What Microsoft 365 Backup is
Microsoft 365 Backup is the backup service built into the Microsoft 365 admin centre. It protects three things — Exchange Online mailboxes, OneDrive accounts and SharePoint sites, which Microsoft calls 'protection units' — and it is designed for speed of recovery from ransomware, mass deletion and malicious overwrite rather than for archival. Microsoft Learn puts restore performance at up to 1,000 average-sized sites, accounts or mailboxes at a median rate of one to three terabytes an hour, which no export-based third-party tool can match because the data never leaves Microsoft's storage. Setting it up needs a SharePoint Administrator or Global Administrator, an Azure subscription for billing, and backup policies per service; tenants onboarding after 1 April 2026 use the newer pay-as-you-go setup under the Billing node (checked September 2026).
How the per-GB pricing works
Microsoft 365 Backup is consumption-priced: the list price is US$0.15 per gigabyte of protected content per month, billed to a linked Azure subscription with no per-user licence (checked September 2026 on Microsoft Learn). Protected content is the user-facing size of the live site or account including its first-stage recycle bin, plus the second-stage recycle bin for SharePoint and OneDrive, plus deleted and versioned items in mailboxes. Microsoft publishes a pricing calculator and notes that costs never rise for a unit after it is removed from a policy. Billing is in US dollars through Azure, so model the AUD exposure at the prevailing rate. For a 50-user tenant holding two terabytes across mailboxes and SharePoint, the arithmetic is around US$300 a month before growth — cheaper than most per-seat products at that data volume, dearer at very large ones.
What it does not cover
The limits follow from the scope. Microsoft's documentation lists exactly three protected services, so anything else in the tenant is outside it: Teams chat and channel messages (channel files live in SharePoint and are covered, the conversations are not), Planner, Loop workspaces, Entra ID users and groups, Intune policies, Power Platform apps and flows, and everything on premises. The recovery window is configurable from three months to two years, so it is not a seven-year retention tool — that is Purview retention's job. Restore points for OneDrive and SharePoint are ten-minute for the first two weeks and weekly after that out to 52 weeks (Exchange keeps ten-minute points for the full year), so an accidental overwrite discovered five months later restores to the nearest week. And the copy sits with the same vendor as the primary: fast, immutable and inside the compliance boundary, but not independent.
Versus third-party backup
Third-party Microsoft 365 backup products still exist because they answer the questions Microsoft's service does not: an independent copy held with a different vendor, Teams chat coverage, multi-year retention, per-user pricing that is easier to budget, and export to a customer-controlled location. Some of those vendors now build on Microsoft 365 Backup Storage, which gives them Microsoft's restore speed with their own management layer. Frontrow's rule for an Australian SMB: if the risk you are buying against is ransomware and mass deletion, the native service is the fastest recovery available and should be the first layer; if you also need an independent copy for insurer, auditor or regulator reasons, add a third-party product and size the native policy to the fast-restore window only.
Does Microsoft 365 back up your data by default?
No. Without Microsoft 365 Backup or a third-party product, a tenant relies on recycle bins, file versioning and any Purview retention policies an admin has configured. Those are resilience features that expire or can be emptied, not point-in-time backups, and Microsoft's own overview frames Backup as the answer to the ransomware and accidental-deletion scenarios those features do not fully cover. Microsoft's platform is highly redundant against hardware failure — that is the part of the shared-responsibility model Microsoft carries. Recovering what a user, an attacker or a misconfigured sync client destroyed is the customer's responsibility, and it is also the third Essential Eight strategy every Australian assessor asks about first. If the answer today is 'the recycle bin', the answer is no.