Microsoft 365 Backup: What Most Businesses Get Wrong

Here is something that catches a lot of businesses off guard: Microsoft does not automatically back up your Microsoft 365 data. Not your emails. Not your files on SharePoint or OneDrive. Not your Teams messages or channels. Not your contacts or calendar.

If data is accidentally deleted, overwritten or corrupted – by ransomware, by a mistake, by a departing employee – Microsoft is under no obligation to recover it for you. This is not buried in the small print. It is part of Microsoft’s documented service model. But it is still one of the most common misconceptions we encounter when talking to businesses about their IT set-up.

The shared responsibility model

Microsoft’s job with Microsoft 365 is to keep the platform running reliably. They maintain the servers, ensure uptime, manage the underlying infrastructure and handle platform-level incidents. That is what your subscription pays for.

Your data – the emails, documents, contacts, calendar entries, Teams files and SharePoint sites that your business actually creates and depends on – is your responsibility. Microsoft calls this the “shared responsibility model”, and it applies across their cloud services.

Microsoft does include some limited data recovery features. Deleted items in Exchange Online stay recoverable for up to 30 days by default. SharePoint and OneDrive have a recycle bin and a version history. Some higher-tier enterprise plans include extended retention options. But none of this is a true backup. It is short-term retention with important gaps – and it is not designed to protect you against the scenarios that actually cause data loss.

How Microsoft 365 data actually gets lost

Data loss in M365 happens more often than people expect, and not always through dramatic events. Common scenarios include:

• Accidental deletion. A staff member deletes a shared folder, empties the recycle bin or removes a SharePoint site. After 30 to 93 days (depending on your configuration), that data is gone permanently. By the time anyone notices it is missing, the recovery window has often closed.
• Ransomware. Ransomware can encrypt files stored in SharePoint and OneDrive just as it can local drives – particularly if a synchronised device is compromised. Microsoft’s retention may not be enough to recover a clean, pre-infection version of your files.
• Departing employees. A departing member of staff deletes their emails or files before leaving. By the time it is noticed, the deletion may be beyond the recovery window. If the account is removed as part of offboarding without properly preserving the data, it can be lost entirely.
• Licence cancellation. If you cancel a Microsoft 365 licence, Microsoft gives you a short grace period to export data. After that, it is deleted. If this is not managed carefully during staff changes or supplier switches, data goes with it.
• Sync errors and corruption. OneDrive sync conflicts or software issues can overwrite files with corrupt versions, sometimes silently and across multiple devices, before anyone notices something has gone wrong.

Retention policies are not the same as backup

Microsoft 365 does include compliance retention policies – these are tools that prevent certain content from being permanently deleted before a specified period. They are useful for regulated industries that need to demonstrate data retention. But they are not a backup.

Retention policies do not capture point-in-time snapshots of your data. They do not protect against corruption or ransomware. They do not let you restore a mailbox or a SharePoint site to exactly how it looked at 9am on a particular Tuesday. They are complex to configure correctly, and many businesses have them misconfigured or switched off entirely.

A proper backup does all of those things – it gives you a clean, independent copy of your data that you can restore to a specific point in time, regardless of what has happened in the meantime.

What proper Microsoft 365 backup looks like

Third-party backup solutions for Microsoft 365 – from providers such as Veeam, Acronis and Datto – connect to your M365 tenant and take regular automated snapshots of your data. These copies are stored independently of Microsoft’s infrastructure, which means they are protected even if something happens at the M365 platform level.

Good M365 backup should cover:

• Exchange Online (email, contacts, calendar)
• SharePoint Online (team sites and document libraries)
• OneDrive for Business (individual file storage)
• Microsoft Teams (channels, messages, shared files)

Restoration should be granular. You should be able to recover a single email, a specific folder, a document library or an entire mailbox to a chosen point in time – without needing to restore everything or contact Microsoft support.

How this fits your wider IT picture

M365 backup is one part of a broader data protection and business continuity picture. It sits alongside endpoint protection, patch management and secure configuration of your Microsoft 365 tenant itself. If you are not confident that all of these are in place and working correctly, a review is worthwhile.

Our managed IT services include Microsoft 365 management as standard – licensing, security configuration, user administration and backup. Our cloud systems support covers businesses moving to or already running cloud-based infrastructure, and we can advise on how to structure your M365 environment to minimise risk from day one.

If you are not sure how your current IT set-up handles data loss, our IT security team can carry out a straightforward review and give you a clear answer.

Get in touch

To find out whether your Microsoft 365 data is properly protected – or to discuss managed IT support more broadly – call us on 01452 701355 or contact us online. We will give you a straight answer about what you have in place and what, if anything, needs to change.