Guide
Backing up Microsoft 365: why Microsoft does not do it for you
The shared responsibility model, what the recycle bin and retention policies do and do not do, the risks that occur most often, and what a real backup of Exchange, OneDrive and SharePoint must meet.
"But it's in the cloud, isn't it?"
That is true, and Microsoft does excellent work there: the data centres, the servers, the availability of the platform. But the Microsoft 365 service terms contain the shared responsibility model: Microsoft is responsible for the service, you are responsible for your data. Microsoft itself recommends taking a backup of your content with a third party.
The same applies to Google Workspace.
What the built-in features do and do not do
| Feature | What it does | What it does not do |
|---|---|---|
| Recycle bin (30 days, 93 for SharePoint) | keep deleted items temporarily | protect against whoever empties the bin, or against deletions older than the period |
| Version history | keep earlier versions of a document | help when the whole account or site is gone, or with mass encryption through a synchronised folder |
| Retention policy (Purview) | keep items for compliance | make a real copy outside the tenant; an administrator with the right permissions can change the policy |
| Deleted user | recoverable for 30 days | give back the mailbox and OneDrive of a former employee after that period |
All these features sit in the same tenant, under the same administrator accounts. Whoever takes over your administrator account has all of them.
The risks that occur most often
- Human error. A folder dragged, a site deleted, a rule that filters mail away. Noticed weeks later.
- Leaving employees. The licence is revoked to save money, and after thirty days the mailbox with ten years of customer correspondence is gone.
- Ransomware through synchronisation. The OneDrive client synchronises encrypted files just as faithfully as normal ones. Version history helps to a point, but not with thousands of files at once.
- Hijacked administrator account. Then there is no recycle bin and no retention policy any more.
- Retention obligations. Invoices seven years, personnel files longer: you do not arrange that with a recycle bin.
What a real backup must meet
- Outside the tenant, in storage you control, with a different set of keys than your Microsoft administrator's.
- Immutable: the backup itself must not be deletable during the retention period.
- Encrypted before it leaves, with a key that is neither with Microsoft nor with the backup provider.
- Readable without the vendor: mail as plain messages, documents in their own format.
- Granular restore: one mailbox, one folder, one file, without overwriting the original.
- Tested: regularly restore a sample and compare.
How Zekura approaches it
Zekura backs up Microsoft 365 and Google Workspace via a connector host: a small Linux VM of yours or your IT partner's. It fetches mail and files through the official API, keeps an incremental mirror and snapshots it to your own immutable storage, encrypted like everything else. The connection credentials stay on that VM and never go to the platform.
Mail is stored per message as .eml, documents in their own format, Google documents as docx, xlsx, pptx or pdf. Restoring can go to a folder or straight back into the tenant, always under a Zekura-restore folder, never over the original. And every week Zekura restores a small sample and compares it: that is the proof that the backup works. The steps are in the documentation.
Frequently asked questions
Doesn't Microsoft have its own backup service?
Microsoft 365 Backup has existed since 2024 and keeps copies within the Microsoft cloud, under the same tenant and the same administrators. It is useful for fast recovery, but it is not a copy outside the tenant and no protection against a hijacked administrator account.
How often should a Microsoft 365 backup run?
Daily is common; mail and documents change all day, but losing one day is acceptable for most organisations. Those who want a smaller RPO run the connector more often.
Does this count for NIS2 and GDPR?
Yes. Your mail and documents are personal data and business information for which you must be able to restore availability (GDPR article 32). Read the guide on NIS2.