"It's in the cloud, so it's backed up" is one of the most common and most costly assumptions in small business IT. Microsoft 365 is a highly reliable service, but reliability of the platform and recoverability of your data are two different things. Microsoft is clear about this in its own documentation, under what it calls the shared responsibility model.
What Microsoft Is Responsible For
Microsoft is responsible for the availability and resilience of the service itself — its data centres, hardware, network and the software that runs Exchange Online, SharePoint, OneDrive and Teams. If a Microsoft data centre has a hardware failure, your service carries on. That is the part Microsoft takes care of, and does well.
What You're Responsible For
Your data, your users and your accounts are your responsibility. Microsoft will faithfully replicate whatever happens to your data, including the things you would rather it didn't:
- Accidental deletion. A user deletes a folder, or an administrator removes an account. The deletion is synchronised everywhere, quickly and correctly.
- Malicious deletion. A disgruntled leaver, or an attacker with a compromised account, deletes or overwrites content on purpose.
- Ransomware and sync. Encrypted files can sync to OneDrive and SharePoint, replacing good versions with encrypted ones.
- Compromised accounts. Attackers who gain access to a mailbox can delete mail and cover their tracks.
- Leavers. Licences removed without the data being retained can result in mailboxes and OneDrive content being deleted after a set period.
"But there's a recycle bin." There is, and it helps with simple mistakes — but its limits matter. Deleted items in Exchange Online are retained for a short default period (14 days, extendable to 30), and SharePoint and OneDrive recycle bins hold content for around 93 days. After that, it's gone. That's a safety net for the odd mistake, not a backup.
Retention Is Not the Same as Backup
Microsoft 365 offers retention policies and litigation hold, and these are valuable for compliance. But their purpose is to keep content available for legal and regulatory reasons, not to give you a point-in-time recovery you can restore from. Retention keeps what exists; backup lets you go back to how things were before something went wrong. The two answer different questions.
What Independent Backup Adds
- Separation. A copy held outside your Microsoft 365 tenant survives a tenant-level incident, such as a compromised administrator account.
- Point-in-time restore. You can recover a mailbox, a site or a folder as it was on a given date, rather than relying on what the recycle bin still holds.
- Longer retention. Data can be kept for as long as your business requires, not just for the platform's default windows.
- Granular recovery. Restoring a single email or file without rolling back everything else.
- A cleaner leaver process. Data from departed staff can be retained without paying for a licence to keep their account alive.
What to Check in Your Own Setup
- What is backed up? Exchange, OneDrive, SharePoint and Teams data are separate things, and not every product covers all of them.
- Where does the backup live? It should be separate from the tenant it protects.
- How long is data kept? Check this against your business and regulatory needs.
- Has a restore ever been tested? This is the question that matters most. A backup that has never been restored is an assumption. See our guide on continuity and disaster recovery planning.
- Is it protected from the same attack? The backup should not be reachable using the same credentials an attacker would steal to get into Microsoft 365.
Questions worth asking your IT provider: Do we have a backup of our Microsoft 365 data that is independent of Microsoft? Which services does it cover? When did we last restore something from it, and how long did that take?
The Bottom Line
Microsoft 365 is dependable, and moving to it is usually the right call. But it is a service, not a safety net for your data. A separate, tested backup is inexpensive relative to the cost of discovering the gap at the moment you need to recover something.