Did you know you are responsible for protecting your Office 365 data?

Ask most business owners who is responsible for backing up their Microsoft 365 data and you'll get the same answer: "Microsoft, surely?" It's an understandable assumption, and it's wrong in a way that only becomes obvious after data is already gone.

Microsoft operates a shared responsibility model. They're responsible for the platform. You're responsible for your data.

What Microsoft actually protects

Microsoft guarantees the infrastructure: uptime, physical security of the datacentres, and replication of the service itself. If a datacentre fails, your mailbox still works. That's what the 99.9% availability SLA covers.

Microsoft's own Services Agreement is explicit that you should regularly back up content you store on the service. It's in the terms, it just isn't in the sales conversation.

What Microsoft does not protect

• Accidental deletion. An email deleted from Deleted Items sits in recoverable items for 14–30 days by default. After that it's gone.
• Deliberate deletion. A departing employee clearing their mailbox and SharePoint folders on their last afternoon is a scenario we've dealt with more than once.
• Ransomware. Files encrypted on a laptop sync straight to OneDrive and SharePoint in their encrypted state. The sync does exactly what it's designed to do.
• Retention policy gaps. Delete a user licence and the mailbox is removed after 30 days. If someone leaves in March and you need their emails in June, they may not exist.
• Malicious insiders and compromised accounts. An attacker inside a mailbox can delete, forward and destroy. Native recovery windows are short.

The version history and recycle bin in SharePoint and OneDrive help with small mistakes. They are not a backup, they're limited, time-bound, and they replicate the damage in a sync-based attack.

The gap in numbers

Most Microsoft 365 recovery windows land between 14 and 93 days depending on configuration. Most businesses discover they need historic data well outside that window: a legal dispute, an HR case, an audit, or a client query about a project from two years ago.

For regulated sectors this matters more. Firms in legal and financial services frequently have retention obligations measured in years, not weeks.

What a proper Microsoft 365 backup looks like

A third-party backup takes an independent copy of your tenant and stores it outside Microsoft's environment. In practice you want:

1. Full coverage, Exchange Online mailboxes, OneDrive, SharePoint sites and Teams (including chat and channel files, which are stored in different places).
2. Multiple daily backups, not just one overnight run.
3. Long or unlimited retention aligned to your compliance obligations.
4. Granular restore, pull back a single email or file without restoring an entire mailbox.
5. Immutable storage so an attacker with admin credentials can't delete the backups too.
6. A tested restore. An untested backup is a hope, not a plan.

This is exactly what our backup and disaster recovery service delivers, and it's the first thing we check during any Microsoft 365 support onboarding.

The related security question

Backup protects you after the event. Most Microsoft 365 data loss starts with a compromised account, so the two go together. If you haven't already, enforce multi-factor authentication across every account, our guide to securing your Office 365 email for free walks through it, and layer on endpoint protection so ransomware never reaches the sync client in the first place.

If you're storing files in SharePoint and OneDrive, structure matters too. A sensible SharePoint and OneDrive setup makes both permissions and restores dramatically simpler.

What to do this week

1. Check your current retention settings in the Microsoft 365 admin centre. Note the actual number of days.
2. Identify who would notice if a SharePoint site was deleted, and how long it would take them to notice.
3. Ask whoever provides your IT whether you have a third-party 365 backup, and when it was last restored from.
4. If the answer to any of those is unclear, treat it as a risk, not an inconvenience.

Getting it sorted

Microsoft 365 is an excellent platform. It just isn't a backup platform, and assuming otherwise is one of the most common gaps we find when taking on a new client across Birmingham and the West Midlands.

If you'd like us to check what's actually protected in your tenant, get in touch, the review is free and takes about half an hour.