Most businesses assume the cloud is the backup. Microsoft protects the platform, not your data, and the gap shows up at the worst possible moment. Here's how to check.
Ask a room of business owners where their company data lives and most will say the same thing: Microsoft 365. Ask who backs it up, and the answer is usually a shrug and some version of "Microsoft does, right?"
It's an understandable assumption, and it's half true in a way that matters.
What Microsoft actually provides
Microsoft keeps Microsoft 365 running. That's a serious commitment, and it includes real protections:
- Redundancy. Your data is stored in multiple copies across their infrastructure, so a failed disk or datacenter doesn't lose it.
- Recycle bins and versions. Deleted files and mail go to a recycle bin, and documents keep version history.
- Retention policies. Items can be held for a period, and legal holds are available on higher plans.
None of that is nothing. But notice what it's designed for. Microsoft's job is platform availability: keeping the service up and your data intact at the platform level. That is not the same as a backup of your data that you control, and the difference shows up at exactly the worst moment.
Where the gaps are
Retention is not a backup. A recycle bin holds something you deleted. It does not hold a point-in-time copy you can roll back to. If a file was altered repeatedly over months before anyone noticed, retention gives you the altered version plus version history within its limits, not a clean snapshot from before the problem started.
The windows are shorter than people think. By default, SharePoint and OneDrive recycle bins keep items for 93 days, and Exchange Online keeps deleted mail for 14 days. Those defaults are generous for everyday mistakes and far too short for the cases that hurt: a problem discovered six months later, a dispute that needs last year's correspondence, a compliance obligation measured in years. Your tenant's retention policies can change those numbers, so check them rather than assuming.
Deletion by a compromised account is the real risk. If an attacker gets in with valid credentials, or a departing employee decides to clean house, deleting data is a click. Recycle bins help only until someone with the right permissions empties them. An administrator account with the ability to purge can remove the safety net entirely.
Ransomware follows your sync client. This one is genuinely counterintuitive. When ransomware encrypts the files in a synced OneDrive folder, the sync client dutifully uploads the encrypted versions to the cloud. You now have a perfect cloud copy of encrypted garbage. Version history can help, but only within its retention limits and only if you catch it in time.
Recovering at scale is slow and manual. Pulling back an entire mailbox, or everything a former employee had access to, from recycle bins and versions is a manual, error-prone process, and it happens exactly when you have the least patience for it.
What a real backup looks like
The definition is simple, and it has very little to do with where the data currently lives:
- A separate copy, held outside your primary Microsoft 365 tenant
- Point-in-time snapshots, so you can restore to a moment before a problem started
- Granular restore, so you can get back one file, one mailbox, or one site
- Retention you set, measured in months or years rather than days
- A restore you have actually tested
That last point is the one that separates a backup from a hope.
Do you need it?
Not everyone does, and it is worth being honest about that.
You probably need a third-party backup if your data matters for compliance or disputes, if you've been through a data-loss scare, if you can't tolerate waiting out a restore window, or if email and file history are load-bearing for how you serve clients. Insurance and contractual requirements increasingly ask the question directly.
You can reasonably skip it if you're a very small team with little historical data and quick, tolerable recovery from the recycle bin.
The decision gets easier when you frame it as: what happens if we can't get this back? If the answer is "we rebuild in an hour," you're fine. If the answer is "we're in real trouble," you've just answered the question.
Three things to check this week
- Look at your actual retention windows. SharePoint, OneDrive and Exchange each have their own defaults, and tenant policies can change them.
- Try a restore. Delete a test file, restore it, and time it. Then ask who would do that for a mailbox, and how long it would take.
- Ask what happens if an admin account is compromised. If the honest answer is "we'd lose a lot and not know for a while," that's your priority.
The bottom line
Microsoft protects the platform. You are responsible for your data. Those are two different jobs, and only one of them can restore a file from eight months ago.
If you're not sure which side of that line your business sits on, a short conversation about recovery is worth more than a slide deck about it.