Guide · Microsoft 365
Backing up Microsoft 365: why the recycle bin is not a backup
In short: Microsoft makes sure that Exchange Online, OneDrive and SharePoint keep running. For your data – deleted by mistake, encrypted by ransomware or gone with a departed employee – you are responsible yourself. The recycle bin and retention periods only help for a short time and not in every case.
Shared responsibility
Cloud services follow the shared responsibility model: the provider is responsible for data centres, hardware and the availability of the service. What happens to the content – who deletes, overwrites or encrypts it – is up to the customer. Microsoft does replicate your data across several data centres, but every deletion and every encryption is replicated just as reliably.
How long Microsoft 365 keeps deleted items
Without additional retention policies, these default values apply:
| Service | What happens after deletion | Afterwards |
|---|---|---|
| Exchange Online | Permanently deleted items stay in the “Recoverable Items” folder – 14 days by default, 30 days at most | Gone for good |
| OneDrive and SharePoint | Recycle bin and second-stage recycle bin, 93 days in total | Gone for good |
| OneDrive of departed employees | Kept for 30 days by default after the account is deleted (configurable) | Gone for good |
Retention policies and archiving in Microsoft 365 can extend these periods. They are not a backup in the true sense, though: they live in the same tenant, with the same administrator accounts – whoever takes over these accounts can also change the policies.
Five cases in which only a backup helps
- Deleted and noticed too late: a folder of project documents has been missing for four months – the recycle bin was emptied long ago.
- Ransomware via synchronisation: an infected laptop encrypts local files, and OneDrive synchronises the encrypted versions to the cloud.
- Departed employees: the account and licence are removed; weeks later, mail or files are needed for a legal dispute.
- Compromised administrator account: an attacker deliberately deletes mailboxes and sites.
- Audit and evidence: for retention obligations or an audit, the state of a particular day has to be produced.
What matters in a Microsoft 365 backup
- Complete: mail from all folders, calendars, contacts, tasks, OneDrive and SharePoint – not just the mailboxes.
- Outside the tenant: the backup is kept in a place that an attacker with Microsoft credentials cannot reach.
- Encrypted and in Germany: for the GDPR, what counts is the location, the data processing agreement and who holds the key.
- With minimal permissions: a dedicated app registration in Entra ID with read permissions, restricted to the necessary mailboxes and sites where possible.
- Many versions: each day can be retrieved individually, even after months.
How AegisGrid backs up Microsoft 365
AegisGrid backs up via Microsoft Graph with a dedicated app registration: Exchange mailboxes with all folders, calendars with attachments, contacts, tasks, OneDrive and SharePoint document libraries – for individual accounts or the whole tenant. Every run is a complete version, but only what has changed is transferred. The data is encrypted before it is stored and can go to up to eight destinations, for example to your own backup server and to the cloud storage in Germany.
Restores are currently made as an export: mail as .eml files, files as a folder tree with their modification time, appointments, contacts and tasks as files – filtered by account, folder and period. Restoring directly into the tenant is not yet available.
Frequently asked questions about Microsoft 365 backup
Doesn't Microsoft back up my data itself?
Microsoft protects the service against failures of its data centres. That does not help against deletions, encryption by ransomware or compromised accounts, because these changes are replicated just the same. Microsoft keeps deleted content only for a limited time.
Is a GDPR-compliant backup of Microsoft 365 possible?
Yes. What matters is a storage location that you decide on, encryption with a key in your hands and a data processing agreement with every service provider that runs or stores the backup.
Which permissions does the backup need?
Only read permissions via Microsoft Graph for the areas being backed up – such as mail, calendars, contacts, tasks and files. Exchange Online and SharePoint can additionally be restricted to individual mailboxes and sites.
Back up Microsoft 365 in Germany
In a pilot project we set up the backup of your tenant with you.