Does Microsoft 365 Back Up Your Data?
It depends on your plan and how it is configured — here is what Perth business owners need to know
The Short Answer — It Depends
This is one of the most common questions Perth business owners ask about Microsoft 365 — and the answer is more nuanced than a simple yes or no. Microsoft 365 does include data protection features, but whether those features are sufficient for your business depends entirely on which plan you are on and how it has been configured.
A Microsoft 365 environment that has been properly set up by a qualified provider gives most Perth small businesses strong, built-in data protection — without needing a separate third-party backup tool. But the same environment left on default settings, or on the wrong plan, has significant gaps.
The information on this page is general in nature and is intended to help business owners understand data protection at a high level. It is not legal or technical advice specific to your situation. If you have specific concerns about your data protection obligations, DM1 recommends speaking with a qualified IT provider and, where relevant, a lawyer.
What Microsoft's Own Terms Say
Microsoft’s Services Agreement includes a section on Service Availability that states: “We recommend that you regularly backup Your Content and Data that you store on the Services.”
This applies to consumer accounts
The Services Agreement governs personal Microsoft accounts — Outlook.com, OneDrive personal, and consumer Microsoft 365 subscriptions. For personal accounts, Microsoft makes no guarantee of data preservation, and the recommendation to back up your own data is sound advice.
Business accounts have different terms
Microsoft 365 Business plans are governed by the Microsoft Online Services Terms and the Microsoft Product Terms — different documents with stronger commitments around availability and data handling. The consumer Services Agreement does not apply to business subscriptions.
How Each Plan Handles Your Data
Your Microsoft 365 plan determines which data protection tools are available to you. Here is what each tier includes — and what it does not.
Business Basic & Standard
Limited built-in protection
Includes version history (up to 500 versions) and a recycle bin with 93-day retention. Your data is stored across Microsoft's geo-redundant infrastructure — a hardware failure will not cause data loss.
However, there are no retention policies, no audit logging, and no protection against accidental mass deletion or a ransomware attack that encrypts your files. If all versions of a file are encrypted, version history does not help.
âš Not recommended for businesses handling sensitive personal data
Business Premium — configured correctly
Strong built-in protection for most Perth SMBs
Business Premium adds Microsoft Purview retention policies, audit logging, and data loss prevention. Defender for Business provides ransomware detection and endpoint protection. Properly configured, this gives most small businesses the data protection they need — without a third-party backup tool.
The key phrase is configured correctly. Retention policies do not configure themselves. Defender for Business requires setup. A provider who understands what they are doing makes the difference.
✓ DM1's recommendation for most Perth businesses
When a third-party backup still makes sense
Some situations warrant additional layers
For businesses with very long retention obligations (7+ years), complex compliance requirements, or those that have experienced a ransomware incident before, a third-party backup tool adds a clean, independent copy of your data outside the Microsoft environment.
This is not a default recommendation for every Perth SMB — it is a situation-specific decision. DM1 assesses each client's needs individually.
What "Configured Correctly" Actually Means
Business Premium gives you the tools. Configuration is what makes them work. Here is what DM1 sets up for every Business Premium client.
Retention policies — keeping data for as long as required
DM1 configures Microsoft Purview retention policies to automatically keep emails and documents for the period relevant to your industry — then delete them. This replaces the need for manual archiving and ensures you are not keeping data longer than you need to.
Defender for Business — ransomware detection and response
DM1 deploys and configures Defender for Business across all devices. This detects and responds to ransomware and malware before it can encrypt your files — significantly reducing the likelihood that a backup or rollback would ever be needed.
Audit logging — knowing what happened to your data
DM1 enables unified audit logging so there is a complete record of who accessed, modified, shared, or deleted data across your Microsoft 365 environment. This supports your obligations under the Privacy Act and gives you visibility if something goes wrong.
Conditional Access — controlling who can get in
DM1 configures Conditional Access policies to block logins from suspicious locations, unknown devices, or outside business hours. This stops the most common cause of data loss — compromised accounts — before they become a problem.
What DM1 Finds During New Client Onboarding
The most common data protection issue DM1 finds when a new client joins is not the absence of a backup tool — it is Business Premium features that were never configured.
Discovered during DM1 new client onboarding
Business Premium licences — Defender never deployed
When a Perth professional services firm moved to DM1, our onboarding checks found they had been on Business Premium for two years — but Defender for Business had never been deployed to any device. The licences were being paid for but none of the security features were active. Their previous provider had set up the licences and stopped there. DM1 deployed Defender across all devices and configured the security baseline within the first week.
Discovered during DM1 new client onboarding
No retention policies — emails deleted after 30 days
A Perth finance business joined DM1 after a compliance review flagged concerns about email retention. Their Microsoft 365 tenant had no retention policies configured — emails deleted by staff were gone permanently after 30 days, with no way to recover them. Their industry has a minimum 7-year retention obligation. DM1 configured Purview retention policies and recovered what was still available in the compliance archive.
Discovered during DM1 new client onboarding
Business Standard — no ransomware recovery capability
When a Perth construction business moved to DM1, our review found they were on Business Standard. They had experienced a ransomware incident 18 months earlier that had encrypted several SharePoint document libraries. Because Business Standard has no Defender for Business and no advanced version recovery, their previous provider had been unable to recover the files. DM1 upgraded them to Business Premium and configured Defender as the first priority.
DM1's Position on Microsoft 365 Data Protection
DM1 has been advising Perth businesses on Microsoft 365 for many years. Our position is straightforward: Microsoft 365 Business Premium, properly configured, provides strong built-in data protection that satisfies the needs of most Perth small businesses.
We do not recommend third-party backup tools as a default for every client. What we do recommend — strongly — is that every Business Premium environment has its security and retention features properly configured by someone who knows what they are doing. An unconfigured Business Premium licence is not the same as a protected environment.
Want to know if your Microsoft 365 environment is properly configured?
DM1 reviews Microsoft 365 environments as part of new client onboarding — checking whether the security and retention features included in your plan are actually active and configured correctly.
Is Your Microsoft 365 Properly Configured?
DM1 reviews and configures Microsoft 365 environments for Perth businesses. Call (08) 6202 6012 or send us a message.