Most businesses we speak to assume Microsoft backs up their Microsoft 365 data. It doesn't, at least not in the way they think. Microsoft keeps the service running. Getting your data back after someone deletes it, encrypts it or corrupts it is your job.
For a fintech, that gap matters more than most. Your email, client files, approvals and Teams conversations all live in Microsoft 365, and regulators expect you to be able to restore them. This guide covers what Microsoft gives you out of the box, where it stops, and how to put a backup in place that you can actually rely on.
No, not as a backup you control. Microsoft 365 runs on a shared responsibility model: Microsoft is responsible for the infrastructure, availability and resilience of the service, and the customer is responsible for the data inside it.
Microsoft replicates your data across its data centres so the service stays up if hardware fails. That replication copies deletions and encryption too. If a user deletes a SharePoint library, or ransomware encrypts a set of OneDrive files, those changes replicate just like any other. Replication keeps you online. It doesn't take you back in time.
Native recovery windows are measured in days, not years. The defaults are:
Those windows are fine for "I deleted a file yesterday". They don't help when nobody notices a problem for four months, or when you need to roll back hundreds of files to the state they were in before an attack.
A retention policy in Microsoft Purview keeps copies of content for a set period so you can meet legal and regulatory obligations. It's designed for eDiscovery and compliance, not recovery.
Retained content is held in hidden locations like the Preservation Hold library and Recoverable Items folder. You can search it and export it, but you can't use it to restore a mailbox, site or OneDrive to a point in time. It also sits inside the same tenant, so an attacker with enough admin rights can change the policy. We'd always run retention and backup side by side, because they solve different problems.
Because regulators expect you to show you can restore data and keep important services running, and Microsoft 365 holds a lot of that data. Three sets of rules come up most often with the fintechs we work with.
Article 32 of UK GDPR asks for appropriate technical measures, including the ability to restore the availability of and access to personal data in a timely manner after an incident. If customer data lives in Exchange or SharePoint, your backup is part of how you meet that.
Since 31 March 2025, FCA-regulated firms have had to show they can stay within impact tolerances for their important business services during severe but plausible disruption. If client communications, approvals or onboarding run through Microsoft 365, losing that data is exactly the kind of scenario you need a tested recovery plan for.
If you operate in or serve the EU financial sector, the Digital Operational Resilience Act sets out requirements for ICT backup policies, restoration and recovery (Article 12). It expects backups that are separate from the source systems and restore procedures that are tested regularly.
A good backup lets you restore clean data from before the attack, so you aren't negotiating with the attacker. That only works if the backup itself survives the attack.
Modern ransomware goes after backups first. If the backup tool sits behind the same global admin account that's just been compromised, the attacker can delete your restore points along with everything else. Protect your backup with:
Microsoft 365 Backup is Microsoft's native backup service. It covers Exchange Online mailboxes, OneDrive accounts and SharePoint Online sites, and stores restore points in Azure, separate from the live service. It's billed pay-as-you-go by the amount of data protected, through an Azure subscription.
It has improved a lot since launch. Restore points go back up to a year, file and folder level restore for SharePoint and OneDrive reached general availability in 2026, and you can now protect an entire workload with a single policy rather than picking sites and mailboxes one by one. Restores of SharePoint and OneDrive are quick because the backup data stays within Microsoft's own infrastructure.
There are gaps to be aware of:
For most fintechs, the answer depends on how wide your Microsoft 365 footprint is and how your risk team views supplier concentration.
Microsoft 365 Backup suits firms that mainly need fast, large-scale restore for Exchange, SharePoint and OneDrive and are comfortable keeping backups inside Microsoft's boundary. Third-party tools such as Veeam, AvePoint or Druva typically cover more workloads, including Teams and Entra ID, and can store data outside Microsoft entirely. Some firms run both: native backup for speed, and a third-party copy for independence and wider coverage.
Whichever route you take, write the decision down with the reasoning. When an auditor or enterprise customer asks how you protect Microsoft 365 data, a documented choice is a much better answer than "we use the recycle bin".
List the mailboxes, SharePoint sites, OneDrive accounts and Teams that support your important business services. Include shared mailboxes and service accounts, which are easy to miss.
Agree how much data you can afford to lose (recovery point objective) and how quickly you need it back (recovery time objective) for each service. These should line up with your operational resilience impact tolerances.
Decide between Microsoft 365 Backup, a third-party tool or both, based on your coverage needs and your risk team's view on keeping backups with the same supplier.
Use dedicated backup admin roles through PIM, enforce phishing-resistant MFA, and turn on immutability and alerting. Treat the backup console as one of the most sensitive systems you run.
Restore a file, a mailbox and a full site at least quarterly, and record how long it took. If you've never restored from a backup, you don't really know it works.
Keep a short record of what's backed up, how often, where it's stored, who can access it and the results of your last restore test. That's the evidence regulators and enterprise customers will ask for.
We start by mapping your Microsoft 365 data against your important business services, then agree recovery objectives with your risk and compliance team. From there we design the backup approach (native, third-party or both), secure it with the same Entra ID controls we use for the rest of your tenant, and set up a restore testing routine that produces evidence you can hand to an auditor or customer.
The aim is that when someone asks whether you can get your data back, you can show them the last test result rather than a promise.
No. Microsoft 365 includes short-term recovery features like the recycle bin and Recoverable Items folder, but not a point-in-time backup you control. Microsoft 365 Backup is a separate, pay-as-you-go service you have to turn on and configure.
Deleted Exchange items are recoverable for 14 days by default, extendable to 30. SharePoint and OneDrive files stay in the recycle bins for 93 days in total. After that, they're gone unless you have a backup.
No. Retention policies keep copies of content for compliance and eDiscovery. They don't give you a way to restore a mailbox, site or OneDrive to how it was at a specific point in time.
Only partly. Teams files are stored in SharePoint and OneDrive, and chat data is stored in mailboxes, so backing those up covers some Teams content. There's no dedicated Teams restore, so many firms use a third-party tool if Teams is critical.
The FCA doesn't name specific tools, but operational resilience rules expect you to recover important business services within your impact tolerances, and UK GDPR requires you to restore access to personal data in a timely manner. If that data lives in Microsoft 365, a tested backup is the practical way to show you can.
At least quarterly, covering a single file, a mailbox and a full site. Record the time each restore took and compare it against your recovery time objective.
Want a second pair of eyes on how your Microsoft 365 data is protected? Book a security review with our team.