Plan B evaluates whether you should backup your Office 365

With a big trend towards adoption of Microsoft Office 365, businesses need to consider the protection of their data. Microsoft and Veeam both warn users of the risk of not backing up your Office 365 data. It’s simply not the case that you can migrate to Office 365 and rest assured that you are safe from data loss. If in doubt, you can refer to the Microsoft Service Agreement.

If you assume that moving to the cloud automatically means that your data is safe, secure and resilient then:

a) You can be comforted by the fact that you’re not alone

b) You would be well advised to read on to gain a better understanding of how your data is managed within Office 365 to avoid costly data loss.

First it is useful to understand Office 365’s data protection policies:

Office 365 Data Security

Office 365 uses 4 methods to secure data:

  • Backup by Microsoft itself
  • Recycle bin
  • Retention
  • Versioning

N.B. Microsoft’s ‘Holds’ options now fall under retention policies, hence why it is not mentioned further.

Office 365 Backups

Microsoft’s backup is designed to be used in the event of an emergency. Microsoft performs a backup every 12 hours, with a retention period of 14 days.

Because the backup has been set up for disaster recovery purposes only, it is only possible to restore complete environments and not so-called brick level restores of, for example, an individual mailbox or a mailbox item.

In addition, restores must be requested through the Microsoft support department which there is a cost association with. You have no control over the moment at which the restore is actually carried out, making it difficult to manage.

Office 365 Recycle bin

Discarded data is stored in the recycle bin. In addition to the standard recycle bin, Office 365 has a second recycle bin for email as well as for Sharepoint where the data is stored when it is removed from the primary recycle bin. Although the idea is the same for both email and Sharepoint, there is a difference in the exact operation. We describe the process of both below.


The email process looks like this:

  1. The user deletes data
  2. The item is stored in the ‘deleted items’ folder. In principle, an item can remain there indefinitely
  3. When data is removed from ‘deleted items’ this is sent to the second e recycle bin or the “recoverable items’ moved. The data will stay here for a maximum of 30 days
  4. The data will be permanently deleted after 30 days

2. Sharepoint

The Sharepoint process looks like this:

  1. The user deletes data
  2. The data is moved to the ‘First-stage recycle bin’, also known as the ‘Site recycle bin’
  3. From the ‘First-stage recycle bin’ it is moved to the ‘Second-stage recycle bin’ (also called ‘Site collection recycle bin’)
  4. In all cases, the data is permanently deleted after 93 days after the data is first placed in the ‘First-stage recycle bin’. It does not matter in which recycle bin the data is at that moment. Deleted data is stored within Sharepoint for only a maximum of 93 days

Office 365 Retention

It is possible to use retention within the Office 365 E3, E5 and Exchange online subscriptions. Microsoft has introduced retention for two reasons:

  • Save data for a specific period
  • Delete data after a certain period

As these elements can conflict with each other, a number of rules apply with regard to retention:

Even with retention there is a difference in the effect between email and Sharepoint. We describe these separately below:


The mail retention process is as follows:

  • When deleting from the ‘deleted items’ folder, items move to the ‘recoverable items’ folder
  • Periodically a process is running which checks whether items comply with the set retention policy. If this is not the case, items are permanently deleted. If this is the case, the items remain in the ‘recoverable items’ folder


The retention process in Sharepoint is different and depends on whether the data already exists at the time the retention policy is created.

The moment the data already exists when creating the retention policy, a version of the data is saved at one of the following moments:

  • The moment the first change is made to the document after the retention policy has been created. The version prior to the change is saved to the ‘Preservation Hold Library’
  • The moment the data is deleted.

It is important to realize that retention only produces 1 version of the data. If you want to save multiple versions of a file, you must use versioning.

Read part 2 of this blog which covers versioning and sums up the key considerations around Office 365 backup.

Plan B is holding a Webinar around Office 365 and the considerations for backup. Register here to join the Webinar.

If you would like to discuss Office 365 with Plan B we can be contacted on 08448 707999 or