“Everything is in the cloud, so Microsoft has a backup” is one of the most expensive assumptions a business can make. Microsoft keeps its service running and gives you recovery tools, but restoring your data to a known good point after an attack is your responsibility. Planning Microsoft 365 backup for ransomware means knowing exactly what the built-in features can undo, where their time limits end, and what needs a real backup. This post lays that out plainly.
The shared responsibility line
Microsoft is responsible for the infrastructure: data centers, replicated copies of your mailboxes and sites, and keeping the service available if hardware fails. That replication protects against Microsoft’s problems, not yours. If ransomware encrypts files in OneDrive, those encrypted versions sync and replicate faithfully. If a compromised admin deletes a SharePoint site, the deletion replicates too.
You are responsible for your data, identities and configuration: who can access what, how long things are kept, and getting back to a healthy state after something goes wrong inside your tenant.
What Microsoft 365 can restore on its own
The native recovery features are genuinely useful, and every business should know their limits.
Workload
Built-in recovery
Default window
Exchange Online
Single item recovery from Recoverable Items
14 days by default, configurable up to 30 days
SharePoint and OneDrive
Version history
At least 500 versions per file by default
SharePoint and OneDrive
Recycle bin (first and second stage)
93 days
OneDrive and SharePoint
Files Restore (roll a whole library back to a point in time)
Last 30 days
Teams
Chats stored in Exchange mailboxes, files in SharePoint/OneDrive
Follows those services
Deleted user accounts
Restore from deleted users
30 days
For a typical ransomware event caught within a few days, OneDrive Files Restore is the hero. You can roll a user’s entire OneDrive back to the hour before encryption started. The trouble starts when the attack is discovered late, when it spans many users, or when an attacker with a compromised admin account deliberately removes versions and empties recycle bins.
Where the built-in features fall short
Time. Dwell time before an attack is noticed can exceed 30 days. Once you are outside the Files Restore window, you are restoring file by file from version history, if the versions survived.
Scale. Rolling back 150 OneDrives and 40 SharePoint sites one at a time through the portal is slow, and slow recovery is what turns an incident into a week of lost revenue.
Deliberate destruction. An attacker with SharePoint admin rights can remove sites and clear recycle bins. Native tools assume your admins are trustworthy.
Configuration. Conditional Access policies, Intune profiles, Exchange transport rules and app registrations are not restored by any file recovery feature.
Retention is not backup.Microsoft Purview retention policies preserve content for compliance, and they help, but restoring from a Preservation Hold library is a manual, item-level process. Retention answers “can we prove we kept it?” not “can we be back in business by Tuesday?”
Microsoft 365 Backup: the native option
Microsoft 365 Backup is Microsoft’s own backup product for SharePoint, OneDrive and Exchange Online, managed from the Microsoft 365 admin center. A few points make it a strong fit for ransomware recovery:
Immutable, append-only storage. Backups cannot be altered by a client process, and are only removed if a Backup admin explicitly offboards them.
Data stays inside the Microsoft 365 trust boundary and honors your data residency.
Fast bulk restore. Microsoft designs it to roll back large numbers of sites and mailboxes in hours, with express restore points for OneDrive and SharePoint.
Granular restore. As of September 2026, you can browse a restore point and recover specific files and folders, not just whole sites.
Pay-as-you-go billing through an Azure subscription, based on the volume of data protected rather than per user.
Third-party backup products built on the Microsoft 365 Backup Storage platform, or independent backup services that copy data outside Microsoft, are also valid choices. The right answer depends on whether you want a copy outside Microsoft entirely, how long you need to keep restore points, and your budget.
What else to protect
A complete recovery plan covers more than mail and files.
Entra ID configuration. Export and version-control Conditional Access policies, named locations and app registrations. Microsoft Entra Backup and Recovery, currently in preview, takes daily snapshots of key directory objects and keeps five days of history, which is a useful but short safety net.
Intune configuration. Export compliance policies, configuration profiles and app assignments so you can rebuild device management quickly.
Endpoints. Data stored only on a laptop’s local drive is not in Microsoft 365. Redirect Desktop, Documents and Pictures to OneDrive with Known Folder Move so it is.
Azure and on-premises servers. Use Azure Backup or your existing backup platform, with immutable vaults and soft delete turned on.
Admin access. Keep two break-glass accounts with phishing-resistant MFA, excluded from normal policies, so you can still get in if attackers lock you out.
Build the recovery runbook before you need it
When ransomware hits, nobody wants to read documentation for the first time. Write down and test these steps:
Contain. Isolate affected devices in Defender, disable compromised accounts, revoke sessions and reset credentials for admins.
Find the start time. Use the Defender incident timeline and audit logs to identify when encryption began.
Choose restore points just before that time for each affected OneDrive, site and mailbox.
Restore in priority order: finance, client-facing teams, then everyone else.
Verify before reopening. Confirm devices are clean before users sync restored files back, or you re-infect the restored data.
Review and harden. Close the entry point, whether that was a phished password, a missing patch or an unmanaged device.
Run a restore test at least twice a year, timing how long it takes to bring back one OneDrive, one site and one mailbox. That number is your real recovery time, and it is the number cyber insurers increasingly ask for. A NIST CSF assessment is a good way to see where your recovery capability sits against the rest of your controls, and strong Defender for Endpoint coverage reduces how often you need the runbook at all.
Microsoft replicates your data to protect against its own infrastructure failures and provides recovery features such as version history and recycle bins. It does not provide point-in-time backup of your tenant unless you use Microsoft 365 Backup or a third-party backup service.
Can I recover OneDrive after ransomware without a backup product?
Often, yes, if you act within 30 days. OneDrive Files Restore can roll a whole OneDrive back to an earlier point. Outside that window, or at scale across many users, a dedicated backup is far faster and more reliable.
Are retention policies a substitute for Microsoft 365 backup?
No. Retention policies keep content for compliance and legal purposes. They are not designed for fast, bulk restoration to a known good state after ransomware.
Not sure how long recovery would take in your tenant? Book a free Microsoft 365 security assessment and we will review your retention, backup and recovery readiness.
“Everything is in the cloud, so Microsoft has a backup” is one of the most expensive assumptions a business can make. Microsoft keeps its service running and gives you recovery tools, but restoring your data to a known good point after an attack is your responsibility. Planning Microsoft 365 backup for ransomware means knowing exactly what the built-in features can undo, where their time limits end, and what needs a real backup. This post lays that out plainly.
The shared responsibility line
Microsoft is responsible for the infrastructure: data centers, replicated copies of your mailboxes and sites, and keeping the service available if hardware fails. That replication protects against Microsoft’s problems, not yours. If ransomware encrypts files in OneDrive, those encrypted versions sync and replicate faithfully. If a compromised admin deletes a SharePoint site, the deletion replicates too.
You are responsible for your data, identities and configuration: who can access what, how long things are kept, and getting back to a healthy state after something goes wrong inside your tenant.
What Microsoft 365 can restore on its own
The native recovery features are genuinely useful, and every business should know their limits.
For a typical ransomware event caught within a few days, OneDrive Files Restore is the hero. You can roll a user’s entire OneDrive back to the hour before encryption started. The trouble starts when the attack is discovered late, when it spans many users, or when an attacker with a compromised admin account deliberately removes versions and empties recycle bins.
Where the built-in features fall short
Microsoft 365 Backup: the native option
Microsoft 365 Backup is Microsoft’s own backup product for SharePoint, OneDrive and Exchange Online, managed from the Microsoft 365 admin center. A few points make it a strong fit for ransomware recovery:
Third-party backup products built on the Microsoft 365 Backup Storage platform, or independent backup services that copy data outside Microsoft, are also valid choices. The right answer depends on whether you want a copy outside Microsoft entirely, how long you need to keep restore points, and your budget.
What else to protect
A complete recovery plan covers more than mail and files.
Build the recovery runbook before you need it
When ransomware hits, nobody wants to read documentation for the first time. Write down and test these steps:
Run a restore test at least twice a year, timing how long it takes to bring back one OneDrive, one site and one mailbox. That number is your real recovery time, and it is the number cyber insurers increasingly ask for. A NIST CSF assessment is a good way to see where your recovery capability sits against the rest of your controls, and strong Defender for Endpoint coverage reduces how often you need the runbook at all.
Microsoft’s summary of built-in protections is in Ransomware protection in Microsoft 365.
Frequently asked questions
Does Microsoft back up my Microsoft 365 data?
Microsoft replicates your data to protect against its own infrastructure failures and provides recovery features such as version history and recycle bins. It does not provide point-in-time backup of your tenant unless you use Microsoft 365 Backup or a third-party backup service.
Can I recover OneDrive after ransomware without a backup product?
Often, yes, if you act within 30 days. OneDrive Files Restore can roll a whole OneDrive back to an earlier point. Outside that window, or at scale across many users, a dedicated backup is far faster and more reliable.
Are retention policies a substitute for Microsoft 365 backup?
No. Retention policies keep content for compliance and legal purposes. They are not designed for fast, bulk restoration to a known good state after ransomware.
Not sure how long recovery would take in your tenant? Book a free Microsoft 365 security assessment and we will review your retention, backup and recovery readiness.