Microsoft 365 is not backing up your data

It is in the cloud, so it is backed up. That sentence costs UK businesses real money every year, and it is built on a misunderstanding of what Microsoft actually sells you.

What Microsoft actually promises

Microsoft operates a shared responsibility model, and it is published openly. Their side is the service: the infrastructure, the uptime, protection against their own hardware failing. They replicate your data across datacentres so that a fire in one building does not take your email with it.

Your side is the data itself. Microsoft is not responsible for a user deleting a folder, a leaver taking files with them, ransomware encrypting a document library, or anyone noticing any of it six months later. That is yours, and the tools to recover from it are limited.

How long deleted things actually survive

The recycle bin feels like a safety net until you read the numbers. Deleted email sits in the recoverable items area for a default period measured in days rather than months, and once that window closes the message is gone from a user perspective.

SharePoint and OneDrive give you a first stage recycle bin and then a second stage for administrators, and together they add up to a few months at most. When an account is deleted, the associated OneDrive is retained for a default period and then removed. These are grace periods for recent mistakes. They are not an archive.

A recycle bin protects you from last Tuesday. It does nothing about a problem you discover next year.

The four ways data actually goes missing

Accidental deletion is the common one and the least dramatic. Someone clears out what looks like an old folder, and it turns out to be the only copy of something that mattered.

Offboarding is the quiet one. A member of staff leaves, the licence gets removed to save money, and the mailbox and OneDrive go with it. Nobody notices until the person who inherited the role needs something from that mailbox.

Ransomware is the loud one. Encrypted files on a laptop sync cheerfully up to OneDrive and SharePoint, and version history helps only if you catch it inside the window and only if the attacker did not exhaust the versions first.

And then there is the departure nobody plans for, where someone on the way out deletes deliberately. Retention and audit matter precisely because you cannot predict that one.

Retention policies are not backup either

Retention policies are genuinely useful and worth configuring. They are built for compliance, though, not recovery. They keep data discoverable for a legal or regulatory window, not restorable to a folder structure your team can use on a Tuesday morning.

Try recovering a department worth of files from a retention policy under time pressure and the difference becomes obvious very quickly.

What a real Microsoft 365 backup looks like

• An independent copy held outside the tenant, not inside it
• Coverage across Exchange, OneDrive, SharePoint and Teams, including chat
• Retention you choose, measured in years rather than days
• Point in time restore, so you can go back to before the damage
• Granular recovery of a single message or file, not just a whole mailbox
• Restores tested on a schedule, with someone accountable for the test

That last point is the one that gets skipped. A backup nobody has restored from is a theory. The first restore should happen on a quiet afternoon of your choosing, not during the week everything is on fire.

Where to start

Find out what you have today. Check whether anything is backing up your tenant beyond Microsoft defaults, how long your retention windows actually are, and what your offboarding process does with a leaver mailbox. Most businesses that run this check find at least one gap, and finding it on a Tuesday is considerably cheaper than finding it any other way.