Microsoft 365 Is Not a Backup: What It Does and Doesn't Protect

The most common thing we hear during a backup review is some version of “we’re on Microsoft 365, so it’s all in the cloud.” It’s an understandable assumption. It’s also wrong in a way that only becomes visible on the worst possible day.

Resilience is not backup

Microsoft and Google run enormous, redundant infrastructure. If one of their data centres loses a disk — or an entire building — your mailbox survives, because it’s replicated elsewhere. That’s resilience: protection against their failures.

Backup is something different: an independent copy of your data, held separately, that you can restore from after your failure. And most data loss is not caused by a data centre fire. It’s caused by:

• Someone deleting a folder they shouldn’t have
• A former employee’s mailbox being removed along with their licence
• A compromised account whose attacker deletes or encrypts data
• Ransomware on a synced laptop pushing encrypted files into OneDrive
• A sync tool or integration that overwrites good data with bad

In every one of those cases, the platform does exactly what it was told to do. It has no way to know the instruction was a mistake.

What the platforms actually keep

Deleted items go to a recycle bin or recoverable-items folder with a default retention window measured in weeks. Once that expires, the data is gone. Version history helps with individual files but is impractical for restoring an entire mailbox or a whole SharePoint site.

Microsoft’s own services agreement recommends that customers regularly back up their content. That line is doing a lot of work, and very few people have read it.

The shared responsibility gap

Cloud providers describe this as a shared responsibility model: they’re responsible for the platform, you’re responsible for the data. The gap between those two sentences is where businesses lose years of email.

What proper protection looks like

1. An independent backup of mail, OneDrive, SharePoint and Teams — or the Google Workspace equivalents — held outside the tenant, so a compromised admin account can’t delete it.
2. Retention that matches your obligations, not the platform’s defaults.
3. Restores you’ve actually tested. A backup nobody has restored from is a hope, not a control.

We cover this in detail in our infrastructure and backup practice, and in the situation most of our backup clients start from: we don’t really have a backup system.