For years, real backup in Microsoft 365 has come up in every tenant I look after. Most organisations either paid a third-party vendor or tried to convince themselves that the recycle bin or retention policies were 'good enough'. Microsoft 365 Backup has been generally available since late July 2024, so there is finally a native option. It backs up SharePoint sites, OneDrive accounts and Exchange mailboxes directly inside the Microsoft 365 trust boundary, restores quickly and at scale, and comes with a clear billing model.

Microsoft 365 Backup keeps backups and restores inside Microsoft 365

Setup is simple. In the Microsoft 365 admin center, under Settings → Microsoft 365 Backup, you connect an Azure subscription. Billing is pay-as-you-go per GB per month (check the official pricing page for current numbers). Next you configure backup policies per workload and decide which users, sites or mailboxes are covered. Restores can go to the original location or to a new one, which matters a lot when an account has been deleted or compromised. Microsoft's main promise is that backups and restores happen entirely within the Microsoft 365 environment, with a fixed retention of one year. If you know the delays and the export/import hassle of legacy backup, the speed will surprise you.

The diagram below shows how backup and restore work with Microsoft 365 Backup:

flowchart TD
  admin["Admin sets backup policy"] --> m365backup["Microsoft 365 Backup Service"]
  m365backup --> storage["Backup storage (Microsoft 365)"]
  admin2["Admin starts restore"] --> m365backup
  m365backup --> restore["Fast restore to target (e.g. OneDrive, Exchange)"]

Figure: How backup and restore flow through Microsoft 365 Backup.

I recommend reading the official documentation. It states clearly that all data stays inside the Microsoft 365 trust boundary, which is a key point for compliance and privacy.

The recycle bin and retention policies do not replace a backup

I've lost count of how many times someone has told me that "the recycle bin is our backup". In practice, the recycle bin in OneDrive or SharePoint is a last-resort feature for end users. Retention and capacity are limited, and nothing really protects you against mass deletion or malicious action. Retention policies in Purview have a different job. They prevent deletion, but they were never designed for point-in-time restore or for recovering from major incidents such as ransomware or scripted data loss. More than one team I know found that out the hard way.

Pro tip: If you have to convince management that you need real backup, demo a few restore scenarios using only the recycle bin or retention policies. That usually opens eyes.

Setup and daily management happen in the admin center

The service sits under Microsoft 365 admin center → Settings → Microsoft 365 Backup. Link your Azure subscription for billing, then choose which users, sites or mailboxes to protect in each workload. Retention is fixed at one year, and as of today you can't extend it. Restores work at a granular level (a single file, email or site) and at scale (entire mailboxes or site collections). Because the operations run in place in Microsoft 365 storage, they are remarkably fast.

Starting a restore takes only a few clicks. Being able to restore to a new target is extremely useful, especially after an account has been deleted by accident or on purpose.

Third-party vendors are moving to the new storage platform

Many organisations still run third-party backup tools, sometimes for longer retention, for Planner or Teams chats, or for advanced compliance requirements. These vendors are now moving to the new Microsoft 365 Backup Storage Platform, and legacy methods like direct pulls via EWS or Graph API are being deprecated. As a result, backups stay in the tenant, data privacy improves and restores run faster. If you rely on one of these tools, ask your vendor whether they have migrated to the new platform yet. Some features may still be catching up.

Microsoft 365 Backup is particularly useful in these situations:

  • Recovering quickly from large-scale deletion, whether accidental or malicious
  • Fast, granular restores without long exports or imports
  • Core workloads protected without depending on a third party
  • Full integration, with billing through an Azure subscription

The step-by-step setup guide explains the technical details well.

I finally see a real backup here, though it does not cover everything

Microsoft 365 Backup closes an important gap in the platform. The core workloads now get native, scalable backup that stays entirely within the trust boundary. It doesn't solve every problem, though. For longer retention, less common services or complex compliance scenarios, third-party solutions may still have their place. For most tenants it is a big step forward, and I'm already recommending it in projects where speed, privacy and simplicity matter. For everyday recovery, and for sleeping better at night, Microsoft 365 Backup is now the first tool I reach for.