Microsoft’s side and your side
Microsoft describes a shared responsibility model. Microsoft is responsible for the infrastructure: keeping data centers running, replicating data so a failed drive doesn’t lose it, and keeping the service available. You are responsible for the data itself: who can access it, what happens when it is deleted or changed, and how you get it back.
Replication protects against Microsoft losing your data. It does not protect you from your own users, a bad sync or an attacker, because every change, including a deletion, is replicated too.
Retention is not a backup
Deleted email sits in a recoverable folder for a limited time, SharePoint and OneDrive have recycle bins, and OneDrive can roll a whole library back to an earlier point within a window of recent days. Retention policies can hold data longer, but they are compliance tools, not a restore button.
All of these live inside the same Microsoft account. If someone with admin rights is compromised, or a problem is only noticed weeks later, they may not help.
The situations that catch businesses out
These are the requests we see most often:
- An employee deletes a folder and nobody notices until after the recycle bin has emptied.
- Ransomware on one laptop encrypts files that OneDrive then syncs to the cloud.
- A departing employee’s mailbox is removed with their license, and someone needs an email from it months later.
- A sync tool or migration overwrites a SharePoint library with older versions.
- An attacker with admin access deletes data and empties the recycle bins.
What a real Microsoft 365 backup includes
Our backup plans copy Exchange mailboxes, OneDrive, SharePoint and Teams to separate, immutable storage outside your Microsoft account, so an attacker who takes over your systems can’t reach or encrypt the backup. We test recovery on a regular schedule, so we know a restore works before you need it, and we manage the Microsoft 365 tenant itself: licenses, security settings and mailbox administration.