Does Microsoft 365 Back Up Your Email?

The short answer: no. Microsoft 365 keeps your email available — replicated across datacenters, protected against Microsoft's hardware failing — but it does not back it up. Microsoft's own Exchange Online documentation says it plainly: "Exchange Online does not provide a way to perform a traditional backup of mailboxes," and point-in-time restore is "out of scope for the Exchange Online service." Retention policies and litigation holds are compliance tools, not backups; and Microsoft's paid Microsoft 365 Backup add-on restores data only back into Microsoft 365, never out of it. What you should do about it depends on what you're protecting against — this guide walks through the real options, including the honest cases where you don't need to buy anything.

What Microsoft actually says (and the quote everyone gets wrong)

Nearly every backup vendor's pitch quotes the Microsoft Services Agreement — "We recommend that you regularly backup Your Content" — as proof that Microsoft tells businesses to back up Microsoft 365. Check the source: that agreement governs Microsoft's consumer services. Your business tenant runs under a different contract entirely, and the clause doesn't apply to it.

The honest evidence is stronger anyway, and it's in Microsoft's own admin documentation:

• Exchange Online offers no traditional mailbox backup and no point-in-time restore — Microsoft suggests "third-party solutions" for that, in those words.
• Purview's documentation states that eDiscovery content export "is supported for eDiscovery purposes only, and can't be used as a backup solution."
• Microsoft sells a backup add-on (below). If the service were already backed up, there'd be nothing to sell.

The "shared responsibility model" vendors invoke is a marketing coinage (Veeam's, originally), but the underlying split is real: Microsoft is responsible for the service running; what's in your mailboxes is yours to protect.

What you get natively — and why it isn't backup

Out of the box, deleted mail follows a conveyor belt, not a backup: a deleted message sits in Deleted Items (the default policy clears items after 30 days), then moves to the hidden Recoverable Items folder for 14 more days (an admin can extend this to 30 with Set-Mailbox -RetainDeletedItemsFor 30). After that, it's gone.

Litigation hold and Purview retention policies stop that purging — held mail is preserved (and versioned) for as long as the hold lasts, which is why people mistake them for backup. They aren't: holds preserve individual items for discovery, but there is no way to roll a mailbox back to how it looked last Tuesday, before the ransomware or the bad sync or the angry employee. Preservation and restore are different capabilities, and native Microsoft 365 only has the first.

The trap that actually costs businesses mail — departed employees. When you remove a user's license or delete their account, the mailbox survives 30 days, then is permanently deleted. Keeping it longer without paying for the license requires making it an inactive mailbox — and that only works if a hold or retention policy was applied before the account was deleted. No hold at deletion, no inactive mailbox, no recovery. If offboarding is your concern, decide the retention story before you delete accounts, or export the mailbox on the way out.

Option 1: Microsoft 365 Backup (Microsoft's paid add-on)

Since 2024, Microsoft sells actual backup as an add-on — and most articles about M365 backup were written before it existed, so here are the current facts:

• Covers Exchange mailboxes, OneDrive accounts, and SharePoint sites; pay-as-you-go at $0.15/GB/month (list) of protected content, billed through an Azure subscription, with restores free.
• Restore points every 10 minutes for Exchange, retained for 1 year — genuine point-in-time recovery, built for the ransomware/mass-deletion scenario the native tools can't handle.
• The boundary: restores go back into Microsoft 365 — into the same or a new folder in the user's mailbox. There is no export, and your backup lives in the same Microsoft trust boundary (and tenant) as the original.

Good: fills the real gap (point-in-time rollback) at any org size, no per-user licensing. Bad: one-year maximum retention, cost scales with data (a 100 GB-per-user org pays real money), and it doesn't answer "I want a copy that exists outside Microsoft" — by design, nothing ever leaves.

Option 2: Third-party tenant backup (Veeam, AvePoint, and friends)

The classic answer: a backup suite that copies every mailbox (usually plus SharePoint/OneDrive/Teams) into the vendor's cloud on a schedule, with admin-grade search and restore. For an organization that needs tenant-wide coverage, multi-year retention, and someone to sign an SLA, this category is the right tool — comparing specific vendors is beyond this post's scope.

One question to ask any of them: where does the backup live? Most store it in their cloud — so you've protected against losing Microsoft by adding a dependency on another provider. Some let you point the backup at your own Azure/S3 storage; if data ownership is the reason you're buying, make that the requirement.

Option 3: Export mailboxes to PST

The manual route, in two flavors:

• As an admin (any mailbox, no desktop Outlook): Microsoft Purview → eDiscovery → create a case, search the mailbox, Export with "Create PSTs for messages." Two things the older guides won't tell you: the classic eDiscovery portal and its ClickOnce export tool were retired in 2025 — exports now download from the browser via Process Manager — and the export package expires after 14 days. The exporting admin needs an E3/E5 license plus an eDiscovery role.
• As an individual user: add the account to desktop Outlook and run the export wizard — the same process as backing up a personal Outlook mailbox, admin policy permitting.

Good: free (license permitting), produces a file you genuinely hold, fine for offboarding snapshots. Bad: entirely manual and per-mailbox — as a recurring "backup process" it's the chore nobody sustains, which even Microsoft's docs acknowledge by recommending against PST as a retention strategy. A PST is where mail goes to be forgotten; it's a snapshot, not a system.

Option 4: A continuous copy in storage you own

The option none of the vendor listicles mention: have a copy of each email land, as it arrives, in storage you control — as one standard .eml file per message, the original with headers and attachments intact. This is what InboxBucket does: connect OneDrive (keeping copies in Microsoft's cloud but your consumer storage, outside the tenant) or S3 (where lifecycle rules and Object Lock make the archive cheap and tamper-proof), get an inbound address, and point your mail at it. Three ways to do the pointing, smallest to largest:

• One mailbox (yours): a forwarding rule to your InboxBucket address.
• A few mailboxes, admin-managed: a mail flow rule in Exchange admin that BCCs matching mail to the archive address — invisible to users, works tenant-side. (Behavior around admin rules and external recipients varies by tenant configuration — test with one mailbox first.)
• Everything, compliance-grade: Exchange Online journaling — which, by Microsoft's own design, must deliver journal reports to an address outside Exchange Online. An external archiving endpoint is exactly what the feature expects. Note Microsoft's caveats: journal reports get one delivery attempt cycle (set a JournalingReportNdrTo address), and Microsoft itself steers customers toward Purview retention instead — journaling is the old-school tool, but it's the one that puts copies outside the walls.

The catch every M365 admin must know: external forwarding is blocked by default. Since late 2020, the tenant-wide outbound spam policy ships with automatic forwarding off — a user who sets up forwarding gets the bounce "5.7.520 Access denied, Your organization does not allow external forwarding." The fix is deliberate, not hard: in the Defender portal (security.microsoft.com) → Policies → Anti-spam, create a custom outbound spam policy scoped to the specific user(s) with automatic forwarding set to On. Scoping it narrowly keeps the default protection for everyone else.

Good: continuous and automatic, per-message files in your own storage, works at the individual/small-team scale where tenant suites are overkill. Bad: it's not a tenant backup — no SharePoint/Teams/calendar, and it archives from setup onward (pair it with a one-time PST export for history). And on a default business tenant, it needs that one-time admin unblock first.

Which one do you actually need?

Honest thresholds: if your risk is oops-deleted-last-week, native retention already covers you — buy nothing. If it's ransomware or bulk corruption, Microsoft 365 Backup is the cheapest credible answer. If it's the org needs everything, for years, with an SLA, that's the tenant-suite category. And if it's "I want my mail to exist somewhere Microsoft can't take it with them" — account loss, tenant offboarding, a business closing its subscription — that's the continuous-copy category, and it's the gap the other three leave open. Weighing this beyond Microsoft 365? See the comparison of email backup methods.

FAQ

Does Microsoft back up Microsoft 365 email?

No. Microsoft replicates your mailbox for availability — protecting against their hardware failing, not against deletion, ransomware, or account loss on your side. Microsoft's Exchange Online documentation states there is no traditional mailbox backup and that point-in-time restore is out of scope for the service. Backup is available, but as a separate paid add-on or through third parties.

How long does Microsoft 365 keep deleted emails?

A deleted message sits in Deleted Items (cleared by the default policy after 30 days), then in the Recoverable Items folder for 14 more days by default — an admin can extend that to a maximum of 30. After that it's permanently gone, unless a litigation hold or retention policy was preserving it.

Does Microsoft recommend backing up Microsoft 365 data?

The often-quoted "we recommend that you regularly backup Your Content" line is from Microsoft's consumer Services Agreement and doesn't govern business tenants. For business services, Microsoft's documentation states Exchange Online has no traditional backup and suggests third-party solutions for point-in-time restore — and Microsoft sells its own backup add-on, which answers the question in practice.

What is Microsoft 365 Backup and what does it cost?

Microsoft's first-party backup add-on for Exchange, OneDrive, and SharePoint. It's pay-as-you-go — list price $0.15 per GB per month of protected content, billed via Azure, restores free — with restore points every 10 minutes and one year of retention. Restores go back into Microsoft 365 only; it can't export your data anywhere else.

What happens to a former employee's mailbox?

Once the license is removed or the account deleted, the mailbox is recoverable for 30 days, then permanently deleted. To keep it longer without a license, a hold or retention policy must be applied before deletion, which turns it into an inactive mailbox. Missed that window? There's nothing to recover — export to PST or archive the mail before offboarding, not after.

How do I export a Microsoft 365 mailbox to PST?

As an admin: Microsoft Purview → eDiscovery → create a case → search the mailbox → Export, choosing "Create PSTs for messages," then download from Process Manager within 14 days (the package expires). You'll need an E3/E5 license and an eDiscovery role. For your own mailbox, desktop Outlook's export wizard does it without admin involvement — see our Outlook backup guide.

Why does Microsoft 365 block my email forwarding?

Since 2020, Microsoft 365 tenants block automatic forwarding to external addresses by default via the outbound spam policy — the sender gets error 5.7.520, "your organization does not allow external forwarding." An admin can allow it for specific users with a custom outbound spam policy in the Defender portal (Policies → Anti-spam → automatic forwarding: On). Enable it per-user rather than tenant-wide.