Many business owners assume that because their email and files are in Microsoft 365, they are backed up. Microsoft runs huge data centers, keeps multiple copies of everything, and rarely goes down. So what could go wrong?
Quite a lot, as it turns out. Microsoft protects the service from hardware failure and outages. It does not promise to bring back data that you, an employee or an attacker deleted or damaged. That gap is where businesses get caught out.
What Microsoft does and does not cover
Microsoft describes cloud security as a shared responsibility. In broad terms:
- Microsoft's job: keeping data centers running, replicating data so a failed server does not lose it, and keeping the platform available.
- Your job: managing who has access, protecting accounts, and controlling what happens to your data, including recovering it after deletion, corruption or attack.
Replication is not backup. If a file is deleted or encrypted by ransomware, that change is copied across Microsoft's systems just like any other change.
The built-in safety nets and their limits
Microsoft 365 does include some recovery features. They are useful, but each has a time limit or a catch.
- OneDrive and SharePoint recycle bins. Deleted files are kept for 93 days by default, then removed for good.
- Version history. Earlier versions of files can be restored, but only up to the number of versions your settings keep.
- Exchange recoverable items. Email that is removed from Deleted Items can usually be recovered for 14 days by default. An administrator can extend that to 30 days.
- Deleted users. When a user account is deleted, their mailbox and OneDrive are kept only for a limited period before they are removed. After that, the data is gone unless something else preserved it.
These windows are fine for a file someone deleted yesterday. They do not help when a problem is discovered two months later, which is common with slow, quiet data loss.
Retention policies are not backup either
Microsoft Purview retention policies and holds can stop content from being permanently deleted for a set period. That is valuable for records management and legal holds. But retention is designed to preserve content for search and discovery, not to restore a mailbox or a SharePoint site to how it looked last Tuesday.
Restoring from retained content is often slow and manual. It does not bring back folder structure, permissions or a full site in one step. And if an attacker gains admin access, retention settings can be changed. Retention rules may also have compliance implications, so confirm any requirements with your legal or compliance adviser before changing them.
Common ways businesses lose Microsoft 365 data
- An employee deletes a folder by mistake and nobody notices until after the recycle bin has emptied.
- Ransomware on a laptop encrypts files, and OneDrive sync uploads the encrypted copies.
- A departing employee's account is deleted before anyone exports their mailbox or files. Our employee offboarding checklist covers how to avoid this.
- A compromised account is used to delete email or files on purpose.
- A sync tool or migration overwrites good data with old or empty copies.
What a proper Microsoft 365 backup looks like
A dedicated backup service copies your Microsoft 365 data on a schedule and stores it separately from your production tenant. Both Microsoft and third-party providers offer products for this. When choosing one, look for:
- Coverage of everything you use: Exchange mailboxes, OneDrive, SharePoint sites and Teams files and conversations.
- Frequent backups, ideally several times a day.
- Long retention that matches how far back you might need to go, often a year or more.
- Separate storage and credentials, so a compromised Microsoft 365 admin account cannot also delete the backups.
- Granular restore, from a single email to a whole mailbox or site, back to the original location or a new one.
- Monitoring and alerts when a backup job fails.
Test it before you need it
A backup you have never restored is only a hope. Once a backup is in place, restore a few items each quarter: an email, a file and a folder. Confirm they come back complete and in the right place. Write down how long it took, so you know what to expect in a real incident.
Getting help
Creative IT USA sets up and monitors Microsoft 365 backup for businesses across Los Angeles County, the Inland Empire and Ventura County. See our managed cloud backup and Microsoft 365 services, or ask us to review what your tenant can and cannot recover today.