortable keeping backups inside Microsoft's boundary. Third-party tools such as Veeam, AvePoint or Druva typically cover more workloads, including Teams and Entra ID, and can store data outside Microsoft entirely. Some firms run both: native backup for speed, and a third-party copy for independence and wider coverage.

Whichever route you take, write the decision down with the reasoning. When an auditor or enterprise customer asks how you protect Microsoft 365 data, a documented choice is a much better answer than "we use the recycle bin".

A step-by-step approach to backing up Microsoft 365

Step 1: Map where your important data lives

List the mailboxes, SharePoint sites, OneDrive accounts and Teams that support your important business services. Include shared mailboxes and service accounts, which are easy to miss.

Step 2: Set recovery objectives

Agree how much data you can afford to lose (recovery point objective) and how quickly you need it back (recovery time objective) for each service. These should line up with your operational resilience impact tolerances.

Step 3: Choose your backup approach

Decide between Microsoft 365 Backup, a third-party tool or both, based on your coverage needs and your risk team's view on keeping backups with the same supplier.

Step 4: Lock down the backup itself

Use dedicated backup admin roles through PIM, enforce phishing-resistant MFA, and turn on immutability and alerting. Treat the backup console as one of the most sensitive systems you run.

Step 5: Test restores on a schedule

Restore a file, a mailbox and a full site at least quarterly, and record how long it took. If you've never restored from a backup, you don't really know it works.

Step 6: Document it for your auditors

Keep a short record of what's backed up, how often, where it's stored, who can access it and the results of your last restore test. That's the evidence regulators and enterprise customers will ask for.

Common mistakes with Microsoft 365 backup

• Relying on the recycle bin. It's a convenience feature with a hard 93-day limit, not a recovery plan.
• Treating retention policies as backup. They preserve content for compliance but won't restore a site or mailbox to a point in time.
• Forgetting Entra ID. Losing your Conditional Access policies or app registrations can take down access to everything, and they're rarely backed up.
• Leaving backup admin rights wide open. If a compromised global admin can delete your restore points, your backup won't survive the incident you bought it for.
• Never testing a restore. Most backup problems are found during a real incident, which is the worst possible time.

How Yobah approaches Microsoft 365 backup for fintechs

We start by mapping your Microsoft 365 data against your important business services, then agree recovery objectives with your risk and compliance team. From there we design the backup approach (native, third-party or both), secure it with the same Entra ID controls we use for the rest of your tenant, and set up a restore testing routine that produces evidence you can hand to an auditor or customer.

The aim is that when someone asks whether you can get your data back, you can show them the last test result rather than a promise.

FAQs About Backing Up Microsoft 365

Does Microsoft 365 include backup by default?

No. Microsoft 365 includes short-term recovery features like the recycle bin and Recoverable Items folder, but not a point-in-time backup you control. Microsoft 365 Backup is a separate, pay-as-you-go service you have to turn on and configure.

How long does Microsoft keep deleted emails and files?

Deleted Exchange items are recoverable for 14 days by default, extendable to 30. SharePoint and OneDrive files stay in the recycle bins for 93 days in total. After that, they're gone unless you have a backup.

Is a retention policy the same as a backup?

No. Retention policies keep copies of content for compliance and eDiscovery. They don't give you a way to restore a mailbox, site or OneDrive to how it was at a specific point in time.

Does Microsoft 365 Backup cover Teams?

Only partly. Teams files are stored in SharePoint and OneDrive, and chat data is stored in mailboxes, so backing those up covers some Teams content. There's no dedicated Teams restore, so many firms use a third-party tool if Teams is critical.

Do FCA-regulated firms need to back up Microsoft 365?

The FCA doesn't name specific tools, but operational resilience rules expect you to recover important business services within your impact tolerances, and UK GDPR requires you to restore access to personal data in a timely manner. If that data lives in Microsoft 365, a tested backup is the practical way to show you can.

How often should we test Microsoft 365 restores?

At least quarterly, covering a single file, a mailbox and a full site. Record the time each restore took and compare it against your recovery time objective.

Want a second pair of eyes on how your Microsoft 365 data is protected? Book a security review with our team.