Email administrators migrating from on-premise Exchange to Exchange Online often carry an assumption with them: that the cloud version handles backup the same way, or better. It doesn't. On-premise Exchange had native backup tools, integration with Windows Server Backup, and brick-level recovery options. Exchange Online has retention policies, litigation holds, and a deleted items folder — none of which are a backup in the traditional sense.
The distinction matters most when something actually goes wrong.
The Soft Delete Window
When a user deletes an email in Exchange Online, it moves to the Deleted Items folder. When they empty that, it moves to the Recoverable Items folder — the "dumpster" — where it sits for 14 days by default, or 30 days if the mailbox has an Exchange Online Plan 2 license. After that window, it's purged permanently.
Litigation holds and retention policies extend this by keeping data in the Recoverable Items folder beyond the normal purge window — but that data is only accessible through eDiscovery or compliance search, not through a simple admin restoration. You can't just "restore" an email from a litigation hold like you'd restore from a backup.
When an employee's account is deleted — which happens constantly in organizations with any staff turnover — their mailbox enters a soft-delete state. It stays accessible for 30 days (30-90 days with certain license types), then it's permanently deleted. If you need to access that person's email a year later for an audit, and the account was fully deleted without a hold, there's nothing to retrieve.
What Mailbox-Level Corruption Looks Like
Beyond the deletion window problem, there are failure modes that retention policies can't help with at all. Malicious inbox rules — a common BEC tactic — can silently delete or redirect emails as they arrive. A compromised account that's been quietly deleting inbound emails from certain contacts for three months won't have those emails in any litigation hold, because they were deleted before retention captured them.
Folder structure corruption, accidental bulk-delete by PowerShell scripts, calendar corruption — these are operational problems that need backup-style recovery: point-in-time restoration to a known-good state. Retention policies are compliance tools. They preserve data for legal purposes; they don't enable operational recovery.
What Proper Exchange Online Backup Covers
A proper Exchange Online backup captures mailbox content — messages, attachments, calendar items, contacts, notes, and folder structure — on a scheduled basis and stores it outside the M365 tenant. Recovery is at any level of granularity: a single email, a folder, an entire mailbox, or a calendar range.
North Brook Vault uses the Microsoft Graph API to capture Exchange Online data with delta sync — on each backup run, only changes since the last snapshot are pulled, keeping backup windows short and storage efficient. Backups store to your own S3-compatible storage, isolated from your M365 tenant's security perimeter.
The practical implication is that a compromised admin credential — the most common attack vector for M365 breaches — cannot reach your backup. The attacker can delete mailboxes, purge retention holds, and destroy evidence of their access. Your backup stays intact because it was written with Object Lock to immutable storage and is inaccessible from the tenant side.
For organizations under HIPAA, FINRA, SEC 17a-4, or similar data retention mandates, independent Exchange Online backup isn't just operationally smart — it's frequently required by the letter of the regulation. Litigation holds are good for compliance. Backup is what saves you when the litigation hold wasn't in place before the incident.