Microsoft 365 does not back up your data. At least not in the way you think it does.

Today, trust is placed in the cloud that companies once built for their own server in the hallway. Microsoft 365 is stable, accessible from anywhere and technically impeccably managed, which leads to the assumption that it also takes care of your data. The reality is different: Microsoft guarantees service availability, not a backup of your content. This difference becomes apparent only when something is irretrievably lost.

What Microsoft actually promises

The shared responsibility model used by Microsoft (and indeed every major cloud provider) divides data care into two parts. Microsoft manages the infrastructure, servers run, data centres are backed up against outages, and replication between locations works. The customer is responsible for content, what is in mailboxes, SharePoint, and OneDrive. If a user accidentally deletes a folder, an administrator overwrites a file with the wrong version, or ransomware synchronously encrypts the entire OneDrive, it is the company's problem, not Microsoft's.

The basket and version history are not a backup.

M365 offers several built-in mechanisms that are easily confused with backups. Deleted emails can be retrieved from the Deleted Items folder and, after emptying it, remain recoverable for a while in Recoverable Items. Files in OneDrive and SharePoint have a recycle bin and version history. This sounds like a backup, and for common "I accidentally deleted one file five minutes ago" scenarios, it works. The problem is the window during which this protection applies: typically tens of days, not months or years. And if an entire user account or an entire team in Teams is deleted, the associated history and recycle bin disappear with it.

When retention is insufficient

In practice, you will encounter retention limits in situations that are not rare: an employee deletes project files before leaving because they consider them "their work" and do not want to leave a trace. Ransomware reaches a shared folder and encrypts thousands of files before anyone notices, and more than a month passes before you realise what has happened. A poorly configured retention policy deletes data before someone manages to need it. Or simply, someone deletes a team in Teams along with the entire SharePoint because they thought it was unused. Similarly, during data cleanup, an entire file library may be accidentally moved and overwritten, version history will only help with what was captured before the overwrite, not with files permanently deleted outside the retention window. In all these cases, the recycle bin and version history will not help.

What a genuine advance payment means

A true backup is an independent copy of data stored outside the primary storage, with its own retention period that you define: not the platform's default settings. For M365, this means deploying a specialised backup tool for Exchange, SharePoint, OneDrive and Teams that retains historical versions according to your policy (for example, years back, not weeks) and can restore individual items or entire accounts. Separation is also crucial: a backup residing in the same environment as production data is vulnerable to the same attack. And a backup you have never tested for restoration is merely an assumption of a backup, not actual protection.

How to do it in practice

First, verify whether you actually have such a system, many companies discover that the only data protection in place is the built-in one mentioned above. Then simply follow a few steps:

• Verify whether you have a separate backup for Exchange, SharePoint, OneDrive and Teams in addition to the built-in recycle bin and version history.
• Set retention based on actual data needs, financial documents differ from work notes: not according to the tool's default value.
• Separate the backup from the production environment so that it is not affected by the same attack as the original.
• Carry out a test recovery once in a while, only then will you know if it actually works and how long it takes.

Backup is part of the core security architecture of M365, just as MFA and conditional access - both address different risks, but neither works automatically without configuration.

If you are unsure about the actual state of your environment, we will gladly carry out a quick audit and tell you straight where the greatest risk lies.