Microsoft 365 is very good at keeping its servers running. It is not, by default, a backup of your data. Those are two different promises, and the gap between them is where small businesses lose a mailbox to a bad script, a SharePoint library to ransomware, or a former employee's OneDrive to a cleanup job nobody noticed.

This is a plain comparison of what Microsoft keeps for you, what Microsoft now sells as an actual backup, and how the main third-party options differ. No pricing here, because it changes too often to be useful. The differences that matter are coverage, where the copy lives, and how you get data back.

What Microsoft Keeps for You

Deleted email. When someone deletes a message and empties Deleted Items, it moves to the Recoverable Items folder. Exchange Online keeps it there for 14 days by default, and an admin can raise that to a maximum of 30 days. Calendar items are kept for 120 days. After that, it is gone.

Deleted files. SharePoint and OneDrive deletions go to the site recycle bin, then to the site collection recycle bin. Microsoft keeps them for 93 days total, counted from the original delete, and then they are permanently removed.

Retention policies and litigation hold. These preserve copies of content so it cannot be purged, mostly for compliance and eDiscovery. They are powerful, but they are designed to keep evidence, not to roll a site back to how it looked last Tuesday.

Why Retention Is Not Backup

Microsoft spells out the split in its shared responsibility model: no matter the type of cloud service, you always keep responsibility for your data, your endpoints, your accounts, and your access management. Microsoft protects the platform. Protecting what you put in it is on you.

In practice, the native tools fall short in a few predictable ways. Retention windows expire. A compromised admin account can change policies or delete content. Ransomware that encrypts files on a synced laptop syncs the encrypted versions straight into OneDrive. And when a departed user's account is deleted, their OneDrive enters a cleanup countdown whether or not anyone copied the files out. A real backup is a separate, versioned copy you can restore from on your schedule.

If ransomware is the worry, our walkthrough on what to do in the first four hours of a ransomware attack covers the response side. Backup is what makes that response survivable.

What to Compare

Four questions separate these products. Which workloads are covered: Exchange, OneDrive, SharePoint, and Teams. Where the backup copy lives: inside Microsoft 365, in the vendor's own cloud, or on storage you control. How granular restores are: one email, one file, or a whole site rolled back. And how long the copies are kept.

Microsoft 365 Backup

Microsoft now sells its own backup product, built on what it calls Microsoft 365 Backup Storage. It covers OneDrive, SharePoint, and Exchange Online. Teams is not listed as a separate workload, although Teams channel files live in SharePoint.

The recovery window is set per backup policy at 3 months, 6 months, 1 year, or 2 years, with 1 year as the default. For OneDrive and SharePoint, Microsoft lists restore points every 10 minutes for the past two weeks, then weekly snapshots back to 52 weeks. For Exchange, restore points run every 10 minutes across the prior 52 weeks. Restores can roll a whole OneDrive or site back to an earlier point, restore individual files and folders, or pull back specific mailbox items through search.

The backups stay inside Microsoft 365's own service boundaries on append-only storage, which means existing restore points cannot be changed after they are written. Microsoft also states that Purview retention and deletion policies do not touch the backup recovery window. Billing is pay-as-you-go based on consumption rather than per user.

The trade-off is where the copy lives. Microsoft 365 Backup is fast because the data never leaves Microsoft. If your goal is a copy that sits completely outside Microsoft's infrastructure, that is the gap third-party tools fill. Several of them, Veeam among them, also plug into Microsoft 365 Backup Storage for fast restores.

Veeam

Veeam comes in two forms. Veeam Data Cloud for Microsoft 365 is a managed service: Veeam runs the infrastructure, the data is stored in an Azure region you choose, and Veeam says the primary backup is immutable at the service level, so users, admins, and attackers cannot alter or delete it. The self-managed product, Veeam Backup for Microsoft 365, is software you run yourself and point at any storage you like, on-premises or cloud object storage.

Both protect Exchange, SharePoint, OneDrive, and Teams, and the cloud service also backs up Microsoft Entra ID users, groups, and app registrations. Restores range from single items to bulk restores for disaster recovery. If you go the self-managed route, keep the backup server patched; Veeam servers have been targeted before, as our post on CVE-2025-48984 explains.

Datto SaaS Protection

Datto SaaS Protection backs up Exchange, calendars, OneDrive, SharePoint, and Teams with automated backups three times a day. Datto stores an independent copy outside the SaaS provider's servers, which is the main point of a third-party backup. Restores can be point-in-time, granular down to individual items, or non-destructive, so a restore does not overwrite what is there now.

Datto also offers SaaS Protection+, which adds threat scanning of Microsoft 365 on top of the same three-times-daily backups. The same product covers Google Workspace, which helps if part of the business still lives in Gmail and Drive.

Acronis

Acronis offers agentless, cloud-to-cloud backup of Exchange, OneDrive, SharePoint, and Teams with cloud storage included. New users, groups, and sites are picked up automatically, which saves you from the classic mistake of hiring someone and forgetting to add them to the backup.

Restores are granular: individual emails, files, sites, contacts, and attachments. Mailbox search works by subject, sender, recipient, or date. Acronis also scans the Microsoft 365 backup archives for malware, which matters if you are restoring after an infection. It fits best when you already use Acronis for endpoint or server backup and want one console for everything.

AvePoint Cloud Backup

AvePoint has the widest Microsoft 365 coverage of the group. Its Microsoft AppSource listing covers SharePoint Online, Exchange Online, OneDrive, Teams, Groups, Planner, Project Online, Public Folders, Power Automate, and Power Platform, with automatic backups up to four times a day. You can keep the backup data in AvePoint's Azure storage or in your own cloud storage.

AvePoint advertises unlimited backup storage and retention, and supports exporting data or restoring across tenants, which helps during a merger or a tenant migration. The same platform also protects Salesforce and Google Workspace if you run those too.

Keepit

Keepit's pitch is independence. It runs its own data centers rather than storing backups on AWS or another public cloud, and it keeps your data in two mirrored data centers inside the region you pick: Denmark, Germany, the UK and Ireland, the US, Canada, or Asia Pacific.

Backups are stored in an immutable format built on a blockchain-like Merkle tree, so attackers cannot quietly alter old copies. Storage is unlimited. Coverage includes Exchange, OneDrive, SharePoint, and Teams, down to channel posts, replies, and files in private channels. Restores go back to the original location with the original folder structure and metadata, or you can restore a whole snapshot after a ransomware event.

How to Choose

If your biggest fear is a big, fast rollback of OneDrive or SharePoint and you are comfortable with the copy living inside Microsoft's boundary, Microsoft 365 Backup is the fastest path, and it pairs well with a third-party copy for anything critical.

If you want a copy that is truly separate from Microsoft, look at Keepit or Datto, both of which keep the backup outside the Microsoft 365 servers. If you want to own the storage yourself, or you still run Exchange or SharePoint on-premises, Veeam's self-managed software is the flexible option. If you also run Google Workspace or Salesforce, AvePoint and Datto cover more than Microsoft 365 in one place, and Acronis makes sense when it already protects your laptops and servers.

Whatever you pick, ask every vendor the same questions before you sign. Does it back up Teams chats, or only channel files? Can it restore to the original location? Can an admin account with stolen credentials delete the backups? Where exactly is the data stored? Then run a test restore of a real mailbox and a real folder. A backup you have never restored from is a guess, not a plan.

References

Not sure your Microsoft 365 data could actually be restored today? Contact Rain City Techworks.