There is a line we repeat around here so often it might as well be painted on the wall: the cloud is just someone else’s computer. Microsoft 365 is a wonderful someone else’s computer. Your email, your files, your Teams chats, all running in data centers with security most businesses could never afford to build. It is easy to assume backup is part of the deal.
It is not. Microsoft keeps the service running. Keeping your data is your job. That is not our cynical opinion, it is Microsoft’s official position, spelled out in the agreement nobody reads. And every year we meet another business that learns the difference at the worst possible moment, usually while staring at a mailbox that no longer exists.
Do Not Take Our Word for It. Take Microsoft’s.
Microsoft’s own Services Agreement says it plainly: “We recommend that you regularly backup Your Content and Data that you store on the Services or store using Third-Party Apps and Services.” That sentence sits in the section on service availability, right after Microsoft explains that outages happen. Elsewhere, the same agreement repeats the advice: you should have a regular backup plan. The company that runs the platform is telling you, in writing, to keep your own copy of what lives on it. That should settle the argument by itself.
None of this is Microsoft being sneaky, and it is not a knock on Microsoft 365, which we happily recommend. It is a reasonable division of labor. Microsoft cannot know whether a deletion was a mistake, a policy, or an attack. Only you can. So the platform treats every instruction as intentional, and it is very good at following instructions.
The Shared Responsibility Model, Translated
The industry calls this the shared responsibility model, which sounds like legal wallpaper but is actually simple. Microsoft is responsible for the infrastructure. You are responsible for what you put on it.
- Microsoft’s side of the deal: physically secure data centers, a platform with a 99.9 percent uptime commitment, patched systems, and copies of your data replicated between data centers so a hardware failure does not lose it.
- Your side of the deal: your users, your passwords, your settings, and above all your data. If something gets deleted, overwritten, encrypted by ransomware, or purged by a departing employee, recovering it is your responsibility, not Microsoft’s.
Notice what replication actually protects against: Microsoft’s hardware failing. It does not protect against you. If a file is deleted or corrupted, replication copies the deletion to every data center within moments. As backup vendor AvePoint puts it, replication faithfully copies deletions and corruptions. A perfect copy of a disaster is still a disaster.
Retention Is Not Backup
“But deleted items sit in the recycle bin,” someone always says. True, briefly. Microsoft 365’s built-in safety nets are retention features, and retention is measured in days.
- Exchange email: deleted items are kept for 30 days by default. After that, they are gone for good.
- OneDrive and SharePoint files: the recycle bin holds deleted files for 93 days. Then they are gone, and no phone call to Microsoft brings them back.
- Departed employees: when someone leaves and you remove their license, the clock starts on their mailbox and OneDrive too. We covered the money side of unused licenses in our post on neglected subscriptions, but the data side has sharper teeth. Reclaim a license without a plan and the data follows the employee out the door.
Retention also assumes the deletion was innocent. Attackers who compromise an account routinely empty recycle bins on the way out. Version history does not save you either, because it lives inside the same account that was just compromised. If the account can delete the file, the account can delete the history. A safety net you do not fully control is not a backup. A backup is an independent copy, stored outside the platform, that you can restore from a point in time you choose.
The Surprises We Actually See
The horror stories are rarely exotic. They are ordinary business events with a quiet fuse attached.
- The cleanup that went too far: someone tidies an old SharePoint library in March. In July, the auditor asks for those files. The 93 days are up.
- The ex-employee’s mailbox: a salesperson leaves, the license gets reclaimed to save money, and six months later a customer dispute needs their emails. There is nothing left to search.
- The ransomware sync: a laptop infection encrypts files, and OneDrive obediently syncs the encrypted versions over the good ones.
- The quiet corruption: a key spreadsheet breaks at some point nobody notices, and by the time anyone does, every copy in the version history is bad too.
What a Real Microsoft 365 Backup Looks Like
Fixing this is neither hard nor expensive, which makes the horror stories genuinely unnecessary. A proper Microsoft 365 backup is a third-party service that copies your mailboxes, OneDrive, SharePoint, and Teams data to storage outside Microsoft’s platform, several times a day, and keeps as much history as your business needs. Years, not 93 days.
Look for three things. Coverage of all the workloads you actually use, not just email. Retention you control, so a file deleted in March can be recovered in November. And restores that get tested, because a backup nobody has ever restored from is a rumor. If the cloud is just someone else’s computer, a real backup is you keeping your own copy of what lives there. And because the cloud can go down, that independent copy also covers you on the day the platform itself has a bad morning.
The Bottom Line
Microsoft 365 is a great platform, and Microsoft holds up its end of the deal. The service stays up, the hardware is protected, the data centers hum along. But Microsoft backs up Microsoft. Nobody backs up you unless you make it happen. Retention windows are safety nets with holes at 30 and 93 days, and the agreement you clicked through tells you outright to keep your own backup. The businesses that get burned are not careless. They just assumed the cloud came with a copy. It does not.
We set up and manage Microsoft 365 backup for small and mid-sized businesses across Denton County, usually for a few dollars per user per month, and we test the restores so you never have to wonder. If you are not sure what would happen to your data after a deletion, a departure, or a ransomware sync, let’s find out together before it matters. Contact us today.
Sources:
Comments are closed