Ask most business owners whether their Microsoft 365 data is backed up and you get a confident yes. It is in the cloud, after all. Microsoft look after it.
It is one of the most common and most expensive misunderstandings in business IT. Microsoft do not back up your data in the way you almost certainly think they do, and the gap only becomes obvious at the worst possible moment. Here is what is actually covered, where the holes are, and what to do about it.
What Microsoft actually promises
Microsoft operate what they call a shared responsibility model. Put simply: Microsoft are responsible for keeping the service running. You are responsible for your data.
They guarantee the platform is available, resilient and protected against their own hardware failures. If a Microsoft data centre has a problem, that is their job to fix, and they are very good at it. What they do not promise is to recover data that you or your staff delete, overwrite or lose. That part is yours.
But there is a recycle bin, isn't there?
There is, and this is exactly where the false sense of security comes from. Microsoft 365 includes some short-term safety nets:
- Deleted emails sit in Deleted Items, then in a recoverable folder for a limited period, typically a couple of weeks by default.
- Files removed from SharePoint and OneDrive go to a recycle bin, usually recoverable for around 90 days.
- Office files keep a version history, so you can roll back recent changes.
These are genuinely useful, and they will rescue you from an "oops, I deleted that this morning" moment. But they are retention windows, not backup. They are short, they can be shortened or emptied by an administrator, and once the window closes the data is gone for good. The exact periods vary depending on your licences and how your tenant is set up, which is part of the problem in itself: most businesses have never checked what theirs are.
Four ways businesses actually lose Microsoft 365 data
These are the real-world causes we see, and none of them are Microsoft's fault:
1. Accidental deletion. Far and away the most common. Someone tidies up a mailbox or deletes a folder they assumed was old. Nobody notices for months. By the time anyone goes looking, the retention window closed long ago.
2. A departing employee. Staff leave, and to save the licence cost the account gets deleted. In Microsoft 365, removing a user takes their mailbox and their OneDrive with it. If that person held years of correspondence, or the only copy of something important, that goes too.
3. Ransomware. This one catches people out badly. If a computer is encrypted by ransomware and that computer syncs OneDrive or SharePoint, the encrypted files sync straight up to the cloud and overwrite the good copies. "It is in the cloud" offers no protection at all here.
4. Malicious deletion. Rarer, but it happens. Someone with access and a grudge can delete a great deal very quickly, and empty the recycle bin behind them.
Why the gaps bite so hard
The pattern is almost always the same. The loss is discovered long after it happened, usually because someone goes looking for an old email or a signed contract and finds nothing. By then you are outside the retention window, and there is no button anyone at Microsoft or at your IT provider can press to bring it back.
It matters more than it used to, as well. If you need to produce correspondence for a dispute, an insurance claim or an audit, "we lost it" is a genuinely serious answer to have to give.
What proper backup looks like
A real Microsoft 365 backup keeps an independent copy of your data, outside Microsoft, that you control. In practice it should:
- Cover the lot: Exchange mailboxes, SharePoint, OneDrive and Teams
- Run automatically every day, with nobody having to remember
- Let you restore a single email or file, not just everything at once
- Keep history for as long as your business actually needs, not a fixed few weeks
- Be tested, so you know a restore works before the day you need it
That last point is the one most people skip. A backup nobody has ever restored from is a hope, not a plan.
How we handle it
For the businesses we look after, Microsoft 365 backup is built into their backup and disaster recovery setup rather than bolted on as an afterthought. We back the whole tenant up to a separate location, set retention to match what the business genuinely needs, and test restores so there are no nasty surprises. It sits alongside the rest of the Microsoft 365 and cloud work we do, so it is one less thing on your plate.
A five-minute check
If you take one thing from this, make it this question, and put it to whoever looks after your IT: "If someone deleted an important mailbox today and we did not notice for six months, could we get it back?"
If the answer is anything other than a straightforward yes, you have a gap worth closing. We are happy to take a look and tell you honestly where you stand.