The 3 2 1 Backup Rule Explained for Small Businesses
The 3 2 1 rule is the simplest way to check whether your backups would really save you. Here is what it means, the modern 3 2 1 1 0 version, and how to apply it to a typical North East business.
Key takeaways
- Microsoft runs the service; you are responsible for your own data. Its services agreement recommends you back up your content regularly.
- Recycle bins and deleted item retention are time limited safety nets, not backups.
- By default Exchange Online keeps soft deleted email for 14 days, and SharePoint keeps deleted sites for 93 days.
- A deleted user's mailbox and OneDrive can be lost after 30 days unless you act first.
- A separate backup gives you copies outside your tenant, longer history and restores to a point in time.
"It is in the cloud, so it is backed up." We hear this a lot, and it is one of the most expensive misunderstandings in small business IT. Microsoft 365 is extremely reliable and Microsoft protects its own infrastructure very well. But keeping a service running is not the same as keeping a recoverable copy of your data. If a member of staff deletes a folder, ransomware encrypts your synced files or a leaver's mailbox quietly disappears, the built in tools may or may not get it back, depending on what happened and how long ago.
This guide explains what Microsoft does and does not do, the real retention limits, and what a proper backup adds.
The shared responsibility model
Cloud services work on what is usually called a shared responsibility model. Microsoft is responsible for the platform: its data centres, hardware, network, the availability of the service and protecting it from failures on its side. You, the customer, are responsible for your accounts, your settings and your data, including who can access it and what happens when it is deleted or changed.
Microsoft says this plainly. The Microsoft Services Agreement recommends that customers regularly back up the content and data they store on its services. In other words, Microsoft itself does not want you to treat Microsoft 365 as your only copy.
What Microsoft 365 keeps, and for how long
Microsoft 365 does have several safety nets for deleted items. They are useful, but each has a time limit and some can be emptied by a user or an attacker. The defaults below come from Microsoft's own documentation on Microsoft Learn.
| What is deleted | Default safety net | What to watch for |
|---|---|---|
| Individual emails in Exchange Online | Items emptied from Deleted Items go to the Recoverable Items folder, kept for 14 days by default, which an admin can raise to a maximum of 30 days | After that period the item is removed unless a hold or retention policy is in place |
| Files in SharePoint and OneDrive | Recycle bin, then a second stage recycle bin, within an overall window of up to 93 days | Once the window closes, items are purged |
| A whole SharePoint site | Kept for 93 days after deletion | Restoring rolls back the whole site, not single files |
| A Microsoft 365 group or Team | Other group resources such as the mailbox and Planner are kept for 30 days | Shorter than the 93 days for the site itself |
| A deleted user account | The account can be restored for 30 days | Mailbox and OneDrive content can be permanently lost if not moved first |
Retention policies and holds, available through Microsoft Purview, can keep content for longer. They are designed for compliance, so that information cannot be destroyed early, rather than for quick, convenient restores. They are worth having, but they work inside the same tenant as your live data.
Where the built in tools fall short
Accidental and delayed deletion
People often only notice something is missing weeks or months later, when they need an old contract or a set of emails for a dispute. By then the recycle bin or recoverable items period may have passed.
Ransomware and malicious changes
If ransomware encrypts files on a computer that syncs with OneDrive or SharePoint, the encrypted versions sync to the cloud. OneDrive has tools to roll a library back to an earlier time, which can help, but they rely on version history and settings that you need to have in place. A disgruntled employee or an attacker with admin access can also delete data deliberately and empty the recycle bins. Our guide on what to do after a ransomware attack covers the wider response.
Leavers' mailboxes and OneDrive
This is one of the commonest gaps we see. Microsoft's documentation says that when you delete a user you have 30 days to restore the account before the data is permanently deleted, and that you should move a leaver's email somewhere else before deleting the account. If nobody does, years of client correspondence can vanish. Converting the mailbox to a shared mailbox is one option; a backup is a safety net if that step is missed.
Everything in one place
If the only copy of your data lives inside one Microsoft 365 tenant, a compromised global admin account, a billing problem that suspends the subscription, or a misconfigured retention policy can affect everything at once. Good backup practice, including the 3 2 1 rule, says you should keep a copy somewhere separate.
What a third party Microsoft 365 backup covers
A dedicated Microsoft 365 backup service copies your data out of your tenant to separate storage on a schedule, usually several times a day. Good services typically cover:
- Exchange Online mailboxes, including calendars and contacts
- OneDrive for every user
- SharePoint sites and document libraries
- Teams, including the files and, depending on the product, channel conversations
- Shared mailboxes and the mailboxes of leavers you still need
The benefits are retention you control (often years rather than days), point in time restores so you can recover a folder exactly as it was last Tuesday, restores of a single email or a whole mailbox, and a copy that sits outside the reach of someone who has taken over your tenant. Microsoft also offers its own paid add on called Microsoft 365 Backup, and there are several established independent products. Whichever you choose, check where the data is stored, how long it is kept and how easy a restore really is.
A quick Microsoft 365 data protection checklist
- Turn on multi factor authentication for every account, especially admins.
- Limit global admin rights to a small number of named people.
- Decide how long you need to keep email and files, in line with your data retention obligations.
- Have a written leaver process that deals with the mailbox and OneDrive before the account is deleted.
- Add an independent backup of Exchange, OneDrive, SharePoint and Teams.
- Test a restore at least every few months, including a full mailbox.
- Keep backups of anything that is not in Microsoft 365, such as line of business software or local servers.
How Cyber Fits can help
We set up and monitor Microsoft 365 backups for businesses in Sunderland and across the North East, and we test restores so you know they work. Find out more on our backup and recovery and Microsoft 365 pages, or book a free IT review and we will tell you honestly where your gaps are.
Frequently asked questions
Does Microsoft back up my Microsoft 365 data?
Microsoft protects its own service against hardware and data centre failures, and keeps deleted items for limited periods. It does not provide the kind of long term, point in time backup most businesses need, and its services agreement recommends that customers back up their own content.
How long does Microsoft 365 keep deleted emails?
According to Microsoft's documentation, once items are emptied from Deleted Items they move to the Recoverable Items folder, which keeps them for 14 days by default. An administrator can increase this to a maximum of 30 days. Retention policies and holds can keep items longer.
What happens to a leaver's mailbox when I delete their account?
Microsoft gives you 30 days to restore a deleted user. After that their mailbox and OneDrive content can be permanently deleted. Move or convert the data before deleting the account, and keep a backup as a safety net.
Is the OneDrive recycle bin a backup?
No. It is a useful safety net for recent deletions, but items are purged after the retention window and it sits in the same tenant as your live data. A backup is a separate copy you control.
Written by the Cyber Fits team
IT support and cyber security, Sunderland
Our guides are written by the team who support businesses across the North East every day. If anything here raises a question about your own setup, ask us.