Microsoft 365 is not backed up the way you think

The shared responsibility gap

Microsoft 365 is built to be highly available. Microsoft replicates data across its data centres so that a hardware failure or a site outage does not lose your mail or files. That protects you from Microsoft’s problems.

It does not protect you from your own. If a user deletes a folder, a script overwrites a SharePoint library, ransomware encrypts synced OneDrive files, or an attacker with admin rights purges mailboxes, the platform does exactly what it was told. Replication faithfully copies the deletion too.

Replication protects you from Microsoft’s problems. It faithfully copies your own mistakes.

What the native safety nets cover

Microsoft 365 does include recovery features, and they are worth understanding precisely. Defaults change, so check Microsoft’s current documentation for your plan:

• SharePoint and OneDrive recycle bins keep deleted items for 93 days by default across both stages, after which they are gone.
• Deleted Exchange items are kept in Recoverable Items for 14 days by default, which administrators can extend to 30.
• When a user account is deleted, the account and its mailbox can be restored for 30 days.
• Retention policies and litigation hold can preserve content far longer, but they are compliance tools. Restoring from them at scale is slow and was never their purpose.

These are safety nets, and good ones. They are not a backup: they live inside the same tenant, are governed by the same admin accounts, and have windows that close.

Five scenarios to test against

1. Accidental deletion found lateA project folder deleted in January is needed in June. The recycle bin window has passed.
2. Ransomware through syncAn infected laptop encrypts files that OneDrive dutifully syncs. Version history helps, but restoring thousands of files by hand is not a plan.
3. A compromised administratorAn attacker with global admin rights deletes mailboxes and shortens retention. Anything inside the tenant is within their reach.
4. Departed employeesLicences are removed to save cost and the mailbox and OneDrive disappear with them, along with records the business still needs.
5. Tenant migration or misconfigurationA migration script or a policy change goes wrong and overwrites content across many sites at once.

What a proper Microsoft 365 backup looks like

• Independent of the tenant: stored outside Microsoft 365, under separate administrator credentials protected by MFA.
• Complete: Exchange mail, OneDrive, SharePoint and Teams data, including channel files and conversations where supported.
• Retention set by business need and regulation, not by the platform’s default windows.
• Granular restore: one email, one file or a whole site, back to its original place or somewhere new.
• Tested regularly, with the results recorded, just like any other backup.