“It’s in the cloud, so it’s backed up.” That sentence, said confidently in thousands of businesses, contains one of the most expensive misunderstandings in modern IT. Microsoft 365 keeps your email, files and Teams data extraordinarily safe from *Microsoft’s* problems: their data centres are replicated, resilient and about as unlikely to lose your data through hardware failure as anything on Earth. What Microsoft does not protect you from is you: your deletions, your mistakes, your compromised accounts, your departed employee’s purged mailbox, your ransomware.
That split is called the shared responsibility model, Microsoft documents it openly, and this page explains where the line sits, what the built-in safety nets actually catch, and why a separate backup of your Microsoft 365 data is standard practice rather than paranoia.
The shared responsibility model in one paragraph
Microsoft’s responsibility is the service: uptime, infrastructure, and their side of security. Your responsibility is the data: what gets created, changed, deleted, and by whom, whether the “whom” is a careless click, a malicious insider, a hijacked account or a sync agent faithfully propagating encrypted files. Microsoft replicates your data flawlessly, and that is exactly the problem: replication copies your disasters with the same fidelity as your documents. A deletion replicates. Encryption replicates. Replication is availability, not backup.
What the built-in safety nets actually catch
Microsoft 365 does include recovery features, and being precise about them matters, because they are genuinely useful and genuinely limited:
- Recycle bins: deleted SharePoint and OneDrive files are recoverable for up to 93 days across the two-stage bin; deleted emails follow mailbox-level recovery windows, typically weeks. Good for “I deleted the wrong file on Tuesday”; useless for anything discovered later.
- Version history: previous versions of Office files in SharePoint and OneDrive, which can roll back an individual mangled document, and sometimes helps after ransomware if the attacker was unsophisticated.
- Deleted-user retention: a departed employee’s OneDrive and mailbox survive for a limited window (roughly 30 days by default) after their account is deleted, then they are gone. Offboarding processes discover this line the hard way.
- Retention policies and litigation hold: genuinely powerful compliance tools that can preserve content for years, but they are preservation, not restore: getting a usable, structured recovery of “everything as it was on March 4th” out of retention holds is somewhere between painful and impossible, and they only preserve what the policy covered.
Notice the shape of all four: short windows, per-item recovery, and dependence on someone noticing the loss quickly. What none of them provide is the thing backup means: independent, point-in-time copies of the whole estate, restorable in bulk, on your timescale, held beyond the reach of whatever caused the loss.
The scenarios where the gap bites
Five patterns account for most real-world Microsoft 365 data loss:
- Late-discovered deletion. The folder deleted in January, needed in June: past every recycle-bin window, unrecoverable. Human error is the leading cause of cloud data loss, and its defining feature is that nobody notices at the time.
- Ransomware via sync. OneDrive’s desktop sync is a two-way street: files encrypted on an infected laptop sync upward and overwrite, and version-history recovery at estate scale is slow, partial and race-against-retention. The ransomware playbook treats M365 as inside the blast radius, because it is.
- The compromised account. An attacker in a mailbox can delete, forward and purge; an attacker with admin rights can empty recycle bins too. Everything reachable from your credentials shares your credentials’ fate: the same logic that makes immutable backup the ransomware answer applies to cloud data.
- Offboarding loss. The ex-employee’s account deleted in a tidy-up, their mailbox and files discovered missing when a client dispute surfaces months later.
- Malicious insiders. Rare, memorable, and precisely the scenario where recovery must not depend on permissions the insider held.
What proper Microsoft 365 backup looks like
Third-party M365 backup services exist because of everything above: they take automated, versioned, point-in-time copies of Exchange mailboxes, OneDrive, SharePoint and Teams data into independent storage outside your tenancy, with retention measured in months or years rather than bin-windows, and restore tooling built for both “one email from last spring” and “this user’s entire mailbox as of yesterday”. Costing is per user per month at pocket-money rates (typically £2 to £5), which is why it is unremarkable plumbing in any serious setup rather than a premium add-on.
Run as part of a managed arrangement (it is a standard layer in our Backup as a Service), it inherits the disciplines that make any backup real: monitored jobs, scheduled test restores, and retention set to your obligations. And to head off the licensing question: no Microsoft 365 plan tier includes this, so upgrading plans does not close the gap; the plan comparison covers what the tiers actually buy. Microsoft itself now sells a native backup product as a paid extra, which says the quiet part about the built-in features plainly enough.
Frequently asked questions
Does Microsoft 365 back up my data automatically?
It replicates your data for availability and provides limited recovery windows (recycle bins, version history), but it does not create independent point-in-time backups. Microsoft’s shared responsibility model explicitly leaves data protection with you.
How long does Microsoft 365 keep deleted files and emails?
Roughly: up to 93 days for SharePoint and OneDrive files through the two-stage recycle bin, shorter default windows for mail recovery, and about 30 days for a deleted user’s content. After those windows, without separate backup, the data is gone.
Can OneDrive version history save us from ransomware?
Sometimes, partially, slowly: per-file rollback exists, but estate-wide recovery through version history is impractical at scale and the sync that spread the encryption may also churn versions. Independent backup restores the estate in bulk to a chosen point.
Do retention policies count as backup?
No: they preserve content for compliance and legal discovery, which is different from being able to restore structured data quickly. Preservation answers “prove what existed”; backup answers “put it all back”.
What does Microsoft 365 backup cost?
Typically £2 to £5 per user per month for third-party backup covering mail, OneDrive, SharePoint and Teams, with long retention and proper restore tooling. It is included in our managed backup arrangements rather than sold separately.
We’re a small business. Is this really necessary?
The gap does not scale with size; a ten-person firm loses its mailboxes as permanently as a corporation. The question is only whether your data matters beyond 93 days, and for business records the answer is usually contractual, not optional.
Check where your line actually sits
Ten minutes with your tenancy answers the real questions: what your current recovery windows are, what a departed user’s data fate is, and whether anything would survive a synced ransomware run. That check is part of our free IT health check, alongside the rest of your backup posture. Get in touch before the June discovery of the January deletion.
