Cloud

Microsoft 365 Backup: Why Native Retention Is Not Enough and What Philippine Businesses Should Use

June 21, 2026 · 6min read · The Technica Stack

Microsoft 365's built-in data protection is frequently misunderstood as backup. It is not. The recycle bin, version history, and litigation hold in Exchange, SharePoint, and OneDrive are designed for compliance and accidental deletion recovery within defined windows — not for the kind of reliable, organisation-wide, point-in-time recovery that backup provides.

The gaps matter for Philippine businesses whose email, documents, Teams conversations, and SharePoint sites contain business-critical data.

What M365 Native Retention Actually Does

Exchange Online Recycle Bin

Deleted emails go to the Deleted Items folder, then to the Recoverable Items folder (formerly "dumpster"). The default retention for the Recoverable Items folder is 14 days — after which items are permanently deleted.

With litigation hold or retention policies enabled, items can be retained longer — but this does not mean they are always recoverable by the user. Litigation hold is designed for compliance and eDiscovery, not user-initiated recovery.

SharePoint and OneDrive Recycle Bin

Deleted items in SharePoint and OneDrive move to the site recycle bin, then to the second-stage recycle bin. Total default retention before permanent deletion: 93 days.

Version history in SharePoint retains previous document versions — by default, up to 500 versions per document. However, if a document is deleted (not just modified), version history is lost with the document.

Teams

Teams messages are stored in Exchange Online (for each user's mailbox). Teams data is subject to Exchange Online recycle bin rules. Channels and their contents are stored in SharePoint — subject to SharePoint recycle bin rules.

What These Don't Cover

Admin errors that exceed retention windows: A SharePoint site accidentally deleted 4 months ago is gone. No native recovery path exists after 93 days.
Ransomware that propagates through connected drives: M365 with OneDrive sync can sync encrypted files from an infected device to the cloud before the attack is detected. The version history may contain the encrypted versions, not the original.
Overly aggressive retention policy configuration: A misconfigured retention policy that immediately purges data is not reversible with native M365 tools.
Cross-tenant recovery: If your M365 tenant is compromised and data is deleted at the admin level, Microsoft does not guarantee recovery.

What Third-Party M365 Backup Provides

Third-party M365 backup tools (Veeam, Acronis, AvePoint, Datto SaaS Protection) take scheduled snapshots of your M365 data — Exchange, SharePoint, OneDrive, Teams — and store them independently of Microsoft's infrastructure.

What they enable:

Point-in-time recovery: restore any user's mailbox to any point in the past (daily or more frequent snapshots)
Cross-mailbox restore: recover data from a departed employee's mailbox after their account is deleted
Item-level granular restore: recover a specific email, calendar entry, or document version without restoring the entire mailbox
Long-term retention beyond M365 limits: retain 1–7 years of M365 data independently of Microsoft's 93-day SharePoint window
Ransomware recovery: restore from a clean snapshot predating the encryption event

Platform Comparison

Veeam Backup for Microsoft 365

The market-leading M365 backup tool for enterprise and mid-market.

What it backs up: Exchange Online, SharePoint Online, OneDrive for Business, Microsoft Teams (channels, messages, files)

Deployment: Self-hosted (you run the Veeam B&R for M365 server and store backups in Azure Blob, AWS S3, or on-premise storage) or Veeam Cloud Connect (backup to a managed service provider's storage)

Pricing: USD $4–6/user/month for managed service; self-hosted licence cost varies

Philippine availability: Available through Technica Solutions Inc. and other Veeam-authorised resellers

Best for: Organisations that want control over backup storage location and retention policies; organisations with compliance requirements for long-term retention

Acronis Backup for Microsoft 365

Cloud-managed M365 backup with integrated cybersecurity features.

What it backs up: Exchange Online, SharePoint, OneDrive, Teams

Deployment: Cloud-managed (Acronis stores the backups in their cloud infrastructure)

Pricing: USD $3–5/user/month

Best for: Philippine SMEs that want a fully managed solution without self-hosting; organisations that also use Acronis for endpoint backup (unified platform)

AvePoint Cloud Backup

Enterprise-grade M365 backup with strong governance and compliance features.

What it backs up: Exchange, SharePoint, OneDrive, Teams, Microsoft 365 Groups, Planner

Pricing: USD $4–7/user/month

Best for: Larger Philippine enterprises with complex M365 governance requirements; organisations that need granular restore at the item level across large SharePoint site collections

What to Prioritise Backing Up

Not all M365 data has equal recovery urgency. Philippine SMEs should prioritise in this order:

Priority 1 — Exchange Online (email): Email is the most commonly requested recovery target. Compliance holds, client communications, contracts, and audit trails all reside in email. A backup that covers Exchange with daily snapshots and 1-year retention is the minimum.

Priority 2 — SharePoint and OneDrive: Documents, contracts, project files, and reference materials. The 93-day native window is insufficient for organisations that may not discover a deletion or corruption for months.

Priority 3 — Teams: Teams channels contain project communications, decisions, and shared files that are not always duplicated elsewhere. Teams backup requires the backup tool to handle both the Exchange component (messages) and SharePoint component (files) correctly.

If your organisation is evaluating Microsoft 365 and its security and compliance posture more broadly, see our M365 admin centre first configuration guide, Microsoft 365 E3 vs E5 comparison, and Data Loss Prevention guide for Philippine businesses.

For hybrid backup strategy combining NAS and cloud, see our 3-2-1 hybrid backup guide.

For Philippine organisations implementing Microsoft 365 backup — Veeam, Acronis, or AvePoint — available through Technica Solutions Inc., get in touch.

Talk to our Cloud & I.T. team →