Microsoft 365 backup: why you need it

Responsibility is shared — even in the cloud

Microsoft 365 is built on a shared responsibility model. Microsoft ensures that the service runs: the infrastructure, the uptime, replication between data centres and protection against hardware failure. That is a high standard of availability, but it is not the same as a backup of your content. Replication means a file exists in several places at once — including the wrong version, if someone has deleted or overwritten it.

Responsibility for the data itself lies with you as the customer. This is stated in Microsoft’s own terms, which recommend using a third-party solution or your own routines to safeguard data. In other words, the platform guarantees that the system is up, but not that a particular email, folder or channel can be retrieved if it disappears through an error, an attack or a human decision.

It is worth understanding this boundary before you need it. The discussion about responsibility feels abstract until a concrete case arises: a customer asks for an old exchange of correspondence, an auditor requests a document, or a department discovers that an entire library has vanished. In those situations it does not help that the platform has had full uptime — what matters is whether you yourself have a copy you can restore from.

Why built-in retention is not a backup

Microsoft 365 has several mechanisms that resemble a backup: recycle bins, retention policies, version history and preservation of deleted mailboxes for a period. They are useful and solve many everyday mistakes, but they are designed for retention and compliance — not for full recovery. Recycle bins empty automatically after a fixed number of days, and once the deadline has passed, the data is gone.

A backup differs by being an independent copy that you control. It can restore data to a point in time before an incident, it is not tied to the same account or the same tenant, and it retains history beyond the standard deadlines Microsoft applies. If an account is compromised, or an administrator removes a retention policy by mistake, built-in retention does not necessarily protect the data — but a separate backup does.

This is not a criticism of Microsoft. The platform does exactly what it is meant to. The point is that retention and backup are two different disciplines, and confusing them is a common and costly misunderstanding.

The real risks

Most data loss in Microsoft 365 is not caused by Microsoft’s systems failing. It is caused by something that happens inside your own environment. An employee deletes a folder by mistake and only notices weeks later. A disgruntled user removes files deliberately before leaving. A ransomware attack encrypts files in OneDrive and SharePoint, and synchronisation spreads the encrypted versions. Or a former employee’s mailbox is cleared before anyone thinks about the missing customer correspondence it contained.

What these scenarios have in common is that the problem is often discovered after the built-in deadlines have expired. When a mistake only becomes visible months later, the recycle bin has long since emptied and the version history does not reach back far enough. This is exactly where an independent backup with longer retention makes the difference between an annoying loss and a genuine business crisis.

• Accidental deletion — folders or emails are removed by mistake and discovered too late.
• Malicious deletion — a user removes data deliberately, often just before leaving.
• Ransomware — encrypted files synchronise to OneDrive and SharePoint and overwrite the good versions.
• Retention gaps — data drops out of recycle bins and version history when the default deadlines expire.
• Former employees — mailboxes and files are cleared before anyone secures the necessary history.

What a proper backup covers

A comprehensive Microsoft 365 backup covers more than email. Exchange is the most obvious source, with mailboxes, calendars and contacts, but most companies have just as much critical content in OneDrive, SharePoint and Teams. OneDrive holds the individual employee’s documents, while SharePoint typically contains the shared sites, document libraries and the structure many departments work from every day.

Teams is often the most overlooked. A Teams channel is not a single system but a composite: conversations, files stored in the linked SharePoint, and settings. A backup that captures only the files but forgets the conversations gives a false sense of security. That is why it is important to clarify what the solution actually protects for each individual service — not simply that it says “Microsoft 365”.

A usable backup runs automatically at an agreed frequency, retains multiple versions over time and stores the copy separately from the environment it protects. That separation is crucial: if the backup sits in the same tenant and with the same access as the original, an attack or a compromised administrator account can hit both at once.

Recovery, GDPR and data location

A backup is only as good as the recovery it enables. The important question is not whether data is copied, but how quickly and how precisely you can get it back. Can you restore a single email without rolling back the entire mailbox? Can you retrieve an earlier version of one document? And how long does it take to recover an entire employee’s content after an incident? A recovery that has never been tested is really an assumption — not a safeguard.

Backup is also about compliance. Under GDPR you are the data controller for the personal data in your Microsoft 365, and a backup provider that processes the data on your behalf is a data processor. That requires a data processing agreement and a clear picture of where the copies are physically stored. For many companies it is a deliberate choice to keep data within the EU, out of regard for both legislation and customer expectations.

The goal is not fear, but a realistic picture. Microsoft 365 is a solid platform, and for most companies it is the right choice. A separate backup does not change that — it closes the gap the platform deliberately leaves to you, so that an accident, an attack or a departure does not turn into lost business.