World Backup Day falls on 31 March. It is a good moment to clear up one of the most common assumptions we meet: “our email and files are in Microsoft 365, so they are backed up.”
They are not, at least not in the way most people mean.
What Microsoft promises, and what it does not
Microsoft runs Microsoft 365 on a shared responsibility model. Microsoft is responsible for the service: its data centres, its hardware, keeping Exchange, SharePoint, OneDrive and Teams available. You are responsible for your data: who can see it, who can delete it, and getting it back when something goes wrong.
Microsoft does keep copies of your data across its own systems, but those copies exist to keep the service running if a server fails. They are not there so you can restore a mailbox to how it looked last Tuesday.
The recycle bins are not a backup
Microsoft 365 has some safety nets, and they are useful, but each has a limit:
Deleted email sits in the recoverable items folder for 14 days by default (an administrator can extend this to 30). After that, it is gone.
SharePoint and OneDrive keep deleted files in a recycle bin for up to 93 days, and OneDrive can roll a whole library back up to 30 days.
Leavers’ accounts are kept for 30 days after the account is deleted. If nobody notices the missing project folder until month two, it cannot be recovered.
Retention policies are a compliance tool. They stop data being deleted, but they are not designed for quick, granular restores, and they need to be set up correctly before you need them.
Where businesses actually lose data
In our experience, lost data is rarely Microsoft’s fault. It is usually one of these:
Ransomware. Encrypted files on a laptop sync straight up to OneDrive and SharePoint, replacing the good copies.
Accidental deletion. Someone tidies up a shared folder, or a sync goes wrong, and it is weeks before anyone notices.
Malicious deletion. A disgruntled leaver or a compromised account deletes mail or files on purpose.
Licence housekeeping. A leaver’s licence is removed to save money, and their mailbox goes with it.
In every case, the built-in options either do not reach back far enough or restore too much at once.
What good looks like
A proper backup of Microsoft 365 follows the same rules as any other backup:
A separate copy, held outside your Microsoft 365 tenant, so one compromised account cannot delete both.
Enough history to go back months, not days.
Granular restores: one email, one folder, one Teams channel, without rolling everything else back.
Regular test restores, because a backup nobody has tested is only a hope.
The old 3-2-1 rule still holds: three copies of your data, on two different types of storage, with one copy off site.
Check yours this week
Ask yourself three questions: if a member of staff deleted a shared folder six weeks ago, could you get it back? If your Microsoft 365 account were compromised, would your backup be safe? When did you last test a restore?
If the answer to any of those is “not sure”, our backup and recovery service covers Microsoft 365 email and files alongside your servers and laptops, with restores tested so we know they work. Talk to us or call 01642 661888.