Verified against Ofcom Connected Nations Spring 2026, IASME Cyber Essentials April 2026 standard and current operator pricing.
Quick answer: Microsoft 365 doesn’t include true backup — its retention policies and recycle bins are not a substitute when you need to recover deleted mailboxes, ransomware-encrypted SharePoint sites, or files lost six months ago. Cloud-to-cloud backup tools (Veeam, Druva, Keepit, AvePoint, Acronis) replicate your M365 data to a separate cloud — and importantly, you can keep that copy in the UK or EU for data residency. Pricing: £3–£6 per user/month. The case for it is restore granularity, retention beyond M365’s built-in 30/93 days, and resilience against tenant compromise.
Why M365 native protection isn’t enough
| What people assume | What actually happens |
|---|---|
| “Microsoft backs up my data” | Microsoft replicates for service availability, not for your data recovery. Their SLA explicitly excludes data loss caused by user error or sync issues. |
| “Recycle bin saves me” | OneDrive recycle bin is 30 days. SharePoint is 93 days. After that, gone — unless you have backup. |
| “Retention policies = backup” | Retention prevents deletion but doesn’t restore from corruption or ransomware. Items inside retention can still be encrypted in place. |
| “M365 Backup launched in 2024” | Microsoft’s native Backup service is real — but limited to ~365 days retention, no granular item-level restore for SharePoint, no on-prem export. |
The data residency question
Microsoft datacenters in the UK (London, Cardiff) host the M365 production data of UK customers by default. But your backup doesn’t automatically follow. When you choose a third-party cloud-to-cloud provider, they offer regional choice — and not all providers offer UK.
What gets backed up
- Exchange Online — mailboxes, calendars, contacts, public folders.
- OneDrive for Business — every user’s personal cloud drive.
- SharePoint Online — sites, document libraries, lists, page versions, permissions.
- Microsoft Teams — chat, channels, files, posts, meeting recordings.
- OneNote — notebook structure with section/page versioning.
- Planner / Project — supported by Veeam and Druva; not all providers cover.
IT support that actually supports you
Microsoft 365 backup, cloud services and proactive IT from a UK team. Get a free quote.
Or call us on 0333 015 2615
What it costs (real April 2026 prices)
SMB (10–50 users)
£5/user/mo
Veeam BfM SaaS or AvePoint Cloud Backup. UK datacenter, 7-year retention.
- 4× backups per day
- UK datacenter
- Granular item restore
- 7-year retention
- SOC monitoring
Mid-market (50–250)
£3.50/user/mo
Negotiated bulk rate. Adds reporting, role-based admin and audit trail.
- 4× backups per day
- UK + offsite EU copy
- Granular restore
- 10-year retention
- Compliance reports
Enterprise (1,000+)
£2.20/user/mo
Volume pricing. Multi-tenant, RBAC, integrated with SIEM.
- Continuous incremental
- Multi-region
- SIEM integration
- Dedicated TAM
- Custom SLA
Picking a provider — the 8-point checklist
UK or EU datacenter?
Confirm physical location of the backup copy in the contract. “European” can mean Ireland, Germany, France — clarify.
Backups per day?
Industry standard is 3–4. Some providers do continuous; some only daily.
Granular item restore?
Test it: can you restore one email from 6 months ago to its original folder without affecting anything else?
Immutable backups?
Object lock or air-gap to defeat ransomware that goes after the backup itself. A must-have for 2026.
Retention & legal hold?
Can you set a 7-year retention on Finance shared mailboxes specifically? Most providers can; check.
Restore to a different tenant?
Useful if you ever need to spin up a recovery tenant or migrate. Veeam BfM and Druva support this; Microsoft’s native does not.
Cost predictability
Per-user is most predictable. Per-GB can balloon when SharePoint sites grow.
Auditor-friendly reporting
Monthly success/failure report you can hand to ISO 27001 / Cyber Essentials Plus auditors.
Need M365 cloud-to-cloud backup with UK data residency?
We deploy Veeam Backup for M365 on UK Azure regions for SMBs and mid-market, with 7-year retention from £3.50/user/mo. Free trial available.
Microsoft 365 cloud backup — FAQs
Yes — Microsoft explicitly recommends third-party backup as part of a defense-in-depth strategy. They publish backup-friendly Graph APIs that all major vendors use.
Yes — Veeam, Druva and AvePoint all back up 1:1 and channel chat, plus posts, files and meeting recordings stored in SharePoint/OneDrive.
This is the most important reason for separate backup. If a tenant admin account is compromised and the attacker tries to delete data, the offsite cloud-to-cloud copy is unreachable and immutable.
Negligibly. Backups read via Graph API at off-peak hours and Microsoft has high API throughput per tenant. Users won’t notice.
Related Reading
More from the Connection Technologies blog.