In short
Microsoft 365 retention features, such as retention policies, litigation hold, version history and recycle bins, preserve or delay deletion of content inside your tenant, mainly for compliance and short-term recovery. A backup is a separate, point-in-time copy you can restore from at scale. Retention answers what you must keep; backup answers how you get it back.
Want an impartial recommendation?
Tell us about your users, systems and priorities and we will tell you which option fits, and why.
Retention and backup are not the same thing
Retention and backup both keep copies of data, which is why they are often confused. The difference is purpose and design:
- Retention stops content being permanently deleted, or deletes it on schedule, inside your Microsoft 365 tenant. It exists so you can meet legal and regulatory obligations and find content later through search and eDiscovery.
- Backup keeps a separate, restorable copy of your data at points in time, so you can put mailboxes, files and sites back the way they were after deletion, corruption or attack.
You can have very good retention and still struggle to recover from a ransomware attack, and you can have a good backup and still fail a records-keeping requirement. In practice you need to think about both.
What Microsoft 365's retention features do
Microsoft 365 has several features that keep content around after someone deletes or changes it:
| Feature | What it does | Its limit as a recovery tool |
|---|---|---|
| Retention policies and labels | Retain content for a set period, delete it after a set period, or both, across Exchange, SharePoint, OneDrive, Teams and more | Retained copies sit in hidden locations and are found through search; a delete action can remove data you later need |
| Litigation hold and eDiscovery holds | Preserve all or selected content from deletion for a legal case | Microsoft says holds are optimised for export through eDiscovery, not for mass restore |
| Version history | Keeps earlier versions of files in SharePoint and OneDrive | Microsoft says versions do not scale for large ransomware recovery and can be exhausted by version limits |
| Recycle bins and deleted item retention | Hold deleted items for a period so users and admins can restore them | Time-limited: 93 days in total for SharePoint and OneDrive, 14 to 30 days for Exchange deleted items |
| Microsoft's service replicas | Keep the service running through hardware or datacentre failure | Microsoft says a disaster recovery copy holds the current state of content, not earlier versions |
All of these work in place: the preserved content stays inside the same tenant, governed by the same admin accounts, as the live data. Retained SharePoint and OneDrive content goes to the Preservation Hold library; retained mail goes to the Recoverable Items folder of the mailbox.
Still not sure which way to go? Ask us
Tell us what matters most to you and we will recommend one, with the trade-offs explained.
What Microsoft says in its own FAQ
Microsoft's FAQ for its Microsoft 365 Backup service answers this question directly, and it is worth reading in Microsoft's own words:
- On disaster recovery copies: "A DR copy with Microsoft 365 maintains the current state of content, not any historical versions from prior points in time."
- On versions: they let users restore files to earlier points, but "that kind of recovery method doesn't scale well for large-scale ransomware attacks where an admin needs to orchestrate the recovery. Versions might also be exhausted depending on the version limit set by the admin."
- On legal holds: "Legal holds retain data, but that feature is optimized for export (for example, via eDiscovery), not for mass restore."
Microsoft also notes that retention and deletion policies from Microsoft Purview do not affect the recovery window of Microsoft 365 Backup, which is kept isolated from them. That is a useful design principle for any backup: the settings that govern compliance retention should not be able to shorten your ability to recover. You can read more about Microsoft's service on our Microsoft 365 Backup Storage page.
Retention vs backup vs archive
Archiving is the third term that gets mixed in. This table sets the three side by side:
| Retention | Backup | Archive | |
|---|---|---|---|
| Main purpose | Keep or delete content to meet obligations | Restore data after loss, corruption or attack | Keep a searchable, long-term record, often of email |
| Where the copy lives | Inside your tenant, in place | A separate copy, usually outside the tenant (Microsoft 365 Backup keeps it inside Microsoft 365's data boundary) | Usually a separate archive store |
| How you get data back | Search, eDiscovery export, or per-item recovery | Restore items, mailboxes, sites or accounts to a point in time | Search and retrieve individual records |
| Built for mass recovery | No | Yes | No |
| Built for legal search and holds | Yes | Depends on the product | Yes |
| Affected by tenant admin changes | Yes: policies can be changed or removed | Depends on separation and immutability | Depends on the product |
For a fuller explanation of archiving, see email archiving vs backup on our Email Archiving site, which also covers legal hold.
Weighing up the options?
We can compare them against your own requirements and give you a straight answer.
Do you need both?
Usually, yes, because they answer different questions. Retention answers "what must we keep, and for how long, and what must we delete?" Backup answers "if this disappears or is damaged today, how do we put it back?"
A sensible approach is to let your records and compliance obligations set your retention policies, then make sure your backup covers every workload, keeps data at least as long as you might need to restore it, and sits outside the reach of a compromised admin account. Some backup platforms also add archiving or eDiscovery features, such as the Archiver bundles of NinjaOne SaaS Backup, Redstor's Comply Bundle and Commvault's Enterprise with Compliance edition, which can reduce the number of tools you run. The Microsoft 365 backup comparison shows which platform offers what.
Contact us to review whether your retention settings and backup cover each other's gaps.
How Forever Systems helps with Microsoft 365 backup
We are an independent UK IT and cyber security provider. We supply more than one Microsoft 365 backup product, so we can recommend what fits your tenant, your retention needs and your budget rather than one vendor's answer to everything.
- Review what you have: we look at your Microsoft 365 licences, retention policies and any existing backup before suggesting anything new
- Help you choose: we compare the backup products we supply against the workloads you need covered, such as Exchange Online, OneDrive, SharePoint, Teams and Entra ID
- Set-up and onboarding: we can help connect the backup service to your tenant and agree what is protected and how long copies are kept
- Restore testing: we can help you plan and run test restores so you know how recovery works before you need it
- Licensing in one place: backup licences alongside your Microsoft 365 subscriptions, with terms confirmed at quote
We work with businesses, schools, charities and public sector organisations. Contact us to talk it through.
Frequently asked questions
Is a Microsoft 365 retention policy a backup?
No. A retention policy keeps content from being permanently deleted, or deletes it on schedule, inside your tenant. It is designed for compliance. A backup is a separate copy designed for restoring data at the point in time you choose.
Is litigation hold a backup?
No. Microsoft says legal holds retain data but are optimised for export through eDiscovery, not for mass restore. Holds are meant for legal cases, not as a recovery tool.
Is version history enough to recover from ransomware?
Not reliably. Microsoft says versions do not scale well for large ransomware attacks where an admin has to orchestrate recovery, and that versions can be exhausted depending on the version limit set. A backup lets you restore whole sites, accounts and mailboxes to an earlier point.
What is the difference between backup and archiving in Microsoft 365?
Backup is for restoring data after loss or damage. Archiving keeps a long-term, searchable record, usually of email, for compliance and discovery. Some platforms do both, but the requirements are different.
Can retention policies delete data?
Yes. Retention settings can be retain-only, delete-only, or retain and then delete. A delete action removes content permanently at the end of the period, which is one reason a backup with its own retention is useful.
Still deciding?
Ask us and a member of our team will reply by email with a straight answer.
More Microsoft 365 backup guides
Microsoft 365 BackupMicrosoft's own backup for OneDrive, SharePoint and Exchange, explained.Best practicesA practical checklist for Microsoft 365 backup, aligned with NCSC guidance.