Most UK small businesses rely on Microsoft 365 every day. But retention and the recycle bin aren't the same thing as a dedicated backup, we explain the difference and how to recover fast after an incident.
Most UK small businesses rely on Microsoft 365 every day — email, Teams, OneDrive and SharePoint quickly become the place where everything lives.
So when we ask an SME owner "How do you back up Microsoft 365?", we often hear:
Those features are useful. But they're not the same thing as a dedicated backup.
In this article, we'll explain the difference (without the jargon), what Microsoft 365 can and can't recover on its own, and the practical steps you can take to make sure you can get back to work quickly after an incident.
Retention is a set of rules that control how long Microsoft 365 keeps content.
Backup is a separate copy of your data that you can restore from, even if the "live" environment has been changed, encrypted, or tidied away.
A good way to remember it: retention helps you keep data, and backup helps you get it back.
Microsoft 365 includes several built-in safety nets. The problem is that many SMEs only discover the limits when they actually need to restore.
Here are the common recovery routes, and the "gotchas" we see most often.
For SharePoint and OneDrive, deleted items go through a two-stage recycle bin process. In many setups, the overall window is 93 days across both stages — after that, the content can be permanently deleted.
That's fine if you notice an accidental deletion quickly. But it's not fine if a folder was deleted months ago and only noticed during audit, VAT year-end, or a customer dispute; a leaver's OneDrive was removed as part of an offboarding process, and someone later realises key documents were stored there; or a site is "tidied up" and files are removed without anyone spotting the knock-on impact.
The takeaway: recycle bin recovery is a short-term safety net, not a long-term recovery plan.
OneDrive and SharePoint file version history is great for rolling back a document after someone overwrites it, or for undoing a bad edit.
It can also help in some ransomware scenarios (where files are encrypted in place). But there are limits: version history is not designed as a full system restore, it may not help if large numbers of files are affected, moved, renamed, or deleted, and attackers often aim to damage recovery options as well as files.
In other words: version history is useful, but it shouldn't be your only line of defence.
Microsoft Purview retention policies and labels are about governance: keeping content for a set period and proving it was kept.
They are not designed to make "restore the business to yesterday afternoon" quick and straightforward.
Common SME pain points include retention settings that differ between SharePoint sites, Teams-connected sites, and personal OneDrives; confusion over what's covered (and what isn't) when staff collaborate across multiple sites; and a false sense of security that "we're compliant" means "we're recoverable".
Compliance matters — but so does operational resilience.
When we support UK SMEs, these are the situations that typically turn into costly disruption:
The consistent theme is speed: the longer you can't access files, the more expensive the incident becomes.
You don't need enterprise complexity to improve recovery. You need a few sensible building blocks.
Start with two simple targets: RTO (Recovery Time Objective) — how quickly you need files back to keep trading, and RPO (Recovery Point Objective) — how much data you can afford to lose (e.g., "no more than 4 hours").
If your team can't work without SharePoint for a day, your RTO is not "sometime this week".
A Microsoft 365 backup solution should be able to restore OneDrive files, SharePoint sites and document libraries, and often Exchange mailboxes and Teams content, depending on your needs.
More importantly, it should let you restore a whole site or library (not just a handful of files), restore to a point in time, and recover quickly even if the live tenant is in a mess.
This is where many SMEs move from "we can probably recover" to "we can recover on purpose".
Backup is essential, but it's not a substitute for good access controls. A few high-impact measures: enforce Multi-Factor Authentication (MFA) and strengthen it with Conditional Access where appropriate, block legacy authentication, use separate admin accounts and least-privilege permissions, and review external sharing and guest access regularly.
These steps reduce the chance you'll need the backup at all.
Leaver mistakes are one of the most avoidable causes of data loss.
A simple checklist helps: confirm where key data is stored (SharePoint vs personal OneDrive), transfer ownership and access before accounts are removed, place mailboxes/OneDrives on hold where appropriate (based on policy), and document who is responsible for final approval before deletion.
If you only do one thing this month: make sure your leaver process doesn't delete business-critical files.
A backup you've never tested is a hope, not a plan.
A lightweight quarterly test could include restoring a sample SharePoint library to a test location, restoring a set of OneDrive files for a user, and timing how long it takes from "request" to "usable files".
This is how you turn resilience into something measurable.
At Managed Technology Group, we help UK SMEs build sensible, real-world recovery for Microsoft 365 — without overcomplicating it.
Our approach is straightforward: understand what your business can and can't tolerate (downtime and data loss), make sure retention and compliance settings are appropriate, implement a backup approach that supports fast, reliable recovery, and reduce risk with practical security controls.
Or, as we put it: Your Technology, Managed the Right Way.
If you're not sure whether your current Microsoft 365 setup would let you recover quickly, start with a short review: what retention settings you currently rely on, where your key data actually lives, and whether you could restore a full SharePoint site or OneDrive quickly.
If you'd like, we can run that review with you and highlight the gaps in plain English — so you can decide what to improve (and when).
Book a free IT review and we'll show you exactly where your current setup is costing you money, leaving you exposed, or slowing your team down. No obligation, no hard sell.
