Does Microsoft 365 back up my data?

Not in the traditional backup sense. Microsoft 365 provides item retention, recycle bins, versioning, and preservation policies that recover from deletion or corruption inside the service, but it does not provide the point-in-time restore of a full mailbox, SharePoint site, or OneDrive that a backup product delivers. Microsoft 365 Backup is a Microsoft add-on that fills the gap for a per-GB fee; third parties (Veeam, Commvault, Barracuda, AvePoint, Rubrik, HYCU, Keepit, Redstor) do the same.

What Microsoft 365 does natively

• Mailbox: 14-day (up to 30-day) deleted-item retention, plus Recoverable Items with hold for longer-term recovery.
• SharePoint and OneDrive: two-stage recycle bin (site and second-stage) up to 93 days, plus version history.
• Teams: chat and channel messages honour Exchange and SharePoint retention.
• Preservation Hold libraries and Litigation Hold keep content beyond retention where a policy or hold applies.

Where a backup product is needed

• Restoring an entire mailbox, site, or OneDrive to a moment in time — Microsoft 365 Backup or a third party.
• Ransomware or mass-delete recovery across many objects.
• Retention beyond native ceilings without a compliance-hold obligation.
• Recovery to a different tenant (M&A, divestiture) — third parties are still the practical option.

The shared-responsibility model is explicit in Microsoft's Services Agreement: the tenant owns the data, Microsoft runs the service. Retention is not backup, and a documented backup strategy is expected in most compliance frameworks (ISO 27001, SOC 2, NIS2, DORA).