Guide

Microsoft 365 retention is not the same as operational backup

Retention keeps data for compliance. Backup lets you get it back. Knowing the difference matters before you need to recover.

Many organisations assume their Microsoft 365 data is backed up because their tenant has retention policies configured. That assumption is understandable — but it conflates two different controls that serve different purposes.

What retention does

Retention policies in Microsoft 365 keep data for a defined period to satisfy compliance, legal hold and governance requirements. They answer the question: "Can we prove this data existed?"

Holds mailbox items, files and messages for a policy-defined window
Supports legal discovery and compliance audit
Works within the Microsoft 365 environment
Does not create an independent, restorable copy

What backup does

Operational backup creates independent, point-in-time copies of data that can be restored on demand. It answers the question: "Can we get this back?"

Creates copies independent of the source environment
Enables granular restore — a single email, file or entire mailbox
Protects against accidental deletion, malicious action, sync corruption and account compromise
Retains data beyond Microsoft's native recovery windows

The gap that matters

The risk is not that Microsoft 365 is unreliable — it is not. The risk is that native recovery windows are finite. When data is deleted, corrupted or overwritten beyond those windows, retention cannot bring it back because it was never designed to.

Common scenarios where retention alone fails: a departing employee's mailbox is deleted after the admin-recovery window lapses; a compromised account is used to purge Drive files; a sync error corrupts a SharePoint library and the version history is insufficient; a user permanently deletes emails that retention was not configured to hold.

Closing the gap

An independent backup for Microsoft 365 creates a separate, restorable copy of Exchange, OneDrive, SharePoint and Teams data — outside the Microsoft 365 environment, with retention you control and granular recovery you can action at any time. Through Soteria Cloud, that backup data can be held on local South African infrastructure.

Frequently asked questions

Does Microsoft back up my data?

Microsoft operates a highly resilient infrastructure with geo-redundancy, but it operates under a shared-responsibility model: Microsoft protects the platform and its availability, while you remain responsible for your data. Native tools provide limited-window recovery, not long-term operational backup.

What happens to data deleted beyond the retention window?

Once data passes the retention or recoverable-items window — typically 14 to 93 days depending on the workload and policy — it is permanently removed. Without an independent backup, it cannot be recovered.

Can retention policies replace backup?

No. Retention policies are designed for compliance and legal hold — keeping data for a defined period. Backup is designed for operational recovery — restoring data to a known-good state at any point. They serve different purposes and are not interchangeable.

Close the Microsoft 365 backup gap

Talk to Soteria Cloud about protecting Microsoft 365 with independent, locally hosted backup.

Microsoft 365 backup Speak to our team